Edit tour

Windows Analysis Report
http://morestrategic11688.lt.emlnk9.com

Overview

General Information

Sample URL:	http://morestrategic11688.lt.emlnk9.com
Analysis ID:	1436586
Infos:

Errors URL not reachable

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1924,i,1791445331178183765,13985730309241529132,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1780 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:/// MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=2008,i,9554993435019489605,13314209667266238359,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://morestrategic11688.lt.emlnk9.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 927sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_80.3.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_86.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_86.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_80.3.dr, chromecache_86.3.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_86.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_86.3.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_86.3.dr	String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: chromecache_86.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_80.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_80.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_80.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_80.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_80.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_86.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_86.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_86.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_86.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_86.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_80.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_80.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_80.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: unknown0.win@27/14@8/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1924,i,1791445331178183765,13985730309241529132,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=2008,i,9554993435019489605,13314209667266238359,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://morestrategic11688.lt.emlnk9.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1924,i,1791445331178183765,13985730309241529132,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=2008,i,9554993435019489605,13314209667266238359,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://morestrategic11688.lt.emlnk9.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
http://www.broofa.com	0%	URL Reputation	safe
https://csp.withgoogle.com/csp/lcreport/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	172.217.2.206	true	false	high
play.google.com	172.217.2.206	true	false	high
www.google.com	192.178.50.68	true	false	high
morestrategic11688.lt.emlnk9.com	44.218.159.243	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
windowsupdatebg.s.llnwi.net	208.111.136.0	true	false	unknown
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://apis.google.com	chromecache_80.3.dr, chromecache_86.3.dr	false		high
http://www.broofa.com	chromecache_80.3.dr	false	URL Reputation: safe	unknown
https://csp.withgoogle.com/csp/lcreport/	chromecache_86.3.dr	false	URL Reputation: safe	unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_86.3.dr	false		high
https://domains.google.com/suggest/flow	chromecache_86.3.dr	false		high
https://clients6.google.com	chromecache_86.3.dr	false		high
https://plus.google.com	chromecache_86.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.178.50.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
54.236.118.117	unknown	United States	14618	AMAZON-AESUS	false
3.217.82.240	unknown	United States	14618	AMAZON-AESUS	false
172.217.2.206	plus.l.google.com	United States	15169	GOOGLEUS	false
44.218.159.243	morestrategic11688.lt.emlnk9.com	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436586
Start date and time:	2024-05-06 04:46:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://morestrategic11688.lt.emlnk9.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	UNKNOWN
Classification:	unknown0.win@27/14@8/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.217.238, 142.250.64.163, 142.251.107.84, 34.104.35.123, 192.178.50.35, 23.199.14.95, 20.114.59.183, 208.111.136.0, 192.229.211.108, 13.95.31.18, 13.85.23.206, 20.166.126.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2294)
Category:	downloaded
Size (bytes):	163286
Entropy (8bit):	5.544045381504343
Encrypted:	false
SSDEEP:	3072:CMiFOP4roKgkk/EFZMQbxjZW1BKo6JMI6l0nt8Uv1ziwtXOmDsY+WwYLF/HrY7+A:CMiroKfbMQbxjZW1BKo6JMI6l0nt8Uvq
MD5:	9D9987F6E83F101A097A0BD64A14C71B
SHA1:	E71E10897E0E874DE4D12125D5DF2F7FCE08F585
SHA-256:	D0975FC00A61201A54714BE8DF5E50F02B277E133BA08ABD9DEEA33934FA28A9
SHA-512:	5AE557145F0E0FF3E768AFC63B3E4855F53DCA49D46A22ACB169CC6DC58FF2B11C776B419141EB12C8B0CF7BBD16E928F9EE5AF5014DD976130B00A1995B325E
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ics7SFQVxbg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTtpRznzVJk75Y4TcT-zpGGUjebtAg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.cj=function(a,b,c){return c?a\|b:a&~b};_.dj=function(a,b,c,d){a=_.jb(a,b,c,d);return Array.isArray(a)?a:_.kc};_.ej=function(a,b){a=_.cj(a,2,!!(2&b));a=_.cj(a,32,!0);return a=_.cj(a,2048,!1)};_.fj=function(a,b){0===a&&(a=_.ej(a,b));return a=_.cj(a,1,!0)};_.gj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.hj=function(a,b,c){32&b&&c\|\|(a=_.cj(a,32,!1));return a};._.ij=function(a,b,c,d,e,f){var g=!!(2&b),h=g?1:2;const k=1===h;h=2===h;e=!!e;f&&(f=!g);g=_.dj(a,b,d);var l=g[_.v]\|0;const n=!!(4&l);if(!n){l=_.fj(l,b);var p=g,t=b,r;(r=!!(2&l))&&(t=_.cj(t,2,!0));let B=!r,aa=!0,K=0,F=0;for(;K<p.length;K++){const ba=_.Ua(p[K],c,t);if(ba instanceof c){if(!r){const Ca=!!((ba.ka[_.v]\|0)&2);B&&(B=!Ca);aa&&(aa=Ca)}p[F++]=ba}}F<K&&(p.length=F);l=_.cj(l,4,!0);l=_.cj(l,16,aa);l=_.cj(l,8,B);_.ya(p,l);r&&Object.freeze(p)}c=!!(8&l)\|\|k&&!g.length;if(f&&!c){_.gj(l)&&(g=_.xa(g),.l=_.ej(l,b),b=_.ib(a,b,d,g));f=g;c=l;for(p=0;p<f.length;p++)l=f[p],t=_

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3572)
Category:	downloaded
Size (bytes):	3577
Entropy (8bit):	5.836021721323345
Encrypted:	false
SSDEEP:	96:7VUliNRpDD0InCdSqTIgYOgu1Z6eiCMYOjfffQfo:7AoDD08RgYOgu1Z5nAb
MD5:	E5B6DD27BD357DAEE845EA286313E7B0
SHA1:	93657E0B07E3698520CF3AF14D3DC601EC320424
SHA-256:	DBD2C3038E4C12DD46474F42F2190AC68F064551C63650BB474B5B611BE202E5
SHA-512:	60A26FF68BD0EEFBB943C559BC181BA1CC3B16DAEB77C2FE530719CCE02E9556173A9DE5E3B57971FDE002FD1AEC9E8913A30CAC81B79A3AF645BB392A8D5CD4
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["women bears","netflix movies","paul skenes pirates","apple ipad pro event","nascar cup series kansas speedway","wayfair deals","ai randy travis song","unc basketball"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wZnBnY2pqEhBBZHZlbnRIZWFsdGggNDAwMpoPZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFFQUFBQUFqQ0FNQUFBQVQxL3dZQUFBQllsQk1WRVgvLy8vOS92MEFTWStidzVmUjNPWXllM1lBVFpJQVZwTFAyOUlBQUFEUDNkWUxXcFFBV0pNSE0xb0lPV1dIbWJRQVRwQ0hvTUhZNGVucTcvSlpncXYwOS9nQVU1RUFKVndBTDJxYjAxeUhsS3UvemRzQVA0ZXdzN2U2djhiUjF0cmk1T1k2YjU5R2RxU3R3Tk9PcXNYTHpNNEFIRThBTm0zdy9PRUFJVkFLU0hlKzRaZDZsbGtBRTBaZWhDMEFMMkJvaTYrVm5hU1J6T29xcStBQXBlTFE2UFNoMGVtcTEzZHRpWWtBTnlpQ3d6ZzliMnZ2OStjZlk1bWZ0TXQwbGJjQUYzaWd0TFVBQUR4WWFYdC9pNWtsUGxaV2I0cHNnWlVxVTNwS1hIRWFQMkN0cktjOVEwby9VMjRBS0ZDOXZic0FEempjNXM

