Edit tour

Windows Analysis Report
http://grandprairie-water-damage-restoration.com

Overview

General Information

Sample URL:	http://grandprairie-water-damage-restoration.com
Analysis ID:	1383915
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Creates files inside the system directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3164 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,6419500029572030545,6045319169889960985,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6468 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://grandprairie-water-damage-restoration.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 31 Jan 2024 10:29:09 GMTServer: ApacheLast-Modified: Fri, 30 Sep 2022 16:19:12 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 1191Keep-Alive: timeout=5, max=74Connection: Keep-AliveContent-Type: application/javascriptData Raw: 1f 8b 08 00 00 00 00 00 00 03 95 52 4d 6f db 38 10 bd f7 57 d0 82 61 88 85 22 3b 05 f6 22 43 c8 c1 ed 62 b3 6d 92 2e 92 3d 15 3d 30 d2 d8 62 43 93 5e 72 6c 27 70 fc df 77 48 4a b6 e2 a6 dd 2e 7c b0 38 9f 6f de 7b e3 b7 6c 66 56 4f 56 2e 1a 64 e9 8c b3 77 93 f3 77 ec f6 49 6d 84 d4 ec 0f b1 04 f5 e6 b3 35 df a0 c2 82 35 88 2b 57 8c c7 0b 89 cd fa 3e af cc 72 6c a1 6e 0c 3a f5 34 76 72 b9 52 70 06 8f 2b a1 eb 37 57 97 77 ec 93 ac 40 57 70 ec b3 62 9b ff 77 ef 78 29 1c 82 1d ab d8 7e b6 94 98 e3 23 b2 b7 e3 37 e9 7c ad 2b 94 46 a7 43 be 4b d6 0e 98 43 2b 2b 4c a6 5d 82 41 ca 77 1b 61 19 94 d8 48 37 85 bc 86 b9 58 2b 74 e5 ae 91 35 5c 99 1a 8a 64 2e 6a b8 33 8b 85 82 24 6b f3 b7 20 6c d5 c4 f4 4a 58 d0 78 48 dd 09 bb 00 2c 12 02 ad 31 24 b0 b1 66 7b a3 af a4 73 52 2f da fc 60 92 3d 00 ac 6e 51 20 5c ea 99 31 0f 12 8a c1 79 56 85 af 6b a2 b2 48 5e 1c 9a ec 33 c8 1d 20 d2 0c 82 b7 cf 86 39 3c d2 82 3a 3d 86 b3 e3 01 9c be e7 52 d7 9f 60 03 ea 46 c3 7b 5a 56 1e 08 81 0c 33 cd 77 16 70 6d 89 85 50 99 22 a7 7f 45 64 1e 89 eb 4a 06 c3 d4 13 c4 f3 78 ac fb 5b a3 54 34 45 f3 5c 81 5e 60 b3 e7 2d bc 4b 2d 51 0a 15 ee 3a ee 0b db 3c d1 b6 84 dc 82 a8 43 9e 36 4e ed 45 8a 14 59 9a 0d cc 94 70 2e 4d 2a a3 94 58 39 a8 13 9e 8b ba 6e a3 91 04 1f f4 7b 1a b3 4d 35 e7 c5 69 ef b1 aa d7 da 1b 48 bd 5e 57 df bb 6f bf 7b 20 f9 ee 48 65 de e9 5f 96 65 df 01 17 18 27 f0 e2 07 b5 f7 c2 c9 2a 19 8d ba ba 7d 8b f7 ff ef 09 57 fe c2 9e 58 e7 f7 54 0d 54 0f 1f 4f 6d f5 d9 02 79 b1 96 7e b9 2b 7b da ca 79 cf 3b f9 77 76 1c 8d 86 79 b4 23 ed 5b 13 ad e4 12 a8 79 b0 33 d3 b0 65 1f ac 35 36 7d 69 d3 82 7d 37 87 99 95 5f c8 2c fc b3 96 16 1c eb c6 32 34 ec 1e 58 3b 38 4f c2 0d de 1d b1 af 0f d5 7b 07 cb ae b1 0f 3b 46 ae c5 12 c8 4c d1 cf 48 78 f5 5a a9 e7 67 ff 95 24 17 bb 7d f1 e7 ed cd b5 77 af f3 ae eb f6 9c ba 34 50 32 f8 19 27 3c ae 18 9c 4f 3d 22 5d 62 2e 10 89 83 4b 32 d7 94 9a f5 0b aa 62 f1 b4 6f fc 38 26 e5 99 2c ed 17 fd 95 ca 07 93 e7 67 9a d7 62 97 c1 2f 62 03 a7 d8 32 fd cb e8 da 85 a7 d8 ec 8f b0 c9 13 6c 53 f9 c5 7e 2d 75 f6 73 ba b3 40 a9 43 4b 71 39 7f 4a 25 cf 76 56 6c 8b c1 24 5b 09 6c 8a ad d4 b5 d9 e6 ca 54 c2 5f 90 fb a0 a6 be 7d a0 1f 83 cd 4f ee eb 88 8a c9 99 73 24 49 47 4c 0f 43 23 6b b8 32 b5 b7 65 32 17 35 dc 85 f2 e4 42 e7 c7 57 7a fe db 84 17 3f 68 ba 17 4e 56 be 3e 2e 4a 79 31 cc a5 fb bd c3 f2 4a 17 1f 8d 5e 89 7a d4 99 e5 7d c5 28 44 81 c1 f9 f1 46 3a e3 78 26 f0 dd e1 9e 46 b8 99 12 74 64 02 8f 2b 41 c2 90 4e 17 e9 a1 2d a6 2a a3 94 58 39 a8 d9 b1 88 c6 f3 e2 b4 b0 4b b3 43 87 2f 9c 04 b2 49 f1 fa 4e d8 05 a0 7b c1 38 41 dd 45 03 7c f9 da b9 37 11 f7 ce a8 35 42 c2 65 39 4c 2d 9f 82 72 c0 ba ac 05 45 72 6e 42 36 0e fe 04 1b 50 37 1a de 93 1b

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/js/simple-expand.min.js HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://grandprairie-water-damage-restoration.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/f.png HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://grandprairie-water-damage-restoration.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://grandprairie-water-damage-restoration.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404top_w.jpg HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://grandprairie-water-damage-restoration.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404mid.gif HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://grandprairie-water-damage-restoration.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/f.png HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404bottom.gif HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://grandprairie-water-damage-restoration.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404top_w.jpg HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404mid.gif HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://grandprairie-water-damage-restoration.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404bottom.gif HTTP/1.1Host: grandprairie-water-damage-restoration.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 31 Jan 2024 10:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, Keep-AliveLast-Modified: Fri, 30 Sep 2022 16:19:10 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6083Keep-Alive: timeout=5, max=75Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 52 ed 72 1b 39 92 fc ed 79 8a 5a fa 76 6d c7 89 a4 64 c9 5e 5b a2 b8 31 e3 8f b5 36 ec b1 c2 d2 c4 dc fc 72 80 40 75 37 46 68 a0 07 40 93 ec 73 6c c4 bd c3 bd e1 3d c9 55 a1 c9 66 93 a2 bc f2 ed 6c c4 69 3c 52 03 85 ca ca ca cc c9 1f 5e 7f 7c 75 fd cb e5 1b 28 62 69 e0 f2 a7 1f de 5f bc 82 c1 70 3c fe f9 f8 d5 78 fc fa fa 35 fc c7 bb eb 0f ef e1 68 74 08 57 d1 6b 19 c7 e3 37 3f 0e 60 50 c4 58 9d 8e c7 8b c5 62 b4 38 1e 39 9f 8f af 3f 8d 97 8c 72 c4 6d ab cf 61 48 3d 23 15 d5 60 fa dd 24 0d 59 96 c6 86 f3 3d 00 47 2f 5f be 6c fb 06 fc e8 d4 08 9b 9f 0f d0 0e a0 fb 62 0c 14 0a 2a ef 32 6d b0 43 c9 cb 2a 4f 18 cb cc 8e 8f 8e e8 1d ac 7e 26 25 46 01 fc 6c 88 bf d5 7a 7e 3e 78 e5 6c 44 1b 87 d7 4d 85 03 90 ed e9 7c 10 71 19 c7 3c fc 0c 64 21 7c c0 78 5e c7 6c f8 62 00 e3 1e 5a d4 d1 e0 f4 e4 f0 18 86 f0 f6 e3 a7 1f 2e 5e bf 7e f3 e3 64 dc 5e 7f f7 dd 03 fa 99 fc 61 38 84 ef 95 82 2b a3 15 c2 c7 3a 06 18 0e a7 6d 2d 48 af ab 08 c1 cb 8e bb 74 0a 47 bf fe 56 a3 6f 46 d2 95 e3 f6 73 78 3c 3a 1e 1d 8d 4a 6d 47 bf 86 c1 74 32 6e 3b a7 6b 26 b7 e1 c6 32 d7 c3 d0 84 f1 af 61 1c 74 59 19 1c e2 b2 12 56 dd 06 e9 f6 d9 2c 16 62 63 10 22 69 b2 92 42 86 d0 93 71 e6 54 f3 a5 12 4a 69 9b 9f 1e 9e 95 c2 e7 da d2 47 46 f2 0d 33 51 6a d3 9c 16 68 e6 18 b5 14 67 7f ef fa 1e b2 be 42 5b f4 5f 56 3d 4f 0f ab 25 88 3a ba b3 85 56 b1 38 7d f1 fc 45 b5 dc db 01 0f a3 ab 48 ea 2f 33 21 6f 72 ef 6a ab 86 ba 14 39 9e d6 de 3c 7e d4 ed 9b ee c2 f8 e4 f0 84 de 7f 5e 8c 7e ad f2 47 4f ce 7a 4d 1e 2b 14 f1 d4 ba d5 d7 d6 e4 02 75 5e c4 d3 a3 af d0 28 b5 fa 26 1a f4 7e 94 eb 6c 2f 89 f6 cf b0 b9 c7 f6 ed 58 78 98 8b e8 fc cc c5 e8 ca 2f 95 0b 3a 6a 67 09 c7 88 a8 e7 78 66 30 8b a7 c7 2f 09 25 33 8e 06 f0 f9 1f 00 2e 97 cb 2f bd c7 6b 5b 8f d9 99 e3 e7 fc fb 88 7e 9d c1 ca b1 e4 56 fb 6b 78 b4 76 ef eb 13 f8 0a 6d ec 4f e1 50 0d 85 d1 b9 3d 95 54 42 ff 0d 0a ac e0 e0 21 7a ef bc 74 0a bf a4 e0 05 fd 9f 98 68 b7 39 5c b4 56 be 38 3c bc 2f de 4c d8 dd 68 1e d2 7f f7 6d 2f 5c 88 a8 66 cd 97 dd f1 1b 76 4f 9f ad d9 85 d8 18 3c d5 91 34 90 67 3b 13 ef 3b 50 ba ba 72 f6 8b 74 c6 f9 d3 87 df ff 70 78 b8 3d ec e9 de 61 f7 04 cf 31 86 28 3c 6d 04 e2 ce 11 c7 47 7b 47 fc 1f f5 ef 8d 5c 9b c0 fa 1f 3f bb 33 12 33 17 a3 2b 09 e5 cb 4c c8 9b dc bb da aa a1 2e 45 8e a7 b5 37 8f 1f 8d 65 ae 87 a1 09 e3 74 17 c6 27 87 27 6d cb 28 d7 d9 a3 27 67 bd 2e 8f 15 52 3a ad 5b 7d 6d 05 b2 68 77 39 3a b9 7f 38 33 f1 db e7 4d 7d bd 0f 3c 4b 16 a7 df 67 50 09 a5 b4 cd 4f e1 a8 75 be fd 73 06 d2 a0 f0 a7 c4 b4 b8 ef 34 21 a5 f3 4a 53 1a 36 e6 c0 cb c3 3f 9e 41 bb 06 3c 7f 46 d8 67 50 6a 3b 5c 2d 43 d3 da ab 15 b3 43 10 75 74 67 10 71 19 87 64 63 4e 77 92
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 31 Jan 2024 10:29:09 GMTServer: ApacheLast-Modified: Fri, 30 Sep 2022 16:21:54 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4677Keep-Alive: timeout=5, max=74Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 28 a5 1e fc 61 7b e3 38 6a 6f 8e 17 74 1e c2 45 49 2e fb b6 b1 d1 1f 36 b2 b2 ac 14 f6 71 5e 09 9d 3e 04 59 8a 5a a9 b3 ae 51 08 8e 8d e9 fc 48 ac 5d f3 72 42 69 73 5f 89 34 95 3a 1f 1e 8c 4a 61 72 a9 f9 21 63 0f fb 99 28 a5 6a 86 05 aa 29 3a 99 88 d1 9f cb 7b 7b de 64 21 35 9a fb ee ce cf 07 d5 1c 44 ed 68 34 93 a9 2b 86 bf fe f2 6b 35 df 79 03 f6 1c 55 ec f7 fd 44 24 77 b9 a1 5a a7 7d 59 8a 1c 87 b5 51 4f 9f 2c f5 86 35 1b f1 49 3e ff 69 36 f8 a3 ca 9f 3c 1b ad 5d 32 58 a1 70 43 4d dd d3 c6 e4 02 65 5e b8 e1 e1 57 68 94 32 fd 2e 1a 7c 7e 90 cb 6c 27 89 f6 a7 df 7c 83 fa 76 2c ec e5 c2 91 99 90 73 54 de 57 64 a5 93 a4 19 47 09 27 a7 38 52 98 b9 e1 d1 0b 46 c9 14 f1 00 ff fe 4f 00 e7 f3 f9 fd da e1 45 ac c7 3e 99 a3 17 ff c6 df 87 fc 38 82 2e b1 90 56 fb d5 3f 5c a4 f7 f5 09 7e 09 b5 5b 9f e2 4b d5 17 4a e6 7a 98 f0 16 9a ef 70 a0 83 83 3d 34 86 4c 42 29 de 87 e2 59 f9 0f 1c 1e 79 ae e1 75 d6 46 f9 eb c1 c1 b7 e2 4d 84 de ae e6 01 ff fb d6 eb 05 59 87 e9 a4 b9 df 1e bf 62 f7 f3 f3 05 3b eb 1a 85 43 e9 d8 83 64 b4 35 f1 5b 07 26 54 57 a4 ef 13 52 64 86 7b 2f 5f 1d 1c 6c 0e fb 79 e7 b0 6f 04 cf d1 59 27 0c 2b 02 f1 c5 11 47 87 3b 47 fc 8b fe af 8d 5c 84 e0 fd 3f 7a fe c5 4a 4c c8 39 2a 19 e5 7e 22 92 bb dc 50 ad d3 be 2c 45 8e c3 da a8 a7 4f a2 24 97 7d db d8 28 ac d9 88 4f b6 57 06 b9 cc 9e 3c 1b ad dd 32 58 21 b7 53 53 f7 b4 51 c8 a2 d5 72 78 fc ed e5 cc c4 e7 4f ab fd 85 1e 78 1e 22 0e df 23 a8 44 9a 4a 9d 0f e1 b0 4d be fd 19 41 a2 50 98 21 33 2d be 75 9a 48 12 32 a9 e4 36 ac c2 81 17 07 3f 8e a0 95 01 bf 3c 67 ec 11 94 52 f7 3b 31 3c ad 5d ea 98 1d 80 a8 1d 8d c0 e1 dc f5 39 c6 9c d7 12 06 47 f3 dd 24 a0 56 70 bf 8e a3 30 73 df 8f 42 bb 51 1e 3d fa 66