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3572), with no line terminators
Category:	downloaded
Size (bytes):	3572
Entropy (8bit):	5.140651484312947
Encrypted:	false
SSDEEP:	48:vZUJVKLICJEconBdpZUvGCUvGULHg7OTehn5hsbrc7g8IO8u0Y8D2n:yJYI/coXqCg7OSfg8IO8uB8D2n
MD5:	122C0858F7D38991F14E5ADC6BDB3C3B
SHA1:	FFC64755EB42990A73C4878426A641CFB94B57EE
SHA-256:	06D1296A6F6611AC795B27882FE88823EE857D0F49F7018CF00C6A199976DC0D
SHA-512:	149A1FB533C8C7D5EA363B80982DC1EC4C39E5EF9BB37E45BC80E105B18C3FA4DC610449BBD70DE9B9AC7339FEBBBD4FF76C2A9D1FD104D1943A386539AC4D44
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.RS0dNtaZmo0.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuhe2hCYlalU7rKCW-qT_-zMhVRaw"
Preview:	.gb_2e{background:rgba(60,64,67,.9);-webkit-border-radius:4px;border-radius:4px;color:#fff;font:500 12px "Roboto",arial,sans-serif;letter-spacing:.8px;line-height:16px;margin-top:4px;min-height:14px;padding:4px 8px;position:absolute;z-index:1000;-webkit-font-smoothing:antialiased}.gb_Fc{text-align:left}.gb_Fc>*{color:#bdc1c6;line-height:16px}.gb_Fc div:first-child{color:white}.gb_pa{background:none;border:1px solid transparent;-webkit-border-radius:50%;border-radius:50%;-webkit-box-sizing:border-box;box-sizing:border-box;cursor:pointer;height:40px;margin:8px;outline:none;padding:1px;position:absolute;right:0;top:0;width:40px}.gb_pa:hover{background-color:rgba(68,71,70,.08)}.gb_pa:focus,.gb_pa:active{background-color:rgba(68,71,70,.12)}.gb_pa:focus-visible{border-color:#0b57d0;outline:1px solid transparent;outline-offset:-1px}.gb_i .gb_pa:hover,.gb_i .gb_pa:focus,.gb_i .gb_pa:active{background-color:rgba(227,227,227,.08)}.gb_i .gb_pa:focus-visible{border-color:#a8c7fa}.gb_qa{-webkit-box