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757

Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_3164_13003242

Jump to behavior

Source: classification engine

Classification label: mal56.win@16/12@12/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,6419500029572030545,6045319169889960985,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://grandprairie-water-damage-restoration.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,6419500029572030545,6045319169889960985,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	5 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	6 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://grandprairie-water-damage-restoration.com	0%	Avira URL Cloud	safe
http://grandprairie-water-damage-restoration.com	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse
grandprairie-water-damage-restoration.com	7%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://grandprairie-water-damage-restoration.com/favicon.ico	0%	Avira URL Cloud	safe
http://grandprairie-water-damage-restoration.com/cgi-sys/images/404top_w.jpg	0%	Avira URL Cloud	safe
http://grandprairie-water-damage-restoration.com/cgi-sys/images/404bottom.gif	0%	Avira URL Cloud	safe
http://grandprairie-water-damage-restoration.com/cgi-sys/images/404mid.gif	0%	Avira URL Cloud	safe
http://grandprairie-water-damage-restoration.com/cgi-sys/images/f.png	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
accounts.google.com	142.251.15.84	true	false		high
code.jquery.com	151.101.66.137	true	false		high
www.google.com	172.253.124.104	true	false		high
clients.l.google.com	172.217.215.139	true	false		high
grandprairie-water-damage-restoration.com	192.185.99.217	true	false	7%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
clients2.google.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://grandprairie-water-damage-restoration.com/favicon.ico	false	Avira URL Cloud: safe	unknown
http://grandprairie-water-damage-restoration.com/cgi-sys/images/404top_w.jpg	false	Avira URL Cloud: safe	unknown
http://grandprairie-water-damage-restoration.com/	false		unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false		high
http://grandprairie-water-damage-restoration.com/cgi-sys/images/404mid.gif	false	Avira URL Cloud: safe	unknown
http://grandprairie-water-damage-restoration.com/cgi-sys/images/404bottom.gif	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
http://code.jquery.com/jquery-3.3.1.min.js	false		high
http://grandprairie-water-damage-restoration.com/cgi-sys/images/f.png	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.185.99.217	grandprairie-water-damage-restoration.com	United States	46606	UNIFIEDLAYER-AS-1US	false
172.217.215.139	clients.l.google.com	United States	15169	GOOGLEUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
142.251.15.84	accounts.google.com	United States	15169	GOOGLEUS	false
172.253.124.104	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1383915
Start date and time:	2024-01-31 11:28:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://grandprairie-water-damage-restoration.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@16/12@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 64.233.176.94, 34.104.35.123, 20.12.23.50, 72.21.81.240, 20.166.126.56, 192.229.211.108, 20.3.187.198, 108.177.122.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 140 x 140, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18239
Entropy (8bit):	7.972727118302574
Encrypted:	false
SSDEEP:	384:3bf01dOjMX9Oi9891zgQ2p4898X+3yFl+CeweQfUuBkZ:rf01oj+Or1kt3CFlVewnFBkZ
MD5:	48AB4A603B81E4FEED659BF03483C419
SHA1:	286B69301307E6C14EC3D32F85CDB8FCFBAD9DA6
SHA-256:	0ED026C4829F5BB704EA921A525D9E60BE74C072444E16AF21CB3CF90439E335
SHA-512:	C0236B6BFD97A3025701E9F6496D2349E10A34B09CE5B1B7FBC1AA0CD66A0B5CAE45A0451C02DB545A3FA9EDC724574342D44956246BAFB546D59AE95EDDB2FD
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............A>....sRGB.........bKGD..............pHYs.................tIME.......y.CF.. .IDATx..i.$.u.x.{..Y..]U..... ...A.(..$....I}.e.d.8...<...-.,[......Z..c.h..B........N.;...TWUW.j.-..;?b{..Y.....I..2+++3...{.}.3.gn....:'.s...?.........y..^..O.RMhUi..g.4.Q.sA\I..........H...).D....o..4_q..=UD.w.......n.9..`...?.[....vW0?...fc.F........T.P.Rp..".....N..dL.... U.<...g"......5b&.....\.`."T.`.ML\~..{.`GF`GF.F.&.@.0L@.^.#U....$..:.H..hs..G.j..Hc. ..-.'(z......W..........3...s.=.......#._*.&...<...,Z.....a...IN..]..O.gHf.._.Z@..N.....c..om....Q.O...[....>87.7.<..`......B...A....".&&.1=.........:..CEJ.Q.0z.G+..3.x.g.....^tWV....i-H>...U..q...q....W<...s;<.8........i.hh81...Esz....@T......^t.....<X,.&.>......c."..>l.{..v;......O.n.?.#8...:Oy.\|.{..I+..g... ......0..?$.E.Er.h....."L..?%U...G..RIM..m...d......H.....,z++....sV..n^[....)..z,=..3N;...um..g.~...................... P.Q.Q....+........j@Dc.R....@..;.....&.qP\|....o.\..3.......1.

Chrome Cache Entry: 48

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, from Unix, original size modulo 2^32 86927
Category:	downloaded
Size (bytes):	30288
Entropy (8bit):	7.989374364238999
Encrypted:	false
SSDEEP:	384:vqVmdqPCM85TevWTS9XJbgB2EttwJ52qjCpG6XUcUsJ5plH94VYb/n9SjXjwPG6G:vqUdH5TevT9Zi2CtE5FcGcUvq9f9tG
MD5:	FA20D8437865646E82DC61B9ADF6C93E
SHA1:	936B2B3A3757ECA48867CF43BADEF1C608177A28
SHA-256:	777EFEE22CC03118F4E5BA78AEF0CF7ADB1E8A13FC2B5C60FD220E80472F0188
SHA-512:	81C77E1A7B29D089EF10056C10AAC8F696CC889499D9B68B40550E861173557EDAF39049859188FE9EEC55F69B3B22B05044AFD8B6B212101EC792A7FD289F02
Malicious:	false
Reputation:	low
URL:	http://code.jquery.com/jquery-3.3.1.min.js
Preview:	............y{.F./...)D....-Jr&.w@..8^.gs&v.C1y .I!.....D.\|.[......3s.}3c.K.......q.....Uqwp........ .F._.=x...YR.yv.d....T..4.".XWyQR.......X./..Ju...........JT.}...%}6..a._...B..n....U>[/.....u....5o......Je..fz'Q\....W....".9......00c....P.Arp.f3s.V.tg...a..u..P+.6.a@3..i.fA.vW.?.?qu...i.N..L.'..F"R..'a.P.wE^...\.2...`.....4.DI..uy).tA..[...[1..A.........eR.....;.....L...d..u..D..i;..B...>.W.....W......d.L....... [/.T..T.@..V\.{...NDYL.......v...,..<.4?a%.....B%.z.T..0(.E...@.J.VR.ws... ....l.N...~$..a5.T.l..V.=.L..0...........u._+.f.zu....(...~..;..6...T..x..CE.b>...-.{!.....M..M.........7[.N..:>/..^.zu~..d...../..L..V.....m.`.@x=........e\|"..YQ$w..t...x......m.,.p..NF...>~...I..M.....J...Ub.......x..#..-M.U...%..j+T2......o.B.b+..UW1n..,.~$.....pMqeF,2,SD..>..V.9.sy..N..#.......U...O..2y...).Q.t...".}..y..zR.........y..$.OP}6.;J.*.....KQ.A..b..Q.x../....6$..s..0... .B..M.......R..nu...w:.....\|..o.'.H.2iTV....H...d.Y.I..