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	137077
Entropy (8bit):	5.441087690090085
Encrypted:	false
SSDEEP:	1536:jdGuEyNn2zuFRDP6nWysx3DMqPKnrzNSpGiV1p+RHPGb4gujfL8jZRLM9rZxMkPr:DXnoap3DTKnrQpG4nQUdu06ZxMkmwXd
MD5:	85CCBEAB3F39DCB81C3658609AEE0CCD
SHA1:	C638C493B5A57D8FD86F3B20E289E5DA4963F0C4
SHA-256:	FD9FFE6EDA9CA1A64F7675FB0B6CB4E5D79BD98ABA1B18585FFBAA68095FCC52
SHA-512:	033FC828330E6FF6F8CE9AFF719ED23688D32BA950F7389D25F28E529C7377D7E241FF3883E257977D5579F5B5B597687AFA4847A9754683F3858B314328065E
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Qa gb_hb gb_Td gb_nd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Hd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_rd gb_kd gb_xd gb_wd\"\u003e\u003cdiv class\u003d\"gb_qd gb_gd\"\u003e\u003cdiv class\u003d\"gb_Oc gb_q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Oc gb_Rc gb_q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2124)
Category:	downloaded
Size (bytes):	121628
Entropy (8bit):	5.506662476672723
Encrypted:	false
SSDEEP:	3072:QI9yvwslCsrCF9f/U2Dj3Fkk7rEehA5L1kx:l9ygsrieDkVaL1kx
MD5:	F46ACD807A10216E6EEE8EA51E0F14D6
SHA1:	4702F47070F7046689432DCF605F11364BC0FBED
SHA-256:	D6B84873D27E7E83CF5184AAEF778F1CCB896467576CD8AF2CAD09B31B3C6086
SHA-512:	811263DC85C8DAA3A6E5D8A002CCCB953CD01E6A77797109835FE8B07CABE0DEE7EB126274E84266229880A90782B3B016BA034E31F0E3B259BF9E66CA797028
Malicious:	false
Reputation:	low
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 04:47:06.495325089 CEST	49675	443	192.168.2.4	173.222.162.32
May 6, 2024 04:47:08.640486956 CEST	49678	443	192.168.2.4	104.46.162.224
May 6, 2024 04:47:16.104137897 CEST	49675	443	192.168.2.4	173.222.162.32
May 6, 2024 04:47:16.204758883 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.204837084 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.204917908 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.204943895 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.204977989 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.205054045 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.205118895 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.205131054 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.205178976 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.205255985 CEST	49736	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.205276012 CEST	443	49736	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.205317974 CEST	49736	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.205491066 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.205523014 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.205604076 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.205615044 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.205729008 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.205740929 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.205866098 CEST	49736	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.205876112 CEST	443	49736	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.444536924 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.444876909 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.444890976 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.444901943 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.445137978 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.445156097 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.445868015 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.445955038 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.446173906 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.446229935 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.447067022 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.447129011 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.447180033 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.447242975 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.447422028 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.447427988 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.447474957 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.447480917 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.448043108 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.448045015 CEST	443	49736	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.448257923 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.448298931 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.448334932 CEST	49736	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.448347092 CEST	443	49736	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.449315071 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.449354887 CEST	443	49736	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.449378967 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.449409962 CEST	49736	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.450323105 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.450396061 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.450442076 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.451086044 CEST	49736	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.451148033 CEST	443	49736	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.496109962 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.510293007 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.553354979 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.553586960 CEST	49736	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.553595066 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.553599119 CEST	443	49736	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.553622961 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.666532993 CEST	49736	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.666785002 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.698676109 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.698720932 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.698774099 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.698781013 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.700382948 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.700798988 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.701035976 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.701965094 CEST	49733	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.701975107 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.701993942 CEST	443	49733	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.702060938 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.706377029 CEST	49735	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.706382036 CEST	443	49735	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.724302053 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.724349022 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.724390984 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.724422932 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.724430084 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.724450111 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.724459887 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.731004953 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.731045008 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.731050968 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.738725901 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.738753080 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.738790035 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.738795996 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.738836050 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.746365070 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.754018068 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.754053116 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.754065037 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.833936930 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.834007978 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.834022999 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.837676048 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.840845108 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.840867996 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.846965075 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.848856926 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.848862886 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.853002071 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.856833935 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.856839895 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.860661983 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.860726118 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.860729933 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.868361950 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.868827105 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.868834019 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.878570080 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.880945921 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.880954027 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.884282112 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.884938002 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.884965897 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.890273094 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.892827988 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.892833948 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.904608011 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.904644012 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.904701948 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.904711962 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.904814959 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.911720991 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.918745041 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.918780088 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.918801069 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.918812990 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.918859005 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.925893068 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.943430901 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.943487883 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.943644047 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.943670988 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.943717957 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.946995974 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.953952074 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.953980923 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.954140902 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.954149961 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.954189062 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.960566044 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.966656923 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.966691971 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.966741085 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.966749907 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.966887951 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.972805023 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.972861052 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.972901106 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.972909927 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.978979111 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.980827093 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.980833054 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.984935999 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.987592936 