Chrome Cache Entry: 49

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 868 x 14
Category:	downloaded
Size (bytes):	537
Entropy (8bit):	6.848296452361371
Encrypted:	false
SSDEEP:	12:BDGHgnth2eq8ExIFDW+ax8+RorOwL+8Cu2uPhNWnyRmK3Fd7HRa:lGHith7rEAW+a0W8GChUnyRmoy
MD5:	54EB288427ACF79ED320EFD4916FE0B7
SHA1:	67BA813FF74D52035D70FCDA58B57563F01FB829
SHA-256:	70E4A5F9F7D98C1564B17ECC69196FED4F74FE5AFB2C61B4FB7045DD3309DC4F
SHA-512:	C7C00A268ADA15FC6B19F64860DD5CE92FA69E6B64E2D7B3ADA02B74E6CC3C4EB4466BBA443752A76F4EE908FA93F3683C6256F7A473B05C86ECAEBBCAC125E1
Malicious:	false
Reputation:	low
URL:	http://grandprairie-water-damage-restoration.com/cgi-sys/images/404bottom.gif
Preview:	GIF89ad......6e............\|.....m.....\.......Nw................X..s........d.................{..~.....k.....c..Y......................................................................................!.......,....d......@.AB,...r.l:..tJ.Z..v..z..xL....z]T...\|N.....~.....OnB.............Un.............S......................................f..............D.........f..............D.#p.........E......H...2..............@....#..... C..I...(S.\...0c.I...8s.....6.*.d.......(ph.DC...8..Z...X.j....`..K...S9X Q"I..;

Chrome Cache Entry: 50

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 868 x 14
Category:	dropped
Size (bytes):	537
Entropy (8bit):	6.848296452361371
Encrypted:	false
SSDEEP:	12:BDGHgnth2eq8ExIFDW+ax8+RorOwL+8Cu2uPhNWnyRmK3Fd7HRa:lGHith7rEAW+a0W8GChUnyRmoy
MD5:	54EB288427ACF79ED320EFD4916FE0B7
SHA1:	67BA813FF74D52035D70FCDA58B57563F01FB829
SHA-256:	70E4A5F9F7D98C1564B17ECC69196FED4F74FE5AFB2C61B4FB7045DD3309DC4F
SHA-512:	C7C00A268ADA15FC6B19F64860DD5CE92FA69E6B64E2D7B3ADA02B74E6CC3C4EB4466BBA443752A76F4EE908FA93F3683C6256F7A473B05C86ECAEBBCAC125E1
Malicious:	false
Reputation:	low
Preview:	GIF89ad......6e............\|.....m.....\.......Nw................X..s........d.................{..~.....k.....c..Y......................................................................................!.......,....d......@.AB,...r.l:..tJ.Z..v..z..xL....z]T...\|N.....~.....OnB.............Un.............S......................................f..............D.........f..............D.#p.........E......H...2..............@....#..... C..I...(S.\...0c.I...8s.....6.*.d.......(ph.DC...8..Z...X.j....`..K...S9X Q"I..;

Chrome Cache Entry: 51

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 868x169, components 3
Category:	downloaded
Size (bytes):	4335
Entropy (8bit):	5.483603315043782
Encrypted:	false
SSDEEP:	48:Ivi3ZsdwUKPGIhuF/ig2BamU/CSkMKisRHcfZakyWr9A9RSxNRXbRzwn:HpowU4ovDPCSrKishcxjyWrCCb+n
MD5:	DE6ECBBB2471827D90BF32C47A0CBC45
SHA1:	FFEAAFE8B9CA2752908C5D4E95E4803EF7FFDD18
SHA-256:	5CAE6C33F0F9D4449CE8539A60E7D40EBA2DDC75979FC26284854A29C36D08CB
SHA-512:	FAF0F054EF55B3362BA26615BC670DCC0471D660BBFBC4D086CE8CB143D31235AFC4AD4332FB669CAB4ED422C99FE67AB31D8E955D9B18F21A4CFDD33090D496
Malicious:	false
Reputation:	low
URL:	http://grandprairie-water-damage-restoration.com/cgi-sys/images/404top_w.jpg
Preview:	......JFIF.....H.H.....C..............................................!........."$".$.......C.........................................................................d..........................................:..............................!..16FQt.....aq..AV..&..................................'....................R........Q.!13...............?..X..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 17108
Category:	downloaded
Size (bytes):	6083
Entropy (8bit):	7.965190785004934
Encrypted:	false
SSDEEP:	96:G5DVLapxghT6h5o6bHNTJoy95ah8ROnPtbU6z7aFqDjdawCHH4oJ+8Gp3ANu4Le:EhhTeLNTJoy95auoFb9vnwHtJ+8ASLe
MD5:	080745182EC64AD1EEF75E561ABCB8F1
SHA1:	75D21E720D10EF11DDE6BE4251A426E45FA85485
SHA-256:	589A46931DE5754E4F14601D4348B79A9D658D832AE75E0F7A55732CBAF53FD1
SHA-512:	B3DEEDBF90A8A78AE319A23BB499CE53F664AF51FBCC4111530EEC619408FFC10EBD5C1171A4476E2FB5B5C66671A1EE58B2103329CC77216C86E80ADF17440E
Malicious:	false
Reputation:	low
URL:	http://grandprairie-water-damage-restoration.com/
Preview:	...........R.r.9...y.Z.vm..d.^[..1.6......r.@u7Fh..@..sl...=.U..f.....l.i<R........^.\|u....(bi...._...p<....x...5......ht.W.k...7?.`P.X....b.8.9...?...r.m..aH=#..`..$.Y...=.G/_.l.............b....2m.C..O........~&%F..l...z~>x.lD...M.....\|.q..<..d!\|.x^.l.b...Z.............^.~..d.^.......a8..+....:....m-H......t.G..V.oF...sx<:...JmG...t2n;.k&...2....a.tY....V.....,.bc."i..B..q.T..Ji.........GF..3Qj..h....g......B[._V=O..%.:...V.8}..E.......H./3!or.j....9...<~..........^.~..GO.zM.+........u^....(..&..~..l/.......Xx......../..:jg....xf0.../.%3........./..k[.......~....V.kx.v.....m.O.P...=.TB......!z.t........h.9\.V.8<./.L..h....m/\..f....vO.....<.4.g;..;P..r..t.....px.=...a...1.(<m.....G{G....\....?.3.3..+...L.....E...7...e.....t..'.'m.(..'g....R:.[}m..hw9:..83...M}..<K...gP....O.u..s......4!..JS.6....?.A..<.F.gPj;\-C....C.utg.q..dcNw....3...\|.........h...1.m.g....F.8^..V..Q.....!N.A@.56...H$.^.<h.F..t..hN....f..*Ig.?.Lg.......Wm..g/_.X

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 868x169, components 3
Category:	dropped
Size (bytes):	4335
Entropy (8bit):	5.483603315043782
Encrypted:	false
SSDEEP:	48:Ivi3ZsdwUKPGIhuF/ig2BamU/CSkMKisRHcfZakyWr9A9RSxNRXbRzwn:HpowU4ovDPCSrKishcxjyWrCCb+n
MD5:	DE6ECBBB2471827D90BF32C47A0CBC45
SHA1:	FFEAAFE8B9CA2752908C5D4E95E4803EF7FFDD18
SHA-256:	5CAE6C33F0F9D4449CE8539A60E7D40EBA2DDC75979FC26284854A29C36D08CB
SHA-512:	FAF0F054EF55B3362BA26615BC670DCC0471D660BBFBC4D086CE8CB143D31235AFC4AD4332FB669CAB4ED422C99FE67AB31D8E955D9B18F21A4CFDD33090D496
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C..............................................!........."$".$.......C.........................................................................d..........................................:..............................!..16FQt.....aq..AV..&..................................'....................R........Q.!13...............?..X..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 868 x 4
Category:	dropped
Size (bytes):	120
Entropy (8bit):	6.060493667147718
Encrypted:	false
SSDEEP:	3:CcnebN95vXG5Z1CK/7kCfrpvsdhyt86psoPHHn:tQG5Z1Dn+Wy6pseH
MD5:	DC8055F43FBB4A4B6DFB298EC35188F2
SHA1:	1FFC540743DE1CDB929D9D1218978005141E8D9D
SHA-256:	B857737891B84293B3DF526B48CE3D54FDCC5789C250EADFF9DD38E3C2C68CAF
SHA-512:	2CC173EFBA132E4352582F000F226E86A9A898B8A3AC1BA9633B2F19838B618EE3047555928E5258CC97E514D6F96ADF86391F7C6104288F1A61543E93B13518
Malicious:	false
Reputation:	low
Preview:	GIF89ad.................!.......,....d.....I...............H....................D..VL*.....J.T..P.j......-...;

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 868 x 4
Category:	downloaded
Size (bytes):	120
Entropy (8bit):	6.060493667147718
Encrypted:	false
SSDEEP:	3:CcnebN95vXG5Z1CK/7kCfrpvsdhyt86psoPHHn:tQG5Z1Dn+Wy6pseH
MD5:	DC8055F43FBB4A4B6DFB298EC35188F2
SHA1:	1FFC540743DE1CDB929D9D1218978005141E8D9D
SHA-256:	B857737891B84293B3DF526B48CE3D54FDCC5789C250EADFF9DD38E3C2C68CAF
SHA-512:	2CC173EFBA132E4352582F000F226E86A9A898B8A3AC1BA9633B2F19838B618EE3047555928E5258CC97E514D6F96ADF86391F7C6104288F1A61543E93B13518
Malicious:	false
Reputation:	low
URL:	http://grandprairie-water-damage-restoration.com/cgi-sys/images/404mid.gif
Preview:	GIF89ad.................!.......,....d.....I...............H....................D..VL*.....J.T..P.j......-...;

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 140 x 140, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18239
Entropy (8bit):	7.972727118302574
Encrypted:	false
SSDEEP:	384:3bf01dOjMX9Oi9891zgQ2p4898X+3yFl+CeweQfUuBkZ:rf01oj+Or1kt3CFlVewnFBkZ
MD5:	48AB4A603B81E4FEED659BF03483C419
SHA1:	286B69301307E6C14EC3D32F85CDB8FCFBAD9DA6
SHA-256:	0ED026C4829F5BB704EA921A525D9E60BE74C072444E16AF21CB3CF90439E335
SHA-512:	C0236B6BFD97A3025701E9F6496D2349E10A34B09CE5B1B7FBC1AA0CD66A0B5CAE45A0451C02DB545A3FA9EDC724574342D44956246BAFB546D59AE95EDDB2FD
Malicious:	false
Reputation:	low
URL:	http://grandprairie-water-damage-restoration.com/cgi-sys/images/f.png
Preview:	.PNG........IHDR...............A>....sRGB.........bKGD..............pHYs.................tIME.......y.CF.. .IDATx..i.$.u.x.{..Y..]U..... ...A.(..$....I}.e.d.8...<...-.,[......Z..c.h..B........N.;...TWUW.j.-..;?b{..Y.....I..2+++3...{.}.3.gn....:'.s...?.........y..^..O.RMhUi..g.4.Q.sA\I..........H...).D....o..4_q..=UD.w.......n.9..`...?.[....vW0?...fc.F........T.P.Rp..".....N..dL.... U.<...g"......5b&.....\.`."T.`.ML\~..{.`GF`GF.F.&.@.0L@.^.#U....$..:.H..hs..G.j..Hc. ..-.'(z......W..........3...s.=.......#._*.&...<...,Z.....a...IN..]..O.gHf.._.Z@..N.....c..om....Q.O...[....>87.7.<..`......B...A....".&&.1=.........:..CEJ.Q.0z.G+..3.x.g.....^tWV....i-H>...U..q...q....W<...s;<.8........i.hh81...Esz....@T......^t.....<X,.&.>......c."..>l.{..v;......O.n.?.#8...:Oy.\|.{..I+..g... ......0..?$.E.Er.h....."L..?%U...G..RIM..m...d......H.....,z++....sV..n^[....)..z,=..3N;...um..g.~...................... P.Q.Q....+........j@Dc.R....@..;.....&.qP\|....o.\..3.......1.

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2782
Category:	downloaded
Size (bytes):	1191
Entropy (8bit):	7.796270292729931
Encrypted:	false
SSDEEP:	24:XcZ+V72kAJOJMbpIYwbu7xzHfOHSyW3BgOk0o8fG+ITcIlp4ezR1ZO5:XcZKAeYpIrqzHfkSLHkbH4sRjO5
MD5:	DE892F8C9F4F88B59E09D5F162C5E1F2
SHA1:	1D257DA4E5DDE3A5817F2F41F047BAFD49B646A3
SHA-256:	70C74579F4A1E433CC33E298EA1C08073BFFCDFB6D6DD36163C942B2C8FE4381
SHA-512:	84006416B70DFE6B8CBA6F5EAA0F618406D8404A9FE0E04680BAC3D63F43294F7514A1777D1882A19574331599E4A3E4BC4B6298822535C7283CC1557A2024DC
Malicious:	false
Reputation:	low
URL:	http://grandprairie-water-damage-restoration.com/cgi-sys/js/simple-expand.min.js
Preview:	...........RMo.8...W.a..";.."C...b.m...=.=0..bC.^rl'p..wHJ....\|.8.o.{.lfVOV..d.w..w..Im........5..5.+W......>..rl.n.:.4vr.Rp..+..7W.w.@Wp.b..w.x).....~....#...7.\|.+.F.C.K...C++L.].A.w.a...H7....X+t.5\...d.j.3...$k. l...JX.xH....,...1$..f{...sR/..`.=..nQ \.1....yV..k..H^...3.. .....9<.:=.......R.`..F.{ZV....3.w.pm..P."..Ed...J......x..[.T4E.\.^`..-.K-Q...:...<....C.6N.E..Y...p.M..X9.....n.....{..M5..i....H.^W.o.{ ..He.._.e....'...........}.....W..X..T.T..Om...y..~.+{..y.;.wv...y.#.[.....y.3.e..56}i.}7..._.,.......24..X;8O........{....;F....L..Hx.Z..g..$..}....w......4P2..'<...O="]b....K2.....b.o.8&.,........g..b../b...2.........lS..~-u.s..@.CKq9.J%.vVl..$[.l......T._.....}....O...s$IGL.C#k.2..e2.5...B..Wz...?h..NV.>.Jy1.....J...^.z..}.(D....F:.x&...F...td..+A.N..-.*..X9......K.C./...I..N...{.8A.E.\|..7...5B.e9L-..r....ErnB6....P7......i.JX..U.l....W..0%.......LF......F.r/K\....[..g@......p....t...T_5P=\|$,A.K=...l.2..~.Ky.9..I.