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.987598896 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.990823030 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.992108107 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.992114067 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.996659040 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:16.996818066 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:16.996823072 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.005428076 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.005459070 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.005494118 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.005500078 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.008810043 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.011315107 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.017019987 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.017050028 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.017086983 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.017096043 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.020819902 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.022283077 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.027311087 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.027339935 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.027375937 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.027388096 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.028017998 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.032221079 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.036746025 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.036775112 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.036808014 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.036813974 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.040818930 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.041367054 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.045783043 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.045857906 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.045893908 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.045900106 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.048814058 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.050091982 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.054388046 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.054416895 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.054451942 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.054457903 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.056817055 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.058649063 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.063004971 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.064311981 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.064340115 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.064349890 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.064357042 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.064369917 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.067027092 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.068814993 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.068820000 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.069674969 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.069720030 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.069724083 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.072272062 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.072812080 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.072815895 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.075346947 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.075414896 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.075423002 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.077490091 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.080138922 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.080168009 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.080185890 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.080192089 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.080212116 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.082781076 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.084820032 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.084825993 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.097358942 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.097389936 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.097414970 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.097421885 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.097430944 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.097451925 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.100420952 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.100451946 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.100455999 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.100495100 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.100528002 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:17.100532055 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.100656986 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:17.100812912 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:18.087182045 CEST	49734	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:18.087203979 CEST	443	49734	192.178.50.68	192.168.2.4
May 6, 2024 04:47:19.753135920 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:19.753151894 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:19.753377914 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:19.754858017 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:19.754870892 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:19.993170023 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:19.993482113 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:19.993491888 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:19.994447947 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:19.994832993 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.184319973 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.184319973 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.184338093 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.184453964 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.259608030 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.259615898 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.298311949 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.298345089 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.298372984 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.298401117 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.298405886 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.298422098 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.298434019 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.299087048 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.299091101 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.305821896 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.305963039 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.305970907 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.313541889 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.313746929 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.313754082 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.321211100 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.321346045 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.321352959 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.368969917 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.368976116 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.407726049 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.408611059 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.408617973 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.411506891 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.411732912 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.411740065 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.419228077 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.420726061 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.420732021 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.426911116 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.432884932 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.432892084 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.434570074 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.434673071 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.434679985 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.442198992 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.442682028 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.442688942 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.449851990 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.450089931 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.450097084 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.457014084 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.457149982 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.457155943 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.464179993 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.464386940 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.464394093 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.471328020 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.471448898 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.471455097 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.478375912 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.478807926 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.478815079 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.485563040 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.485783100 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.485790014 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.492692947 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.493119001 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.493125916 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.499804974 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.499907970 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.499918938 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.517345905 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.517563105 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.517570019 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.520565987 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.520759106 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.520765066 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.526412964 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.526895046 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.526901960 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.532094955 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.532216072 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.532222986 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.537606001 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.538017035 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.538022995 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.542674065 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.542892933 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.542901039 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.547966957 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.548090935 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.548103094 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.553250074 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.553657055 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.553663969 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.558588028 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.559206009 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.559212923 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.563829899 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.563946009 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.563952923 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.571748018 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.571774960 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.576642990 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.576649904 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.576772928 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.577044010 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.582324028 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.582350016 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.582600117 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.582607985 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.582856894 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.587595940 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.592895985 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.592921972 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.593007088 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.593015909 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.593065977 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.597897053 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.602870941 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.602931976 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.603029013 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.603035927 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.603142977 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.607707977 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.612297058 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.612420082 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.612426996 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.616714001 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.619779110 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.619786024 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.621192932 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.622150898 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.622158051 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.625516891 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.625747919 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.625755072 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.631824017 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.631851912 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.635126114 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.635133982 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.635410070 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.636166096 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.640371084 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.640398026 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.640422106 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.640430927 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.643033981 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.643062115 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.643069983 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.645687103 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.645802021 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.645808935 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.645915985 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.648185015 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.648297071 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.651058912 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.681490898 CEST	49744	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.681500912 CEST	443	49744	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.783097029 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.783159018 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:20.783220053 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.783591986 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:20.783612013 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:21.020284891 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:21.046369076 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:21.046380043 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:21.046725035 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:21.046781063 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:21.047331095 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:21.047383070 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:21.876851082 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:21.877041101 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:21.877203941 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:21.877218008 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:21.877278090 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:21.924122095 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:22.137048006 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:22.137168884 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:22.137224913 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:22.206607103 CEST	49745	443	192.168.2.4	172.217.2.206
May 6, 2024 04:47:22.206634045 CEST	443	49745	172.217.2.206	192.168.2.4
May 6, 2024 04:47:26.434191942 CEST	443	49736	192.178.50.68	192.168.2.4
May 6, 2024 04:47:26.434250116 CEST	443	49736	192.178.50.68	192.168.2.4
May 6, 2024 04:47:26.440813065 CEST	49736	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:26.564506054 CEST	49736	443	192.168.2.4	192.178.50.68
May 6, 2024 04:47:26.564531088 CEST	443	49736	192.178.50.68	192.168.2.4
May 6, 2024 04:47:42.197016001 CEST	49754	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:42.197519064 CEST	49755	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:42.330815077 CEST	80	49754	44.218.159.243	192.168.2.4
May 6, 2024 04:47:42.331434965 CEST	80	49755	44.218.159.243	192.168.2.4
May 6, 2024 04:47:42.339775085 CEST	49756	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:42.473278999 CEST	80	49756	44.218.159.243	192.168.2.4
May 6, 2024 04:47:42.835254908 CEST	49754	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:42.835257053 CEST	49755	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:42.972438097 CEST	80	49755	44.218.159.243	192.168.2.4
May 6, 2024 04:47:42.972455025 CEST	80	49754	44.218.159.243	192.168.2.4
May 6, 2024 04:47:42.986974955 CEST	49756	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:43.120445967 CEST	80	49756	44.218.159.243	192.168.2.4
May 6, 2024 04:47:43.487118959 CEST	49754	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:43.502741098 CEST	49755	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:43.621047974 CEST	80	49754	44.218.159.243	192.168.2.4
May 6, 2024 04:47:43.628926992 CEST	49756	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:43.636548042 CEST	80	49755	44.218.159.243	192.168.2.4
May 6, 2024 04:47:43.762301922 CEST	80	49756	44.218.159.243	192.168.2.4
May 6, 2024 04:47:44.126468897 CEST	49754	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:44.143105030 CEST	49755	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:44.260221958 CEST	80	49754	44.218.159.243	192.168.2.4
May 6, 2024 04:47:44.266815901 CEST	49756	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:44.276901960 CEST	80	49755	44.218.159.243	192.168.2.4
May 6, 2024 04:47:44.400285959 CEST	80	49756	44.218.159.243	192.168.2.4
May 6, 2024 04:47:44.760854006 CEST	49754	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:44.792146921 CEST	49755	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:44.894722939 CEST	80	49754	44.218.159.243	192.168.2.4
May 6, 2024 04:47:44.900994062 CEST	49756	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:44.913718939 CEST	49757	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:44.925959110 CEST	80	49755	44.218.159.243	192.168.2.4
May 6, 2024 04:47:44.961908102 CEST	49758	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:45.034490108 CEST	80	49756	44.218.159.243	192.168.2.4
May 6, 2024 04:47:45.039252043 CEST	49759	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:45.047952890 CEST	80	49757	54.236.118.117	192.168.2.4
May 6, 2024 04:47:45.095885992 CEST	80	49758	54.236.118.117	192.168.2.4
May 6, 2024 04:47:45.173484087 CEST	80	49759	54.236.118.117	192.168.2.4
May 6, 2024 04:47:45.562643051 CEST	49757	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:45.609807968 CEST	49758	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:45.688891888 CEST	49759	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:45.698539972 CEST	80	49757	54.236.118.117	192.168.2.4
May 6, 2024 04:47:45.743886948 CEST	80	49758	54.236.118.117	192.168.2.4
May 6, 2024 04:47:45.823195934 CEST	80	49759	54.236.118.117	192.168.2.4
May 6, 2024 04:47:46.203744888 CEST	49757	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:46.248882055 CEST	49758	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:46.337424994 CEST	49759	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:46.338007927 CEST	80	49757	54.236.118.117	192.168.2.4
May 6, 2024 04:47:46.382848978 CEST	80	49758	54.236.118.117	192.168.2.4
May 6, 2024 04:47:46.472899914 CEST	80	49759	54.236.118.117	192.168.2.4
May 6, 2024 04:47:46.839766026 CEST	49757	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:46.885777950 CEST	49758	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:46.975058079 CEST	80	49757	54.236.118.117	192.168.2.4
May 6, 2024 04:47:46.976536036 CEST	49759	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:47.019800901 CEST	80	49758	54.236.118.117	192.168.2.4
May 6, 2024 04:47:47.110851049 CEST	80	49759	54.236.118.117	192.168.2.4
May 6, 2024 04:47:47.479445934 CEST	49757	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:47.526299000 CEST	49758	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:47.613763094 CEST	80	49757	54.236.118.117	192.168.2.4
May 6, 2024 04:47:47.615149021 CEST	49760	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:47.619808912 CEST	49759	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:47.660284042 CEST	80	49758	54.236.118.117	192.168.2.4
May 6, 2024 04:47:47.683409929 CEST	49761	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:47.748832941 CEST	80	49760	3.217.82.240	192.168.2.4
May 6, 2024 04:47:47.754013062 CEST	80	49759	54.236.118.117	192.168.2.4
May 6, 2024 04:47:47.756822109 CEST	49762	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:47.817096949 CEST	80	49761	3.217.82.240	192.168.2.4
May 6, 2024 04:47:47.892191887 CEST	80	49762	3.217.82.240	192.168.2.4
May 6, 2024 04:47:48.264511108 CEST	49760	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:48.327269077 CEST	49761	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:48.398286104 CEST	80	49760	3.217.82.240	192.168.2.4
May 6, 2024 04:47:48.398315907 CEST	49762	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:48.461019993 CEST	80	49761	3.217.82.240	192.168.2.4
May 6, 2024 04:47:48.532087088 CEST	80	49762	3.217.82.240	192.168.2.4
May 6, 2024 04:47:48.901335955 CEST	49760	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:48.965626955 CEST	49761	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:49.035103083 CEST	80	49760	3.217.82.240	192.168.2.4
May 6, 2024 04:47:49.047377110 CEST	49762	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:49.099653006 CEST	80	49761	3.217.82.240	192.168.2.4
May 6, 2024 04:47:49.182158947 CEST	80	49762	3.217.82.240	192.168.2.4