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 11816
Category:	downloaded
Size (bytes):	4677
Entropy (8bit):	7.946065353100574
Encrypted:	false
SSDEEP:	96:bZ/NwFlux9fPOlplZDCxX44cnBn4PxuyjWe8zngjoNRc/YrdgN:bZ/CQZOLUcFleWJMUraYrdgN
MD5:	E6AAE2410885DF2F2629465B60A2691D
SHA1:	859D3D883FB8CA2AADEDF5753ABCD7ACCE922479
SHA-256:	A113D210F17827A95D9D1EEE68BF4E0AA8BD39D67DF1D9420FF5E9C0F49B1D48
SHA-512:	77CFA85A05295F3E1D239AE09D6EC80B7D038A0466276B7D5586E614035BABFAA7FAC4B965643EF18C38648ED68BACBFB510BCF06AC578BCFE2C11F7892544AD
Malicious:	false
Reputation:	low
URL:	http://grandprairie-water-damage-restoration.com/favicon.ico
Preview:	...........Rms......sg...J&av.......$...Nm.Rm.H.I...n..M...=._c.pw...~y...........3(\.........G...(z}.......[8....32qQt.....j.E..l0;.....h.Q....o.A....q...K......./^..z..P....P.`..1P.P...%J^Vy..g::<.s.}........k9=.v.].....I.v.s8w..>....;.]........N......p..3x.y......v...G......e...).e.,...v.&FV..I...Jq....M3H.......hp8(...a{.8jo..t..EI......6.....q^..>.Y.Z...Q.....H.].rBis_.4.:...Jar..!c...(.j...):....{{.d!5........D.h4..+....k5.y...U...D$w..Z.}Y....QO.,..5..I>.i6...<..]2X.pCM.....e^...Wh.2...\|~..l'....\|..v,.....sT.Wd....G.'.8R.....F......O.......E..>.......8....V..?\....~..[..K..J.z.....p...=4.LB)..Y....y..u.F......M.........Y.....b....;...C..d.5.[.&TW...Rd.{/_..l..y.o...Y'.+....G.;G.....\...?z..JL.9..~"...P..,E....O.$.}..(..O.W...<...2X!.SS..Q..rx......O....x."..#.D.J...M...A.P.!3-.u.H.2..6....?.....<g...R.;1<.]..........9....G..$.Vp...0s.B.Q.=.f.%a..fQmB<.q..MZq..0&....V....k....I&;..A...}m.D3.q..Icy+!Ef.}.~...`.i....../~].B......&.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 31, 2024 11:28:57.690392971 CET	49675	443	192.168.2.4	173.222.162.32
Jan 31, 2024 11:29:07.299688101 CET	49675	443	192.168.2.4	173.222.162.32
Jan 31, 2024 11:29:07.415970087 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.415993929 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.416065931 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.416399956 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.416429043 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.417866945 CET	49731	443	192.168.2.4	142.251.15.84
Jan 31, 2024 11:29:07.417901993 CET	443	49731	142.251.15.84	192.168.2.4
Jan 31, 2024 11:29:07.417979956 CET	49731	443	192.168.2.4	142.251.15.84
Jan 31, 2024 11:29:07.418183088 CET	49731	443	192.168.2.4	142.251.15.84
Jan 31, 2024 11:29:07.418210030 CET	443	49731	142.251.15.84	192.168.2.4
Jan 31, 2024 11:29:07.643939018 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.644793987 CET	443	49731	142.251.15.84	192.168.2.4
Jan 31, 2024 11:29:07.646497965 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.646532059 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.646823883 CET	49731	443	192.168.2.4	142.251.15.84
Jan 31, 2024 11:29:07.646841049 CET	443	49731	142.251.15.84	192.168.2.4
Jan 31, 2024 11:29:07.647119045 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.647191048 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.648576021 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.648596048 CET	443	49731	142.251.15.84	192.168.2.4
Jan 31, 2024 11:29:07.648643970 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.648682117 CET	49731	443	192.168.2.4	142.251.15.84
Jan 31, 2024 11:29:07.650861979 CET	49731	443	192.168.2.4	142.251.15.84
Jan 31, 2024 11:29:07.650950909 CET	443	49731	142.251.15.84	192.168.2.4
Jan 31, 2024 11:29:07.651266098 CET	49731	443	192.168.2.4	142.251.15.84
Jan 31, 2024 11:29:07.651278973 CET	443	49731	142.251.15.84	192.168.2.4
Jan 31, 2024 11:29:07.651504993 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.651654959 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.652124882 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.652141094 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.849293947 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.849591017 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.849771976 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.849771976 CET	49731	443	192.168.2.4	142.251.15.84
Jan 31, 2024 11:29:07.849772930 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.852962017 CET	49730	443	192.168.2.4	172.217.215.139
Jan 31, 2024 11:29:07.853030920 CET	443	49730	172.217.215.139	192.168.2.4
Jan 31, 2024 11:29:07.873545885 CET	443	49731	142.251.15.84	192.168.2.4
Jan 31, 2024 11:29:07.873708963 CET	443	49731	142.251.15.84	192.168.2.4
Jan 31, 2024 11:29:07.873936892 CET	49731	443	192.168.2.4	142.251.15.84
Jan 31, 2024 11:29:07.875402927 CET	49731	443	192.168.2.4	142.251.15.84
Jan 31, 2024 11:29:07.875466108 CET	443	49731	142.251.15.84	192.168.2.4
Jan 31, 2024 11:29:08.956341028 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:08.958012104 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.058799028 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.059875965 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.060132980 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.060298920 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.060379028 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.162353992 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.192610025 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.192653894 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.192692995 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.192729950 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.192738056 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.192770004 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.192825079 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.221538067 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.221729994 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.324021101 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.332818985 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.332861900 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.333187103 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.333225012 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.333262920 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.333297014 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.333301067 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.333342075 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.333359957 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.333381891 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.333379984 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.333420038 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.333440065 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.333462000 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.333497047 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.333518028 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.333535910 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.334000111 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.339102030 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.436332941 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.436410904 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.436434031 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.436455011 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.436476946 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.436599970 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.440659046 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.441286087 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.441508055 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.543154001 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543220043 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543344021 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543386936 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543427944 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543467999 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543488979 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.543489933 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.543508053 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543545961 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543584108 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543611050 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.543622017 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543631077 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.543659925 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543697119 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.543751001 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.546919107 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.546958923 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.547102928 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.550291061 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.550309896 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.550390959 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.553623915 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.553643942 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.553720951 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.557022095 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.557044029 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.557104111 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.560467005 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.560486078 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.560587883 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.563868999 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.563888073 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.563950062 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.567317009 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.567337036 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:09.567405939 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:09.581279993 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.621187925 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.621628046 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.622258902 CET	49738	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.683605909 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.683727980 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.683950901 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.724384069 CET	80	49738	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.729506969 CET	49738	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.729981899 CET	49738	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.731548071 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.731569052 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.731585026 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.731601000 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.731640100 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.731684923 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.734863043 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.740544081 CET	49740	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.747163057 CET	49741	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.785865068 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791115046 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791132927 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791135073 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.791148901 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791167974 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791184902 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791208982 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791219950 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.791225910 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791243076 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791255951 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.791259050 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791266918 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.791277885 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.791301012 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.791315079 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.831958055 CET	80	49738	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.840579033 CET	80	49738	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.842648029 CET	80	49740	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.845647097 CET	49740	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.846935034 CET	49740	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.849219084 CET	80	49741	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.849490881 CET	49741	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.850219011 CET	49741	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.850989103 CET	49742	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.865864038 CET	49738	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.893333912 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.893377066 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.893413067 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.893449068 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.893477917 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.893487930 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.893534899 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.911947966 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.952328920 CET	80	49740	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.952668905 CET	80	49741	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.952900887 CET	80	49742	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.954130888 CET	49742	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.957348108 CET	80	49740	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.957426071 CET	80	49740	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.957463980 CET	80	49740	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.957511902 CET	80	49740	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.957650900 CET	49740	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.957652092 CET	49740	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.959000111 CET	80	49741	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.979393959 CET	80	49738	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.979432106 CET	80	49738	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.979485989 CET	80	49738	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.979491949 CET	49738	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:09.979522943 CET	80	49738	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:09.979573965 CET	49738	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:10.007055044 CET	49741	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:10.020350933 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:10.066122055 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:11.101471901 CET	49747	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:29:11.101561069 CET	443	49747	172.253.124.104	192.168.2.4
Jan 31, 2024 11:29:11.101661921 CET	49747	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:29:11.102288008 CET	49747	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:29:11.102320910 CET	443	49747	172.253.124.104	192.168.2.4
Jan 31, 2024 11:29:11.315865993 CET	443	49747	172.253.124.104	192.168.2.4
Jan 31, 2024 11:29:11.316245079 CET	49747	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:29:11.316284895 CET	443	49747	172.253.124.104	192.168.2.4
Jan 31, 2024 11:29:11.317323923 CET	443	49747	172.253.124.104	192.168.2.4
Jan 31, 2024 11:29:11.317418098 CET	49747	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:29:11.319221973 CET	49747	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:29:11.319293976 CET	443	49747	172.253.124.104	192.168.2.4
Jan 31, 2024 11:29:11.360444069 CET	49747	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:29:11.360487938 CET	443	49747	172.253.124.104	192.168.2.4
Jan 31, 2024 11:29:11.407326937 CET	49747	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:29:12.785562038 CET	49748	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:12.785653114 CET	443	49748	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:12.785805941 CET	49748	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:12.806621075 CET	49748	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:12.806704044 CET	443	49748	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.033833027 CET	443	49748	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.033968925 CET	49748	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.042931080 CET	49748	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.042989016 CET	443	49748	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.043457031 CET	443	49748	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.094928026 CET	49748	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.193540096 CET	49748	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.233915091 CET	443	49748	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.296629906 CET	443	49748	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.296741962 CET	443	49748	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.296834946 CET	49748	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.296972990 CET	49748	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.297014952 CET	443	49748	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.297055960 CET	49748	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.297071934 CET	443	49748	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.386981010 CET	49749	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.387070894 CET	443	49749	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.387329102 CET	49749	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.388390064 CET	49749	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.388427019 CET	443	49749	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.605091095 CET	443	49749	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.605204105 CET	49749	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.608925104 CET	49749	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.608936071 CET	443	49749	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.609246969 CET	443	49749	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.610800982 CET	49749	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.653945923 CET	443	49749	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.803055048 CET	443	49749	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.803217888 CET	443	49749	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.803280115 CET	49749	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.804730892 CET	49749	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.804750919 CET	443	49749	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:13.804765940 CET	49749	443	192.168.2.4	23.216.73.151
Jan 31, 2024 11:29:13.804773092 CET	443	49749	23.216.73.151	192.168.2.4
Jan 31, 2024 11:29:14.732896090 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:14.733241081 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:14.738132954 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:14.738217115 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:14.958786011 CET	80	49740	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:14.960050106 CET	80	49741	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:14.960150957 CET	49741	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:14.960289955 CET	49740	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:14.980767965 CET	80	49738	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:14.981025934 CET	49738	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:15.022010088 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:15.022089005 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:17.323326111 CET	49741	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:17.323492050 CET	49737	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:17.323599100 CET	49740	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:17.323652029 CET	49735	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:17.323729038 CET	49734	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:17.323853016 CET	49738	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:17.425582886 CET	80	49741	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:17.425652981 CET	80	49737	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:17.425688028 CET	80	49740	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:17.425724030 CET	80	49738	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:17.425756931 CET	80	49735	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:17.425791979 CET	80	49734	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:21.405164957 CET	443	49747	172.253.124.104	192.168.2.4
Jan 31, 2024 11:29:21.405236006 CET	443	49747	172.253.124.104	192.168.2.4
Jan 31, 2024 11:29:21.405313969 CET	49747	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:29:21.644987106 CET	49747	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:29:21.645019054 CET	443	49747	172.253.124.104	192.168.2.4
Jan 31, 2024 11:29:41.740868092 CET	80	49742	192.185.99.217	192.168.2.4
Jan 31, 2024 11:29:41.740942955 CET	49742	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:54.580353975 CET	49736	80	192.168.2.4	151.101.66.137
Jan 31, 2024 11:29:54.682765961 CET	80	49736	151.101.66.137	192.168.2.4
Jan 31, 2024 11:29:54.966842890 CET	49742	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:29:55.069104910 CET	80	49742	192.185.99.217	192.168.2.4
Jan 31, 2024 11:30:11.032814026 CET	49742	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:30:11.033142090 CET	49757	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:30:11.033178091 CET	443	49757	172.253.124.104	192.168.2.4
Jan 31, 2024 11:30:11.033241987 CET	49757	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:30:11.033555984 CET	49757	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:30:11.033571005 CET	443	49757	172.253.124.104	192.168.2.4
Jan 31, 2024 11:30:11.135325909 CET	80	49742	192.185.99.217	192.168.2.4
Jan 31, 2024 11:30:11.135552883 CET	49742	80	192.168.2.4	192.185.99.217
Jan 31, 2024 11:30:11.248574018 CET	443	49757	172.253.124.104	192.168.2.4
Jan 31, 2024 11:30:11.249352932 CET	49757	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:30:11.249378920 CET	443	49757	172.253.124.104	192.168.2.4
Jan 31, 2024 11:30:11.249857903 CET	443	49757	172.253.124.104	192.168.2.4
Jan 31, 2024 11:30:11.253348112 CET	49757	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:30:11.253433943 CET	443	49757	172.253.124.104	192.168.2.4
Jan 31, 2024 11:30:11.297107935 CET	49757	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:30:21.262239933 CET	443	49757	172.253.124.104	192.168.2.4
Jan 31, 2024 11:30:21.262311935 CET	443	49757	172.253.124.104	192.168.2.4
Jan 31, 2024 11:30:21.262470961 CET	49757	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:30:21.644046068 CET	49757	443	192.168.2.4	172.253.124.104
Jan 31, 2024 11:30:21.644084930 CET	443	49757	172.253.124.104	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 31, 2024 11:29:07.296233892 CET	61625	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:07.296901941 CET	55326	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:07.297807932 CET	61569	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:07.298188925 CET	61659	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:07.400008917 CET	53	53187	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:07.413536072 CET	53	61625	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:07.414529085 CET	53	55326	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:07.414943933 CET	53	61569	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:07.415416002 CET	53	61659	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:08.071403027 CET	53	62462	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:08.834615946 CET	64806	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:08.835194111 CET	51751	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:08.955269098 CET	53	64806	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:08.955300093 CET	53	51751	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:09.220725060 CET	56256	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:09.220894098 CET	61644	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:09.338208914 CET	53	61644	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:09.338244915 CET	53	56256	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:09.443593025 CET	62513	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:09.443758011 CET	50565	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:09.561290979 CET	53	62513	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:09.579811096 CET	53	50565	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:10.981534004 CET	65452	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:10.981901884 CET	53593	53	192.168.2.4	1.1.1.1
Jan 31, 2024 11:29:11.098972082 CET	53	53593	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:11.099258900 CET	53	65452	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:24.509382963 CET	138	138	192.168.2.4	192.168.2.255
Jan 31, 2024 11:29:25.475383997 CET	53	53874	1.1.1.1	192.168.2.4
Jan 31, 2024 11:29:44.181236029 CET	53	59810	1.1.1.1	192.168.2.4
Jan 31, 2024 11:30:06.645445108 CET	53	49575	1.1.1.1	192.168.2.4
Jan 31, 2024 11:30:07.210984945 CET	53	55964	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 31, 2024 11:29:07.296233892 CET	192.168.2.4	1.1.1.1	0xf9b9	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:07.296901941 CET	192.168.2.4	1.1.1.1	0xc01a	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 31, 2024 11:29:07.297807932 CET	192.168.2.4	1.1.1.1	0x778f	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:07.298188925 CET	192.168.2.4	1.1.1.1	0xcf03	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 31, 2024 11:29:08.834615946 CET	192.168.2.4	1.1.1.1	0x8d8f	Standard query (0)	grandprairie-water-damage-restoration.com	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:08.835194111 CET	192.168.2.4	1.1.1.1	0xb2b6	Standard query (0)	grandprairie-water-damage-restoration.com	65	IN (0x0001)	false
Jan 31, 2024 11:29:09.220725060 CET	192.168.2.4	1.1.1.1	0xaa9d	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:09.220894098 CET	192.168.2.4	1.1.1.1	0xa8e4	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Jan 31, 2024 11:29:09.443593025 CET	192.168.2.4	1.1.1.1	0xe8b9	Standard query (0)	grandprairie-water-damage-restoration.com	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:09.443758011 CET	192.168.2.4	1.1.1.1	0x840f	Standard query (0)	grandprairie-water-damage-restoration.com	65	IN (0x0001)	false
Jan 31, 2024 11:29:10.981534004 CET	192.168.2.4	1.1.1.1	0xb33	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:10.981901884 CET	192.168.2.4	1.1.1.1	0xe593	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 31, 2024 11:29:07.413536072 CET	1.1.1.1	192.168.2.4	0xf9b9	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 31, 2024 11:29:07.413536072 CET	1.1.1.1	192.168.2.4	0xf9b9	No error (0)	clients.l.google.com		172.217.215.139	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:07.413536072 CET	1.1.1.1	192.168.2.4	0xf9b9	No error (0)	clients.l.google.com		172.217.215.101	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:07.413536072 CET	1.1.1.1	192.168.2.4	0xf9b9	No error (0)	clients.l.google.com		172.217.215.102	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:07.413536072 CET	1.1.1.1	192.168.2.4	0xf9b9	No error (0)	clients.l.google.com		172.217.215.138	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:07.413536072 CET	1.1.1.1	192.168.2.4	0xf9b9	No error (0)	clients.l.google.com		172.217.215.100	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:07.413536072 CET	1.1.1.1	192.168.2.4	0xf9b9	No error (0)	clients.l.google.com		172.217.215.113	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:07.414529085 CET	1.1.1.1	192.168.2.4	0xc01a	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 31, 2024 11:29:07.414943933 CET	1.1.1.1	192.168.2.4	0x778f	No error (0)	accounts.google.com		142.251.15.84	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:08.955269098 CET	1.1.1.1	192.168.2.4	0x8d8f	No error (0)	grandprairie-water-damage-restoration.com		192.185.99.217	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:09.338244915 CET	1.1.1.1	192.168.2.4	0xaa9d	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:09.338244915 CET	1.1.1.1	192.168.2.4	0xaa9d	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:09.338244915 CET	1.1.1.1	192.168.2.4	0xaa9d	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:09.338244915 CET	1.1.1.1	192.168.2.4	0xaa9d	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:09.561290979 CET	1.1.1.1	192.168.2.4	0xe8b9	No error (0)	grandprairie-water-damage-restoration.com		192.185.99.217	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:11.098972082 CET	1.1.1.1	192.168.2.4	0xe593	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 31, 2024 11:29:11.099258900 CET	1.1.1.1	192.168.2.4	0xb33	No error (0)	www.google.com		172.253.124.104	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:11.099258900 CET	1.1.1.1	192.168.2.4	0xb33	No error (0)	www.google.com		172.253.124.106	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:11.099258900 CET	1.1.1.1	192.168.2.4	0xb33	No error (0)	www.google.com		172.253.124.99	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:11.099258900 CET	1.1.1.1	192.168.2.4	0xb33	No error (0)	www.google.com		172.253.124.105	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:11.099258900 CET	1.1.1.1	192.168.2.4	0xb33	No error (0)	www.google.com		172.253.124.147	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:11.099258900 CET	1.1.1.1	192.168.2.4	0xb33	No error (0)	www.google.com		172.253.124.103	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:21.939204931 CET	1.1.1.1	192.168.2.4	0x467	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 31, 2024 11:29:21.939204931 CET	1.1.1.1	192.168.2.4	0x467	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:40.556833029 CET	1.1.1.1	192.168.2.4	0xebef	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 31, 2024 11:29:40.556833029 CET	1.1.1.1	192.168.2.4	0xebef	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:29:59.261835098 CET	1.1.1.1	192.168.2.4	0x9f9a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 31, 2024 11:29:59.261835098 CET	1.1.1.1	192.168.2.4	0x9f9a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Jan 31, 2024 11:30:19.390131950 CET	1.1.1.1	192.168.2.4	0xd50e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 31, 2024 11:30:19.390131950 CET	1.1.1.1	192.168.2.4	0xd50e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