May 6, 2024 04:47:49.548444033 CEST	49760	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:49.604717016 CEST	49761	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:49.682328939 CEST	49762	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:49.683150053 CEST	80	49760	3.217.82.240	192.168.2.4
May 6, 2024 04:47:49.739717960 CEST	80	49761	3.217.82.240	192.168.2.4
May 6, 2024 04:47:49.817672968 CEST	80	49762	3.217.82.240	192.168.2.4
May 6, 2024 04:47:50.185504913 CEST	49760	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:50.248074055 CEST	49761	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:50.319274902 CEST	80	49760	3.217.82.240	192.168.2.4
May 6, 2024 04:47:50.321129084 CEST	49762	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:50.381856918 CEST	80	49761	3.217.82.240	192.168.2.4
May 6, 2024 04:47:50.455095053 CEST	80	49762	3.217.82.240	192.168.2.4
May 6, 2024 04:47:51.359081984 CEST	49764	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:51.359085083 CEST	49763	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:51.492918015 CEST	80	49764	44.218.159.243	192.168.2.4
May 6, 2024 04:47:51.492928028 CEST	80	49763	44.218.159.243	192.168.2.4
May 6, 2024 04:47:51.611989975 CEST	49765	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:51.745520115 CEST	80	49765	44.218.159.243	192.168.2.4
May 6, 2024 04:47:51.993982077 CEST	49763	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:51.994738102 CEST	49764	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:52.130476952 CEST	80	49763	44.218.159.243	192.168.2.4
May 6, 2024 04:47:52.131031990 CEST	80	49764	44.218.159.243	192.168.2.4
May 6, 2024 04:47:52.260341883 CEST	49765	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:52.393944979 CEST	80	49765	44.218.159.243	192.168.2.4
May 6, 2024 04:47:52.636935949 CEST	49764	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:52.636938095 CEST	49763	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:52.770821095 CEST	80	49764	44.218.159.243	192.168.2.4
May 6, 2024 04:47:52.770838976 CEST	80	49763	44.218.159.243	192.168.2.4
May 6, 2024 04:47:52.897691965 CEST	49765	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:53.031348944 CEST	80	49765	44.218.159.243	192.168.2.4
May 6, 2024 04:47:53.270220995 CEST	49763	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:53.286221027 CEST	49764	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:53.404161930 CEST	80	49763	44.218.159.243	192.168.2.4
May 6, 2024 04:47:53.420027018 CEST	80	49764	44.218.159.243	192.168.2.4
May 6, 2024 04:47:53.538763046 CEST	49765	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:53.672298908 CEST	80	49765	44.218.159.243	192.168.2.4
May 6, 2024 04:47:53.905031919 CEST	49763	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:53.931627989 CEST	49764	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:54.039598942 CEST	80	49763	44.218.159.243	192.168.2.4
May 6, 2024 04:47:54.057389021 CEST	49766	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:54.066299915 CEST	80	49764	44.218.159.243	192.168.2.4
May 6, 2024 04:47:54.085573912 CEST	49767	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:54.177895069 CEST	49765	80	192.168.2.4	44.218.159.243
May 6, 2024 04:47:54.191380978 CEST	80	49766	54.236.118.117	192.168.2.4
May 6, 2024 04:47:54.219599009 CEST	80	49767	54.236.118.117	192.168.2.4
May 6, 2024 04:47:54.311453104 CEST	80	49765	44.218.159.243	192.168.2.4
May 6, 2024 04:47:54.312335968 CEST	49768	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:54.446635962 CEST	80	49768	54.236.118.117	192.168.2.4
May 6, 2024 04:47:54.697277069 CEST	49766	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:54.729168892 CEST	49767	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:54.831516027 CEST	80	49766	54.236.118.117	192.168.2.4
May 6, 2024 04:47:54.863209009 CEST	80	49767	54.236.118.117	192.168.2.4
May 6, 2024 04:47:54.948446989 CEST	49768	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:55.082827091 CEST	80	49768	54.236.118.117	192.168.2.4
May 6, 2024 04:47:55.339662075 CEST	49766	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:55.371767998 CEST	49767	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:55.474092007 CEST	80	49766	54.236.118.117	192.168.2.4
May 6, 2024 04:47:55.506021023 CEST	80	49767	54.236.118.117	192.168.2.4
May 6, 2024 04:47:55.596544027 CEST	49768	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:55.731618881 CEST	80	49768	54.236.118.117	192.168.2.4
May 6, 2024 04:47:55.979650021 CEST	49766	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:56.006531954 CEST	49767	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:56.114497900 CEST	80	49766	54.236.118.117	192.168.2.4
May 6, 2024 04:47:56.142412901 CEST	80	49767	54.236.118.117	192.168.2.4
May 6, 2024 04:47:56.245007992 CEST	49768	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:56.380141973 CEST	80	49768	54.236.118.117	192.168.2.4
May 6, 2024 04:47:56.617842913 CEST	49766	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:56.651732922 CEST	49767	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:56.751837969 CEST	80	49766	54.236.118.117	192.168.2.4
May 6, 2024 04:47:56.752234936 CEST	49769	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:56.785727978 CEST	80	49767	54.236.118.117	192.168.2.4
May 6, 2024 04:47:56.786055088 CEST	49770	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:56.885656118 CEST	80	49769	3.217.82.240	192.168.2.4
May 6, 2024 04:47:56.889733076 CEST	49768	80	192.168.2.4	54.236.118.117
May 6, 2024 04:47:56.919831991 CEST	80	49770	3.217.82.240	192.168.2.4
May 6, 2024 04:47:57.024065018 CEST	80	49768	54.236.118.117	192.168.2.4
May 6, 2024 04:47:57.024380922 CEST	49771	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:57.157824039 CEST	80	49771	3.217.82.240	192.168.2.4
May 6, 2024 04:47:57.399358988 CEST	49769	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:57.431072950 CEST	49770	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:57.532810926 CEST	80	49769	3.217.82.240	192.168.2.4
May 6, 2024 04:47:57.564769983 CEST	80	49770	3.217.82.240	192.168.2.4
May 6, 2024 04:47:57.665760994 CEST	49771	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:57.799221039 CEST	80	49771	3.217.82.240	192.168.2.4
May 6, 2024 04:47:58.044828892 CEST	49769	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:58.072309017 CEST	49770	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:58.178266048 CEST	80	49769	3.217.82.240	192.168.2.4
May 6, 2024 04:47:58.205988884 CEST	80	49770	3.217.82.240	192.168.2.4
May 6, 2024 04:47:58.312067986 CEST	49771	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:58.446674109 CEST	80	49771	3.217.82.240	192.168.2.4
May 6, 2024 04:47:58.692833900 CEST	49769	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:58.708832026 CEST	49770	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:58.826271057 CEST	80	49769	3.217.82.240	192.168.2.4
May 6, 2024 04:47:58.843363047 CEST	80	49770	3.217.82.240	192.168.2.4
May 6, 2024 04:47:58.970779896 CEST	49771	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:59.106060982 CEST	80	49771	3.217.82.240	192.168.2.4
May 6, 2024 04:47:59.335268974 CEST	49769	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:59.351277113 CEST	49770	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:59.468698978 CEST	80	49769	3.217.82.240	192.168.2.4
May 6, 2024 04:47:59.485027075 CEST	80	49770	3.217.82.240	192.168.2.4
May 6, 2024 04:47:59.610304117 CEST	49771	80	192.168.2.4	3.217.82.240
May 6, 2024 04:47:59.745027065 CEST	80	49771	3.217.82.240	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 04:47:15.690716028 CEST	53	50510	1.1.1.1	192.168.2.4
May 6, 2024 04:47:15.724641085 CEST	53	50804	1.1.1.1	192.168.2.4
May 6, 2024 04:47:16.090291977 CEST	55791	53	192.168.2.4	1.1.1.1
May 6, 2024 04:47:16.090452909 CEST	64476	53	192.168.2.4	1.1.1.1
May 6, 2024 04:47:16.203124046 CEST	53	64476	1.1.1.1	192.168.2.4
May 6, 2024 04:47:16.203197956 CEST	53	55791	1.1.1.1	192.168.2.4
May 6, 2024 04:47:16.488924026 CEST	53	60574	1.1.1.1	192.168.2.4
May 6, 2024 04:47:18.673274994 CEST	53	65112	1.1.1.1	192.168.2.4
May 6, 2024 04:47:19.617120981 CEST	52802	53	192.168.2.4	1.1.1.1
May 6, 2024 04:47:19.617836952 CEST	57779	53	192.168.2.4	1.1.1.1
May 6, 2024 04:47:19.727281094 CEST	53	52802	1.1.1.1	192.168.2.4
May 6, 2024 04:47:19.729398012 CEST	53	57779	1.1.1.1	192.168.2.4
May 6, 2024 04:47:20.595714092 CEST	52970	53	192.168.2.4	1.1.1.1
May 6, 2024 04:47:20.597925901 CEST	54884	53	192.168.2.4	1.1.1.1
May 6, 2024 04:47:20.705353975 CEST	53	52970	1.1.1.1	192.168.2.4
May 6, 2024 04:47:20.707792044 CEST	53	54884	1.1.1.1	192.168.2.4
May 6, 2024 04:47:36.135116100 CEST	53	58032	1.1.1.1	192.168.2.4
May 6, 2024 04:47:39.177650928 CEST	138	138	192.168.2.4	192.168.2.255
May 6, 2024 04:47:42.080821037 CEST	61276	53	192.168.2.4	1.1.1.1
May 6, 2024 04:47:42.080821037 CEST	64604	53	192.168.2.4	1.1.1.1
May 6, 2024 04:47:42.193310976 CEST	53	61276	1.1.1.1	192.168.2.4
May 6, 2024 04:47:42.196398973 CEST	53	64604	1.1.1.1	192.168.2.4
May 6, 2024 04:47:55.716711998 CEST	53	53526	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 6, 2024 04:47:16.090291977 CEST	192.168.2.4	1.1.1.1	0x3465	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:16.090452909 CEST	192.168.2.4	1.1.1.1	0xdd70	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 6, 2024 04:47:19.617120981 CEST	192.168.2.4	1.1.1.1	0xca6e	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:19.617836952 CEST	192.168.2.4	1.1.1.1	0x8dd4	Standard query (0)	apis.google.com	65	IN (0x0001)	false
May 6, 2024 04:47:20.595714092 CEST	192.168.2.4	1.1.1.1	0xac33	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:20.597925901 CEST	192.168.2.4	1.1.1.1	0xe14d	Standard query (0)	play.google.com	65	IN (0x0001)	false
May 6, 2024 04:47:42.080821037 CEST	192.168.2.4	1.1.1.1	0x8ab4	Standard query (0)	morestrategic11688.lt.emlnk9.com	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:42.080821037 CEST	192.168.2.4	1.1.1.1	0x8c12	Standard query (0)	morestrategic11688.lt.emlnk9.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 6, 2024 04:47:16.203124046 CEST	1.1.1.1	192.168.2.4	0xdd70	No error (0)	www.google.com			65	IN (0x0001)	false
May 6, 2024 04:47:16.203197956 CEST	1.1.1.1	192.168.2.4	0x3465	No error (0)	www.google.com		192.178.50.68	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:19.727281094 CEST	1.1.1.1	192.168.2.4	0xca6e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 6, 2024 04:47:19.727281094 CEST	1.1.1.1	192.168.2.4	0xca6e	No error (0)	plus.l.google.com		172.217.2.206	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:19.729398012 CEST	1.1.1.1	192.168.2.4	0x8dd4	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 6, 2024 04:47:20.705353975 CEST	1.1.1.1	192.168.2.4	0xac33	No error (0)	play.google.com		172.217.2.206	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:29.137844086 CEST	1.1.1.1	192.168.2.4	0x85e5	No error (0)	windowsupdatebg.s.llnwi.net		208.111.136.0	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:29.137844086 CEST	1.1.1.1	192.168.2.4	0x85e5	No error (0)	windowsupdatebg.s.llnwi.net		208.111.136.128	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:29.495537043 CEST	1.1.1.1	192.168.2.4	0x6165	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 6, 2024 04:47:29.495537043 CEST	1.1.1.1	192.168.2.4	0x6165	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:42.193310976 CEST	1.1.1.1	192.168.2.4	0x8ab4	No error (0)	morestrategic11688.lt.emlnk9.com		44.218.159.243	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:42.193310976 CEST	1.1.1.1	192.168.2.4	0x8ab4	No error (0)	morestrategic11688.lt.emlnk9.com		54.236.118.117	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:42.193310976 CEST	1.1.1.1	192.168.2.4	0x8ab4	No error (0)	morestrategic11688.lt.emlnk9.com		3.217.82.240	A (IP address)	IN (0x0001)	false
May 6, 2024 04:47:43.958415985 CEST	1.1.1.1	192.168.2.4	0xd8ef	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 6, 2024 04:47:43.958415985 CEST	1.1.1.1	192.168.2.4	0xd8ef	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