fs.microsoft.com

grandprairie-water-damage-restoration.com

code.jquery.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	192.185.99.217	80	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 31, 2024 11:29:09.060132980 CET	456	OUT	GET / HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.192610025 CET	1286	IN	HTTP/1.1 403 Forbidden Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Fri, 30 Sep 2022 16:19:10 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 6083 Keep-Alive: timeout=5, max=75 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 52 ed 72 1b 39 92 fc ed 79 8a 5a fa 76 6d c7 89 a4 64 c9 5e 5b a2 b8 31 e3 8f b5 36 ec b1 c2 d2 c4 dc fc 72 80 40 75 37 46 68 a0 07 40 93 ec 73 6c c4 bd c3 bd e1 3d c9 55 a1 c9 66 93 a2 bc f2 ed 6c c4 69 3c 52 03 85 ca ca ca cc c9 1f 5e 7f 7c 75 fd cb e5 1b 28 62 69 e0 f2 a7 1f de 5f bc 82 c1 70 3c fe f9 f8 d5 78 fc fa fa 35 fc c7 bb eb 0f ef e1 68 74 08 57 d1 6b 19 c7 e3 37 3f 0e 60 50 c4 58 9d 8e c7 8b c5 62 b4 38 1e 39 9f 8f af 3f 8d 97 8c 72 c4 6d ab cf 61 48 3d 23 15 d5 60 fa dd 24 0d 59 96 c6 86 f3 3d 00 47 2f 5f be 6c fb 06 fc e8 d4 08 9b 9f 0f d0 0e a0 fb 62 0c 14 0a 2a ef 32 6d b0 43 c9 cb 2a 4f 18 cb cc 8e 8f 8e e8 1d ac 7e 26 25 46 01 fc 6c 88 bf d5 7a 7e 3e 78 e5 6c 44 1b 87 d7 4d 85 03 90 ed e9 7c 10 71 19 c7 3c fc 0c 64 21 7c c0 78 5e c7 6c f8 62 00 e3 1e 5a d4 d1 e0 f4 e4 f0 18 86 f0 f6 e3 a7 1f 2e 5e bf 7e f3 e3 64 dc 5e 7f f7 dd 03 fa 99 fc 61 38 84 ef 95 82 2b a3 15 c2 c7 3a 06 18 0e a7 6d 2d 48 af ab 08 c1 cb 8e bb 74 0a 47 bf fe 56 a3 6f 46 d2 95 e3 f6 73 78 3c 3a 1e 1d 8d 4a 6d 47 bf 86 c1 74 32 6e 3b a7 6b 26 b7 e1 c6 32 d7 c3 d0 84 f1 af 61 1c 74 59 19 1c e2 b2 12 56 dd 06 e9 f6 d9 2c 16 62 63 10 22 69 b2 92 42 86 d0 93 71 e6 54 f3 a5 12 4a 69 9b 9f 1e 9e 95 c2 e7 da d2 47 46 f2 0d 33 51 6a d3 9c 16 68 e6 18 b5 14 67 7f ef fa 1e b2 be 42 5b f4 5f 56 3d 4f 0f ab 25 88 3a ba b3 85 56 b1 38 7d f1 fc 45 b5 dc db 01 0f a3 ab 48 ea 2f 33 21 6f 72 ef 6a ab 86 ba 14 39 9e d6 de 3c 7e d4 ed 9b ee c2 f8 e4 f0 84 de 7f 5e 8c 7e ad f2 47 4f ce 7a 4d 1e 2b 14 f1 d4 ba d5 d7 d6 e4 02 75 5e c4 d3 a3 af d0 28 b5 fa 26 1a f4 7e 94 eb 6c 2f 89 f6 cf b0 b9 c7 f6 ed 58 78 98 8b e8 fc cc c5 e8 ca 2f 95 0b 3a 6a 67 09 c7 88 a8 e7 78 66 30 8b a7 c7 2f 09 25 33 8e 06 f0 f9 1f 00 2e 97 cb 2f bd c7 6b 5b 8f d9 99 e3 e7 fc fb 88 7e 9d c1 ca b1 e4 56 fb 6b 78 b4 76 ef eb 13 f8 0a 6d ec 4f e1 50 0d 85 d1 b9 3d 95 54 42 ff 0d 0a ac e0 e0 21 7a ef bc 74 0a bf a4 e0 05 fd 9f 98 68 b7 39 5c b4 56 be 38 3c bc 2f de 4c d8 dd 68 1e d2 7f f7 6d 2f 5c 88 a8 66 cd 97 dd f1 1b 76 4f 9f ad d9 85 d8 18 3c d5 91 34 90 67 3b 13 ef 3b 50 ba ba 72 f6 8b 74 c6 f9 d3 87 df ff 70 78 b8 3d ec e9 de 61 f7 04 cf 31 86 28 3c 6d 04 e2 ce 11 c7 47 7b 47 fc 1f f5 ef 8d 5c 9b c0 fa 1f 3f bb 33 12 33 17 a3 2b 09 e5 cb 4c c8 9b dc bb da aa a1 2e 45 8e a7 b5 37 8f 1f 8d 65 ae 87 a1 09 e3 74 17 c6 27 87 27 6d cb 28 d7 d9 a3 27 67 bd 2e 8f 15 52 3a ad 5b 7d 6d 05 b2 68 77 39 3a b9 7f 38 33 f1 db e7 4d 7d bd 0f 3c 4b 16 a7 df 67 50 09 a5 b4 cd 4f e1 a8 75 be fd 73 06 d2 a0 f0 a7 c4 b4 b8 ef 34 21 a5 f3 4a 53 1a 36 e6 c0 cb c3 3f 9e 41 bb 06 3c 7f 46 d8 67 50 6a 3b 5c 2d 43 d3 da ab 15 b3 43 10 75 74 67 10 71 19 87 64 63 4e 77 92 c0 d1 7f 33 09 a8 0d 7c e9 e3 18 cc e2 b7 a3 b8 df 05 c5 68 d8 15 e5 9b 31 aa 6d 88 67 7f dc 96 e9 ff 46 ac 38 5e a1 2e 56 86 cc 9c 51 04 f3 e0 c1 fd 21 4e f6 41 40 cb 35 36 86 c8 ea 48 24 e5 5e be 3c 68 b4 46 fd a2 74 a8 Data Ascii: Rr9yZvmd^[16r@u7Fh@sl=Ufli<R^\|u(bi_p<x5htWk7?`PXb89?rmaH=#`$Y=G/_lb2mCO~&%Flz~>xlDM\|q<d!\|x^lbZ.^~d^a8+:m-HtGVoFsx<:JmGt2n;k&2atYV,bc"iBqTJiGF3QjhgB[_V=O%:V8}EH/3!orj9<~^~GOzM+u^(&~l/Xx/:jgxf0/%3./k[~VkxvmOP=TB!zth9\V8</Lhm/\fvO<4g;;Prtpx=a1(<mG{G\?33+L.E7et''m('g.R:[}mhw9:83M}<KgPOus4!JS6?A<FgPj;\-CCutgqdcNw3\|h1mgF8^.VQ!NA@56H$^<hFt
Jan 31, 2024 11:29:09.192653894 CET	1286	IN	Data Raw: 8c 68 4e ad b3 b8 2e 66 da 07 2a 49 67 9c 3f a5 4c 67 cf 9f 1f 1e ae 8b 01 a9 57 6d aa c7 b3 67 2f 5f be 58 57 63 a1 7d af 78 f4 f2 85 3c 7a b9 19 aa 10 be c0 4c c8 9b dc bb da aa e1 fa 1d 3e e3 ff ce 68 11 af 90 2e 9e 56 4b 08 ce 68 45 25 85 47 Data Ascii: hN.fIg?LgWmg/_XWc}x<zL>h.VKhE%G)<Zw6dEsNBGq{]\|7((=]EF1Auz\.]9/cahX"0F L<`\|U&v&ueyp0}O~x;;
Jan 31, 2024 11:29:09.192692995 CET	1286	IN	Data Raw: 5a a4 44 46 09 8f bc f6 42 c7 02 50 50 36 db 18 12 d7 ee 9d 75 f4 d7 18 b7 e0 87 b4 35 91 11 4a 79 1e b2 9a 45 6a f0 f0 a0 e3 2e 7d 22 96 41 e3 6a 58 b8 da 28 30 fa 06 f9 b5 2c 50 de 90 1a 24 98 d4 99 96 89 1a a7 ac 61 49 b6 97 48 ed 92 e6 4a 57 Data Ascii: ZDFBPP6u5JyEj.}"AjX(0,P$aIHJWHj'b]6uno?k#~f7\[WMwBEb'B4l50zEe-#4%2,1Z-KQVvHnBdO9H#B8Hp)=(WOyWeUkG/gvcu$o
Jan 31, 2024 11:29:09.192729950 CET	1286	IN	Data Raw: 9b e2 8b ec 1c 4b bc 15 d2 ce 8c 80 29 9d bd 64 8e e0 83 f3 14 75 94 85 d5 52 18 d3 1c 90 4d 3a d9 4d f1 71 92 99 77 60 69 0c 23 88 b4 65 a6 d1 28 f8 9f ff fa ef 76 2e 5f 79 cc d0 a3 95 98 e6 62 25 bc 20 49 36 03 db 8c a6 f8 6a 9b c3 f1 2a 1f a4 Data Ascii: K)duRM:Mqw`i#e(v._yb% I6j*D]"L<\|)ofgo3CL~7;J7a{>S#n>v\MP:px>W\yKd2Ik?:>a'~:#NT6i
Jan 31, 2024 11:29:09.192770004 CET	1261	IN	Data Raw: a8 6d 8d 6d de 30 51 dd 97 b4 bb 23 d6 19 dd ea 11 52 72 ee 1d f9 2b 31 47 78 55 08 9b 63 e8 49 d4 ca 58 d3 9e 1e 7c 8a 43 91 2c 76 de d2 cd 82 05 57 ce ae 58 cb b6 bd a5 3d 43 08 84 b9 77 fe 35 92 2a 24 17 21 e0 2c e8 c8 fa 93 a0 37 d4 52 7b 6c Data Ascii: mm0Q#Rr+1GxUcIX\|C,vWX=Cw5$!,7R{l+zNVg1.2.0]'93AY +iWJd}MvXp&HVtee0NBwn\mw&x\|B9;&cAg3SkA8N!eE@1;8}IvJjBCj
Jan 31, 2024 11:29:09.221538067 CET	385	OUT	GET /cgi-sys/js/simple-expand.min.js HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://grandprairie-water-damage-restoration.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.332818985 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Last-Modified: Fri, 30 Sep 2022 16:19:12 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1191 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: application/javascript Data Raw: 1f 8b 08 00 00 00 00 00 00 03 95 52 4d 6f db 38 10 bd f7 57 d0 82 61 88 85 22 3b 05 f6 22 43 c8 c1 ed 62 b3 6d 92 2e 92 3d 15 3d 30 d2 d8 62 43 93 5e 72 6c 27 70 fc df 77 48 4a b6 e2 a6 dd 2e 7c b0 38 9f 6f de 7b e3 b7 6c 66 56 4f 56 2e 1a 64 e9 8c b3 77 93 f3 77 ec f6 49 6d 84 d4 ec 0f b1 04 f5 e6 b3 35 df a0 c2 82 35 88 2b 57 8c c7 0b 89 cd fa 3e af cc 72 6c a1 6e 0c 3a f5 34 76 72 b9 52 70 06 8f 2b a1 eb 37 57 97 77 ec 93 ac 40 57 70 ec b3 62 9b ff 77 ef 78 29 1c 82 1d ab d8 7e b6 94 98 e3 23 b2 b7 e3 37 e9 7c ad 2b 94 46 a7 43 be 4b d6 0e 98 43 2b 2b 4c a6 5d 82 41 ca 77 1b 61 19 94 d8 48 37 85 bc 86 b9 58 2b 74 e5 ae 91 35 5c 99 1a 8a 64 2e 6a b8 33 8b 85 82 24 6b f3 b7 20 6c d5 c4 f4 4a 58 d0 78 48 dd 09 bb 00 2c 12 02 ad 31 24 b0 b1 66 7b a3 af a4 73 52 2f da fc 60 92 3d 00 ac 6e 51 20 5c ea 99 31 0f 12 8a c1 79 56 85 af 6b a2 b2 48 5e 1c 9a ec 33 c8 1d 20 d2 0c 82 b7 cf 86 39 3c d2 82 3a 3d 86 b3 e3 01 9c be e7 52 d7 9f 60 03 ea 46 c3 7b 5a 56 1e 08 81 0c 33 cd 77 16 70 6d 89 85 50 99 22 a7 7f 45 64 1e 89 eb 4a 06 c3 d4 13 c4 f3 78 ac fb 5b a3 54 34 45 f3 5c 81 5e 60 b3 e7 2d bc 4b 2d 51 0a 15 ee 3a ee 0b db 3c d1 b6 84 dc 82 a8 43 9e 36 4e ed 45 8a 14 59 9a 0d cc 94 70 2e 4d 2a a3 94 58 39 a8 13 9e 8b ba 6e a3 91 04 1f f4 7b 1a b3 4d 35 e7 c5 69 ef b1 aa d7 da 1b 48 bd 5e 57 df bb 6f bf 7b 20 f9 ee 48 65 de e9 5f 96 65 df 01 17 18 27 f0 e2 07 b5 f7 c2 c9 2a 19 8d ba ba 7d 8b f7 ff ef 09 57 fe c2 9e 58 e7 f7 54 0d 54 0f 1f 4f 6d f5 d9 02 79 b1 96 7e b9 2b 7b da ca 79 cf 3b f9 77 76 1c 8d 86 79 b4 23 ed 5b 13 ad e4 12 a8 79 b0 33 d3 b0 65 1f ac 35 36 7d 69 d3 82 7d 37 87 99 95 5f c8 2c fc b3 96 16 1c eb c6 32 34 ec 1e 58 3b 38 4f c2 0d de 1d b1 af 0f d5 7b 07 cb ae b1 0f 3b 46 ae c5 12 c8 4c d1 cf 48 78 f5 5a a9 e7 67 ff 95 24 17 bb 7d f1 e7 ed cd b5 77 af f3 ae eb f6 9c ba 34 50 32 f8 19 27 3c ae 18 9c 4f 3d 22 5d 62 2e 10 89 83 4b 32 d7 94 9a f5 0b aa 62 f1 b4 6f fc 38 26 e5 99 2c ed 17 fd 95 ca 07 93 e7 67 9a d7 62 97 c1 2f 62 03 a7 d8 32 fd cb e8 da 85 a7 d8 ec 8f b0 c9 13 6c 53 f9 c5 7e 2d 75 f6 73 ba b3 40 a9 43 4b 71 39 7f 4a 25 cf 76 56 6c 8b c1 24 5b 09 6c 8a ad d4 b5 d9 e6 ca 54 c2 5f 90 fb a0 a6 be 7d a0 1f 83 cd 4f ee eb 88 8a c9 99 73 24 49 47 4c 0f 43 23 6b b8 32 b5 b7 65 32 17 35 dc 85 f2 e4 42 e7 c7 57 7a fe db 84 17 3f 68 ba 17 4e 56 be 3e 2e 4a 79 31 cc a5 fb bd c3 f2 4a 17 1f 8d 5e 89 7a d4 99 e5 7d c5 28 44 81 c1 f9 f1 46 3a e3 78 26 f0 dd e1 9e 46 b8 99 12 74 64 02 8f 2b 41 c2 90 4e 17 e9 a1 2d a6 2a a3 94 58 39 a8 d9 b1 88 c6 f3 e2 b4 b0 4b b3 43 87 2f 9c 04 b2 49 f1 fa 4e d8 05 a0 7b c1 38 41 dd 45 03 7c f9 da b9 37 11 f7 ce a8 35 42 c2 65 39 4c 2d 9f 82 72 c0 ba ac 05 45 72 6e 42 36 0e fe 04 1b 50 37 1a de 93 1b fd f5 d9 69 cb 4a 58 d0 98 c4 55 8e 6c 19 03 e4 b3 da b0 57 a7 b8 30 25 93 b9 02 bd c0 86 86 4c 46 a3 d4 95 ee d0 ca a7 db 46 92 72 2f 4b 5c fb 1a d0 8b ef 5b a2 a5 67 40 d0 cd 1b 92 e7 c4 70 c3 1c 1e 11 74 dd 93 9c c2 54 5f 35 50 3d 7c 24 2c 41 d4 4b 3d 0b b6 Data Ascii: RMo8Wa";"Cbm.==0bC^rl'pwHJ.\|8o{lfVOV.dwwIm55+W>rln:4vrRp+7Ww@Wpbwx)~#7\|+FCKC++L]AwaH7X+t5\d.j3$k lJXxH,1$f{sR/`=nQ \1yVkH^3 9<:=R`F{ZV3wpmP"EdJx[T4E\^`-K-Q:<C6NEYp.MX9n{M5iH^Wo{ He_e'}WXTTOmy~+{y;wvy#[y3e56}i}7_,24X;8O{;FLHxZg$}w4P2'<O="]b.K2bo8&,gb/b2lS~-us@CKq9J%vVl$[lT_}Os$IGLC#k2e25BWz?hNV>.Jy1J^z}(DF:x&Ftd+AN-*X9KC/IN{8AE\|75Be9L-rErnB6P7iJXUlW0%LFFr/K\[g@ptT_5P=\|$,AK=