play.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	192.178.50.68	443	3104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 02:47:16 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-06 02:47:16 UTC	1191	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 02:47:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-oDgYS8i0WWMhuk4DxAoWHw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-06 02:47:16 UTC	64	IN	Data Raw: 35 32 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 6f 6d 65 6e 20 62 65 61 72 73 22 2c 22 6e 65 74 66 6c 69 78 20 6d 6f 76 69 65 73 22 2c 22 70 61 75 6c 20 73 6b 65 6e 65 73 20 70 69 72 61 74 Data Ascii: 52b)]}'["",["women bears","netflix movies","paul skenes pirat
2024-05-06 02:47:16 UTC	1255	IN	Data Raw: 65 73 22 2c 22 61 70 70 6c 65 20 69 70 61 64 20 70 72 6f 20 65 76 65 6e 74 22 2c 22 6e 61 73 63 61 72 20 63 75 70 20 73 65 72 69 65 73 20 6b 61 6e 73 61 73 20 73 70 65 65 64 77 61 79 22 2c 22 77 61 79 66 61 69 72 20 64 65 61 6c 73 22 2c 22 61 69 20 72 61 6e 64 79 20 74 72 61 76 69 73 20 73 6f 6e 67 22 2c 22 75 6e 63 20 62 61 73 6b 65 74 62 61 6c 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 Data Ascii: es","apple ipad pro event","nascar cup series kansas speedway","wayfair deals","ai randy travis song","unc basketball"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u0
2024-05-06 02:47:16 UTC	11	IN	Data Raw: 44 63 30 4e 56 70 78 4e 31 0d 0a Data Ascii: Dc0NVpxN1
2024-05-06 02:47:16 UTC	1255	IN	Data Raw: 38 63 65 0d 0a 42 49 5a 6a 4e 32 59 33 4d 35 64 6e 68 54 61 48 46 58 61 6c 68 61 57 6c 46 6e 56 45 78 47 55 55 70 76 55 6a 52 46 55 56 4a 44 53 31 6c 35 61 55 68 31 64 46 4e 6b 52 6d 78 6b 51 69 74 68 57 48 70 7a 4d 32 35 56 4d 58 55 30 4c 31 4e 59 53 6c 4e 5a 61 47 70 51 54 47 4d 33 51 58 6c 45 62 33 6c 32 61 30 4d 34 61 47 56 70 54 7a 4e 6c 4b 30 39 6f 4b 30 4a 54 51 57 74 42 5a 6e 64 76 55 58 70 31 64 54 4e 32 4e 7a 52 33 51 55 30 34 51 55 68 4a 5a 43 74 42 61 55 4e 6e 5a 48 55 76 64 55 34 76 4b 31 42 52 54 6c 49 78 51 32 64 45 57 44 68 61 51 58 64 51 55 32 67 77 62 56 70 54 53 44 42 69 4d 54 63 33 63 6d 5a 6c 64 45 68 7a 53 32 4e 42 63 30 46 34 5a 30 5a 4a 54 6b 39 44 52 32 70 6d 54 6e 68 6d 53 33 46 4a 5a 57 5a 6e 4e 7a 4e 72 55 54 4a 6e 55 69 39 51 Data Ascii: 8ceBIZjN2Y3M5dnhTaHFXalhaWlFnVExGUUpvUjRFUVJDS1l5aUh1dFNkRmxkQithWHpzM25VMXU0L1NYSlNZaGpQTGM3QXlEb3l2a0M4aGVpTzNlK09oK0JTQWtBZndvUXp1dTN2NzR3QU04QUhJZCtBaUNnZHUvdU4vK1BRTlIxQ2dEWDhaQXdQU2gwbVpTSDBiMTc3cmZldEhzS2NBc0F4Z0ZJTk9DR2pmTnhmS3FJZWZnNzNrUTJnUi9Q
2024-05-06 02:47:16 UTC	1006	IN	Data Raw: 4e 32 5a 50 64 45 38 33 63 58 4a 69 4f 48 4e 6d 4d 31 68 48 51 55 4e 56 4d 46 4a 4a 51 57 52 74 62 57 45 79 64 30 4e 4e 4f 55 64 69 4e 57 52 4f 55 33 6b 76 64 6a 56 75 62 57 56 31 4d 44 4a 77 53 31 4d 77 4e 33 6b 31 4c 30 38 34 4d 6b 64 44 62 6b 5a 4d 61 54 52 43 51 30 45 31 56 7a 42 73 52 55 68 77 53 33 46 6b 54 30 5a 57 59 6d 78 77 56 57 73 35 57 47 39 71 55 32 56 42 5a 33 4a 44 55 6d 56 42 63 31 56 77 5a 45 74 6a 53 32 4e 5a 55 56 4e 42 51 6d 70 6f 61 58 70 51 56 6d 4e 31 61 31 68 4f 55 54 4e 57 4f 48 55 30 64 55 74 6a 63 32 6c 43 4d 33 6b 30 59 31 4d 78 4f 58 64 47 59 30 49 35 55 48 70 45 62 53 74 6c 59 57 64 35 64 69 39 47 64 57 56 4d 4d 48 56 5a 61 56 68 4b 57 6b 5a 4e 51 55 6c 6b 56 30 35 34 4e 56 56 74 52 44 4a 36 55 58 6f 72 65 55 78 4e 62 30 64 Data Ascii: N2ZPdE83cXJiOHNmM1hHQUNVMFJJQWRtbWEyd0NNOUdiNWROU3kvdjVubWV1MDJwS1MwN3k1L084MkdDbkZMaTRCQ0E1VzBsRUhwS3FkT0ZWYmxwVWs5WG9qU2VBZ3JDUmVBc1VwZEtjS2NZUVNBQmpoaXpQVmN1a1hOUTNWOHU0dUtjc2lCM3k0Y1MxOXdGY0I5UHpEbStlYWd5di9GdWVMMHVZaVhKWkZNQUlkV054NVVtRDJ6UXoreUxNb0d
2024-05-06 02:47:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	192.178.50.68	443	3104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 02:47:16 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-06 02:47:16 UTC	967	IN	HTTP/1.1 200 OK Version: 630032337 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 06 May 2024 02:47:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-06 02:47:16 UTC	288	IN	Data Raw: 31 37 38 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 51 61 20 67 62 5f 68 62 20 67 62 5f 54 64 20 67 62 5f 6e 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1784)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Qa gb_hb gb_Td gb_nd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-05-06 02:47:16 UTC	1255	IN	Data Raw: 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 72 64 20 67 62 5f 6b 64 20 67 62 5f 78 64 20 67 62 5f 77 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 71 64 20 67 62 5f 67 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4f 63 20 67 62 5f 71 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 Data Ascii: 03e\u003c\/div\u003e\u003cdiv class\u003d\"gb_rd gb_kd gb_xd gb_wd\"\u003e\u003cdiv class\u003d\"gb_qd gb_gd\"\u003e\u003cdiv class\u003d\"gb_Oc gb_q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u00
2024-05-06 02:47:16 UTC	1255	IN	Data Raw: 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4e 63 20 67 62 5f 35 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 71 64 20 67 62 5f 65 64 20 67 62 Data Ascii: label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Nc gb_5d\" aria-hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_qd gb_ed gb
2024-05-06 02:47:16 UTC	1255	IN	Data Raw: 22 67 62 5f 55 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 37 63 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 78 20 67 62 5f 4b 20 67 62 5f 6a 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 66 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 53 65 61 72 63 68 20 4c 61 62 73 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 68 74 74 70 73 3a 2f 2f 6c 61 62 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 Data Ascii: "gb_Ud\"\u003e\u003cdiv class\u003d\"gb_7c\"\u003e \u003cdiv class\u003d\"gb_x gb_K gb_j\"\u003e \u003cdiv class\u003d\"gb_f\"\u003e \u003ca class\u003d\"gb_d\" aria-label\u003d\"Search Labs\" href\u003d\"https://labs.google.com/search?source\u003dntp\" t
2024-05-06 02:47:16 UTC	1255	IN	Data Raw: 6d 2f 69 6e 74 6c 2f 65 6e 2f 61 62 6f 75 74 2f 70 72 6f 64 75 63 74 73 3f 74 61 62 5c 75 30 30 33 64 72 68 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 68 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 36 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c Data Ascii: m/intl/en/about/products?tab\u003drh\" aria-expanded\u003d\"false\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg class\u003d\"gb_h\" focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M6,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,
2024-05-06 02:47:16 UTC	720	IN	Data Raw: 75 30 30 33 64 5c 22 67 62 5f 36 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 48 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 49 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 38 64 20 67 62 5f 4a 63 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4e 63 20 67 62 5f 35 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c Data Ascii: u003d\"gb_6c\"\u003e\u003cdiv class\u003d\"gb_Hc\"\u003e\u003cdiv class\u003d\"gb_Ic\"\u003e\u003ca class\u003d\"gb_8d gb_Jc gb_6d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Nc gb_5d\" aria-hidden\u003d\"true\
2024-05-06 02:47:16 UTC	275	IN	Data Raw: 31 30 63 0d 0a 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 68 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 68 64 28 61 2c 62 2c 64 29 Data Ascii: 10c},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis;\ntry{\n_.hd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.hd(a,b,d)
2024-05-06 02:47:16 UTC	1255	IN	Data Raw: 38 30 30 30 0d 0a 79 29 28 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 7a 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 Data Ascii: 8000y)(a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addEventListener?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"z`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry
2024-05-06 02:47:16 UTC	1255	IN	Data Raw: 5c 6e 74 72 79 7b 5c 6e 2f 2a 5c 6e 5c 6e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 77 64 2c 46 64 2c 48 64 3b 5f 2e 72 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 6e 75 6c 6c 5c 75 30 30 33 64 5c 75 30 30 33 64 61 29 72 65 74 75 72 6e 20 61 3b 69 66 28 5c 22 73 74 72 69 6e 67 5c 22 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 74 79 70 65 6f 66 20 61 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 5c 22 6e 75 6d 62 65 72 5c 22 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 74 79 70 65 6f 66 20 61 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a Data Ascii: \ntry{\n/\n\n SPDX-License-Identifier: Apache-2.0\n/\nvar wd,Fd,Hd;_.rd\u003dfunction(a){if(null\u003d\u003da)return a;if(\"string\"\u003d\u003d\u003dtypeof a){if(!a)return;a\u003d+a}if(\"number\"\u003d\u003d\u003dtypeof a)return Number.isFinite(a)?a\|0:
2024-05-06 02:47:16 UTC	1255	IN	Data Raw: 3a 76 6f 69 64 20 30 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 6c 62 28 5f 2e 45 64 28 61 2c 62 29 2c 63 29 7d 3b 46 64 5c 75 30 30 33 64 30 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 5f 2e 78 62 29 5c 75 30 30 32 36 5c 75 30 30 32 36 61 5b 5f 2e 78 62 5d 7c 7c 28 61 5b 5f 2e 78 62 5d 5c 75 30 30 33 64 2b 2b 46 64 29 7d 3b 48 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 Data Ascii: :void 0};_.S\u003dfunction(a,b,c\u003d0){return _.lb(_.Ed(a,b),c)};Fd\u003d0;_.Gd\u003dfunction(a){return Object.prototype.hasOwnProperty.call(a,_.xb)\u0026\u0026a[_.xb]\|\|(a[_.xb]\u003d++Fd)};Hd\u003dfunction(a){return a};_.Id\u003dfunction(a){var b\u003d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	192.178.50.68	443	3104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 02:47:16 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-06 02:47:16 UTC	922	IN	HTTP/1.1 200 OK Version: 630032337 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 06 May 2024 02:47:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-06 02:47:16 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-05-06 02:47:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	172.217.2.206	443	3104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 02:47:20 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-06 02:47:20 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 121628 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun, 05 May 2024 13:09:59 GMT Expires: Mon, 05 May 2025 13:09:59 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 15 Apr 2024 17:34:54 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 49041 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 02:47:20 UTC	340	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 62 61 2c 63 61 2c 64 61 2c 6e 61 2c 70 61 2c 76 61 2c 77 61 2c 7a 61 3b 62 61 3d 66 75 6e 63 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);var ba,ca,da,na,pa,va,wa,za;ba=func
2024-05-06 02:47:20 UTC	1255	IN	Data Raw: 7d 3b 63 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 Data Ascii: };ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"
2024-05-06 02:47:20 UTC	1255	IN	Data Raw: 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 63 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 61 28 62 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 75 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 Data Ascii: n"===typeof d&&"function"!=typeof d.prototype[a]&&ca(d.prototype,a,{configurable:!0,writable:!0,value:function(){return pa(ba(this))}})}return a});pa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a};_.ua=function(a){var b="unde
2024-05-06 02:47:20 UTC	1255	IN	Data Raw: 50 66 29 7b 74 68 69 73 2e 50 66 3d 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 74 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 45 37 28 29 7d 29 7d 74 68 69 73 2e 50 66 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 5f 2e 6d 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 45 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 50 66 26 26 74 68 69 73 2e 50 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 50 66 3b 74 68 69 73 2e 50 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e Data Ascii: Pf){this.Pf=[];var k=this;this.tP(function(){k.E7()})}this.Pf.push(h)};var d=_.ma.setTimeout;b.prototype.tP=function(h){d(h,0)};b.prototype.E7=function(){for(;this.Pf&&this.Pf.length;){var h=this.Pf;this.Pf=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=n
2024-05-06 02:47:20 UTC	1255	IN	Data Raw: 6f 74 79 70 65 2e 6e 65 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 67 63 61 28 29 29 7b 76 61 72 20 6b 3d 5f 2e 6d 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6b 26 26 6b 2e 65 72 72 6f 72 28 68 2e 46 66 29 7d 7d 2c 0a 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 63 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 73 56 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 68 3d 5f 2e 6d 61 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 6b 3d 5f 2e 6d 61 2e 45 76 65 6e 74 2c 6c 3d 5f 2e 6d 61 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 6c 29 72 65 74 75 Data Ascii: otype.nea=function(){var h=this;d(function(){if(h.gca()){var k=_.ma.console;"undefined"!==typeof k&&k.error(h.Ff)}},1)};e.prototype.gca=function(){if(this.sV)return!1;var h=_.ma.CustomEvent,k=_.ma.Event,l=_.ma.dispatchEvent;if("undefined"===typeof l)retu
2024-05-06 02:47:20 UTC	1255	IN	Data Raw: 74 68 69 73 2e 73 56 3d 21 30 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 5f 2e 75 61 28 68 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e 65 78 74 28 29 29 63 28 6e 2e 76 61 6c 75 65 29 2e 42 79 28 6b 2c 6c 29 7d 29 7d 3b 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 5f 2e 75 61 28 68 29 2c 6c 3d 6b 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6c 2e 64 6f 6e 65 3f 63 28 Data Ascii: this.sV=!0};e.resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=_.ua(h),n=m.next();!n.done;n=m.next())c(n.value).By(k,l)})};e.all=function(h){var k=_.ua(h),l=k.next();return l.done?c(
2024-05-06 02:47:20 UTC	1255	IN	Data Raw: 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6e 3d 6e 65 77 20 61 28 5b 5b 6c 2c 32 5d 2c 5b 6d 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6e 2e 67 65 74 28 6c 29 7c 7c 33 21 3d 6e 2e 67 65 74 28 6d 29 29 72 65 74 75 72 6e 21 31 3b 6e 2e 64 65 6c 65 74 65 28 6c 29 3b 6e 2e 73 65 74 28 6d 2c 34 29 3b 72 65 74 75 72 6e 21 6e 2e 68 61 73 28 6c 29 26 26 34 3d 3d 6e 2e 67 65 74 28 6d 29 7d 63 61 74 63 68 28 70 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 66 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 Data Ascii: t.seal)return!1;try{var l=Object.seal({}),m=Object.seal({}),n=new a([[l,2],[m,3]]);if(2!=n.get(l)\|\|3!=n.get(m))return!1;n.delete(l);n.set(m,4);return!n.has(l)&&4==n.get(m)}catch(p){return!1}}())return a;var f="$jscomp_hidden_"+Math.random();e("freeze");e
2024-05-06 02:47:20 UTC	1255	IN	Data Raw: 62 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 5f 2e 75 61 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6b 3d 30 3d 3d 3d 6b 3f 30 3a 6b 3b 76 61 72 20 6d 3d 64 28 74 68 69 73 2c 6b 29 3b 6d 2e 6c 69 73 74 7c 7c 28 6d 2e 6c 69 73 74 3d 74 68 69 73 5b 30 5d 5b 6d 2e 69 64 5d 3d 5b 5d 29 3b 6d 2e 6e 66 3f 6d 2e 6e 66 2e 76 61 6c 75 65 3d 6c 3a 28 6d 2e Data Ascii: b=new WeakMap,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=_.ua(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};c.prototype.set=function(k,l){k=0===k?0:k;var m=d(this,k);m.list\|\|(m.list=this[0][m.id]=[]);m.nf?m.nf.value=l:(m.
2024-05-06 02:47:20 UTC	1255	IN	Data Raw: 3d 62 2e 67 65 74 28 6c 29 3a 28 6d 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6c 2c 6d 29 29 3a 6d 3d 22 70 5f 22 2b 6c 3b 76 61 72 20 6e 3d 6b 5b 30 5d 5b 6d 5d 3b 69 66 28 6e 26 26 76 61 28 6b 5b 30 5d 2c 6d 29 29 66 6f 72 28 6b 3d 30 3b 6b 3c 6e 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 70 3d 6e 5b 6b 5d 3b 69 66 28 6c 21 3d 3d 6c 26 26 70 2e 6b 65 79 21 3d 3d 70 2e 6b 65 79 7c 7c 6c 3d 3d 3d 70 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 6b 2c 6e 66 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 2d 31 2c 6e 66 3a 76 6f 69 64 20 30 7d 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 76 61 72 20 6d 3d 6b 5b 31 5d 3b 72 65 74 75 72 6e 20 70 61 28 66 75 Data Ascii: =b.get(l):(m=""+ ++h,b.set(l,m)):m="p_"+l;var n=k[0][m];if(n&&va(k[0],m))for(k=0;k<n.length;k++){var p=n[k];if(l!==l&&p.key!==p.key\|\|l===p.key)return{id:m,list:n,index:k,nf:p}}return{id:m,list:n,index:-1,nf:void 0}},e=function(k,l){var m=k[1];return pa(fu
2024-05-06 02:47:20 UTC	1255	IN	Data Raw: 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 34 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 7d 63 61 74 63 68 28 68 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 74 68 69 73 2e 44 61 3d 6e 65 77 20 4d 61 70 3b 69 66 28 63 29 7b 63 3d 0a Data Ascii: rn!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|4!=f.value[0].x\|\|f.value[1]!=f.value[0]?!1:e.next().done}catch(h){return!1}}())return a;var b=function(c){this.Da=new Map;if(c){c=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	172.217.2.206	443	3104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 02:47:21 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 927 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-06 02:47:21 UTC	927	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 31 34 39 36 33 36 33 38 36 32 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1714963638628",null,null,null,
2024-05-06 02:47:22 UTC	929	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=RJX70Ti3J3mBZkJUgOvmCru25W9X_kVWtprIPzojXB0QZX1k_jfhbK_5oNgb4brrop50qIeplwWdFbAsUAU1EyJbxXWgN44PSrmwS-NIJihBveGtZ1ukGJkC7oIvSfR3Cfe3l_z2jKM91DCLn68hXuhauB-XM_4IL0huyK70Pxg; expires=Tue, 05-Nov-2024 02:47:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 May 2024 02:47:22 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 06 May 2024 02:47:22 GMT Connection: close Transfer-Encoding: chunked
2024-05-06 02:47:22 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-05-06 02:47:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	04:47:07
Start date:	06/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	04:47:13
Start date:	06/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:47:13
Start date:	06/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1924,i,1791445331178183765,13985730309241529132,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	04:47:14
Start date:	06/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=2008,i,9554993435019489605,13314209667266238359,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:47:41
Start date:	06/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://morestrategic11688.lt.emlnk9.com"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: morestrategic11688.lt.emlnk9.com

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://morestrategic11688.lt.emlnk9.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 2676, Parent PID: 344

General

Chronological Activities

Analysis Process: chrome.exePID: 1780, Parent PID: 2860

General

Chronological Activities

Analysis Process: chrome.exePID: 3104, Parent PID: 2676

General

Chronological Activities

Windows Analysis Report
http://morestrategic11688.lt.emlnk9.com