Jan 31, 2024 11:29:09.332861900 CET	207	IN	Data Raw: ff 6c a1 32 ba 96 7e 80 4b 79 86 39 88 aa 49 0f 33 e3 89 48 b4 61 23 1d cf 34 1d 2b 10 6d 9a d4 02 c5 59 2b 91 3d c3 a0 45 c2 9f 9f 7b a6 aa 61 2e d6 0a a3 4e 99 fd 69 eb 99 03 61 ab e6 f5 09 b7 21 e7 fd 99 75 ec b6 e2 07 79 34 f7 52 f7 89 e3 3b Data Ascii: l2~Ky9I3Ha#4+mY+=E{a.Nia!uy4R;`cF_I{y&N.WZ8k2mZe3/5%T HO[d<\|oao0<XzFtadH0<=O^R
Jan 31, 2024 11:29:09.621628046 CET	440	OUT	GET /cgi-sys/images/404mid.gif HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://grandprairie-water-damage-restoration.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.734863043 CET	361	IN	HTTP/1.1 200 OK Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Last-Modified: Fri, 30 Sep 2022 16:20:18 GMT Accept-Ranges: bytes Content-Length: 120 Keep-Alive: timeout=5, max=73 Connection: Keep-Alive Content-Type: image/gif Data Raw: 47 49 46 38 39 61 64 03 04 00 91 00 00 9a b2 c9 ff ff ff a0 b6 cc a1 b7 cd 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 04 00 00 02 49 dc 82 a9 cb ed 0f a3 9c b4 da 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a6 ea ca b6 ee 9b 00 80 01 d7 f6 8d e7 fa ce f7 fe 0f 0c 0a 87 44 8a 8c 56 4c 2a 97 cc a6 f3 09 8d 4a a7 54 cc f1 50 cd 6a b7 dc ae f7 0b 0e 8b 2d b2 02 00 3b Data Ascii: GIF89ad!,dIHDVL*JTPj-;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	192.185.99.217	80	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 31, 2024 11:29:09.221729994 CET	435	OUT	GET /cgi-sys/images/f.png HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://grandprairie-water-damage-restoration.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.333187103 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Mon, 03 Oct 2022 09:33:42 GMT Accept-Ranges: bytes Content-Length: 18239 Keep-Alive: timeout=5, max=75 Content-Type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 8c 08 06 00 00 00 ae c0 41 3e 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 dd 08 1c 14 1b 17 79 01 43 46 00 00 20 00 49 44 41 54 78 da ed bd 69 98 24 d7 75 1d 78 ce 7b 11 99 59 fb d6 5d 55 dd 0d a0 b1 11 20 20 ae e0 02 41 00 28 91 b4 24 ee 04 d0 00 49 7d 96 65 ea 93 64 8d 38 a3 b1 c7 96 3c 14 c7 1a 2d 94 2c 5b b2 ad 95 9f e8 a1 c6 5a c8 cf 63 11 68 80 d4 42 93 92 b8 89 a4 c4 0d e2 4e 11 3b 1a dd 0d 54 57 55 57 15 6a c9 2d e2 dd 3b 3f 62 7b 11 19 59 dd 8d ee 06 01 09 49 16 ba 32 2b 2b 2b 33 e2 c4 bd e7 9c 7b df 7d c0 33 b7 67 6e cf dc 86 df ee 9a 9a 3a 27 af 73 e7 e4 e4 3f ca e3 c7 7f a8 1f ec ce d1 79 dc d2 5e 2e ee 4f cf 52 4d 68 55 69 8d f6 67 d5 34 ae 51 e8 73 41 5c 49 f0 12 05 0e 10 d8 ab c0 14 01 a8 2a 48 f6 00 ac 29 b0 44 e8 c3 02 dc 6f 14 df 34 2a 5f 71 c6 fe 3d 55 44 01 77 eb da b2 cb ff ce d8 02 6e d9 39 f1 0c 60 9e 2e b7 3f 1e 5b c0 9b d3 13 76 57 30 3f 16 8f f3 66 63 f0 46 90 af 04 d0 02 10 02 08 54 15 50 05 52 70 9c ce a1 22 01 90 00 09 02 4e 81 18 64 4c 91 fb 15 f8 20 55 ee 3c b4 be f2 95 67 22 cc d3 e4 f6 fe b0 35 62 26 a6 de 04 f2 87 00 5c 0d 60 01 22 54 e7 60 9a 4d 4c 5c 7e 19 9a 7b e6 60 47 46 60 47 46 c0 46 03 26 08 40 12 30 4c 40 e1 bd 5e 0e 23 55 a8 08 d4 09 24 8e e0 3a 1d 48 af 87 68 73 0b ed 47 8e 6a e7 b1 c7 48 63 c0 20 00 80 2d 00 27 28 7a a7 c0 fd f7 db d6 57 bf 02 00 87 a7 f7 e0 d0 c6 ea 33 80 f9 b6 73 92 3d 8b 0b b1 e8 1b 0c f9 23 00 5f 2a 2e 26 00 8c 1d 3c 88 e6 dc 2c 5a 8b 0b 08 a7 a6 61 c2 00 10 49 4e bc 17 5d fc 7f 4f 15 67 48 66 df e4 5f c6 5a 40 15 f1 4e 1b dd e5 13 e8 af ad 63 e7 91 a3 1a 6f 6d 93 09 18 1f 51 95 4f 02 fa ee 5b d7 96 ff 06 00 3e 38 37 87 37 9e 3c f9 0c 60 9e ac db 1d a3 07 42 b4 a2 1b 41 f3 af 01 bc 16 22 08 26 26 b4 31 3d c5 c9 ab 9e 8d d6 fc 02 00 85 3a 97 83 43 45 4a 00 51 1f 30 7a 86 47 2b 05 0e 33 e0 78 df 67 91 c6 b5 db d8 bc e7 5e 74 57 56 b4 fb d8 12 69 2d 48 3e a0 d0 df 55 c7 ff 71 db c6 d2 71 00 f8 18 80 57 3c 03 98 f3 73 3b 3c b7 38 a9 a2 ff 1c 86 bf 08 d5 69 d3 68 68 38 31 c1 b9 eb ae 45 73 7a 1a 12 c7 05 40 54 01 91 e2 fb 1c 1f 5e 74 81 a6 ff d7 d3 3c 58 2c 01 26 fb 3e 01 8b ff bd 07 1e 63 a0 22 d8 ba f7 3e 6c dd 7b 1f e2 76 3b fb d3 ef 0f e3 de 4f af 6e 8e 3f f2 23 38 fa b4 89 3a 4f 79 c0 7c 08 7b 10 cd 49 2b d6 f0 67 95 e6 1d 20 00 11 cc 7f cf cb 30 ba 7f 3f 24 05 45 1e 45 72 b0 68 0e 0e 02 10 f5 22 4c f6 1c 3f 25 55 bf 1f cc 47 e5 e8 52 49 4d 84 17 6d 8c c9 01 64 8c 81 a6 8f d1 18 48 af 87 95 bf f9 2c 7a 2b 2b aa aa 04 f4 73 56 e5 c7 6e 5e 5b f9 1a 00 fc 29 16 f1 7a 2c 3d 03 98 33 4e 3b b3 8b b8 75 6d 09 87 67 16 7e 19 d6 fc b4 8a 84 e1 d4 a4 ee bd f1 06 86 e3 e3 c9 f9 cd 00 92 ff ab 05 20 50 06 51 ce 51 b4 00 cd e9 2b a4 1a 2e e3 01 a8 a4 9e 6a 40 44 63 12 52 9d fe 9c c6 40 e2 18 3b 0f 1d d1 b5 bb ef 26 8c 71 50 7c c9 c6 f2 cf 6f de 5c fe e6 33 11 e6 89 a4 9f 99 f9 b7 aa 31 ff 41 9d 5b 18 d9 bf 4f 67 5e f8 42 36 66 a6 81 94 97 Data Ascii: PNGIHDRA>sRGBbKGDpHYstIMEyCF IDATxi$ux{Y]U A($I}ed8<-,[ZchBN;TWUWj-;?b{YI2+++3{}3gn:'s?y^.ORMhUig4QsA\IH)Do4_q=UDwn9`.?[vW0?fcFTPRp"NdL U<g"5b&\`"T`ML\~{`GF`GFF&@0L@^#U$:HhsGjHc -'(zW3s=#_*.&<,ZaIN]OgHf_Z@NcomQO[>877<`BA"&&1=:CEJQ0zG+3xg^tWVi-H>UqqW<s;<8ihh81Esz@T^t<X,&>c">l{v;On?#8:Oy\|{I+g 0?$EErh"L?%UGRIMmdH,z++sVn^[)z,=3N;umg~ PQQ+.j@DcR@;&qP\|o\31A[Og^B6f
Jan 31, 2024 11:29:09.333225012 CET	1286	IN	Data Raw: 94 40 92 47 16 8f d0 7a 00 da 4d 42 9f e9 01 d0 ba 03 58 e5 34 a6 00 4e a2 c0 0c 48 93 82 c7 7b dc 5a a8 73 d8 79 f8 08 d6 be f8 45 90 46 44 f5 23 70 ee 47 6e 7b 7c f5 b1 3b f7 ec c1 2d ab ab cf 00 a6 d6 68 9b 9b c3 2d 27 4f e2 8e d9 85 17 92 e6 Data Ascii: @GzMBX4NH{ZsyEFD#pGn{\|;-h-'OT5={tgkqIJFd3H"FtF&S%9xxLT;~M7Fc\|&}plo#jM/]D_ YCS.Gkp'F9sdJ)A
Jan 31, 2024 11:29:09.333262920 CET	1286	IN	Data Raw: 95 f4 95 2b 25 12 aa 5e 7d 2a 4d 51 59 4a 82 0d 8a f4 64 2d a2 8d c7 f5 d1 ff f9 11 1a 63 fe 4c a5 7f b3 81 8d 6f d9 58 79 7a 02 e6 f0 cc fc f5 4a 7e 6c 64 ff fe 70 fe 7b 5e c6 52 0a ca 23 4a ec 49 e8 02 08 f4 b8 4a 8e 94 ba ba 90 9f 8e 3c fe 42 Data Ascii: +%^}*MQYJd-cLoXyzJ~ldp{^R#JIJ<B/z\%Gx~W_ND2a"4[;I$Tc8>$^.!hBl\|yI\zTO0w-Bbw1:WB-WTiSARN#O8
Jan 31, 2024 11:29:09.333301067 CET	1286	IN	Data Raw: 47 9d 43 38 3d 85 e9 e7 3e 07 97 bf ed 7f c1 ec b5 2f 41 b8 b0 80 a8 1f a5 ca 45 f3 1e e0 42 1d a5 20 c9 c0 0b 2d f7 0e 27 2c 18 9a 46 22 d1 f2 7b c8 d2 53 42 6f 2b 7c 4b 04 30 06 ad 8b 2f c6 de 37 be 0e 33 df fd dd 08 2f b8 00 91 73 85 c5 04 2f Data Ascii: GC8=>/AEB -',F"{SBo+\|K0/73/s/yit!%{~^w%FZ{(A<F"h]pg,RH%$>K"3r^z]vr_}x;UE870KAY1#("6{R!y(<G
Jan 31, 2024 11:29:09.333342075 CET	1286	IN	Data Raw: 7a d1 20 95 e7 57 78 dd 73 18 94 cc 25 5f 86 a5 f5 d1 5a f9 2a e4 33 0a 7e e1 a9 a4 72 8b 66 d1 0e 99 d5 86 0a 35 24 85 0a 02 4a 60 29 45 96 0c f8 99 61 28 52 fc 6d d5 34 da 64 d5 67 57 10 5f 49 8d cb d4 8f 49 00 a2 79 1a 12 49 a2 8b a4 4a 4d b4 Data Ascii: z Wxs%_Z3~rf5$J`)Ea(Rm4dgW_IIyIJMA_gRb$wNNx}fO^}5VBL26AMu5edBQz8S2S\|"I~-KOYT'XiR;jq\{9SZ
Jan 31, 2024 11:29:09.333381891 CET	1286	IN	Data Raw: 22 53 4e 03 29 5e 50 aa c5 4d 3e fb 4a a8 8b 61 60 df 72 6e 53 d2 f4 c2 2b 55 75 a2 b9 30 5f 34 31 49 39 af 73 60 fe 6d c5 57 f1 56 01 6a 25 6a d4 7a 34 18 d2 ca 90 2d 0e ab 59 2e 5b 44 5f cd c1 e2 2f 05 29 24 70 71 a4 15 a8 05 4b 49 9e aa 2b 2a Data Ascii: "SN)^PM>Ja`rnS+Uu0_41I9s`mWVj%jz4-Y.[D_/)$pqKI+Lv.bHkh^[K^p2xjHWc9`# KcQb"S5F51oWWuYXL'kN:F+D$!yJmH<_~6[P.qGq##Q9D.z[[onBD"DQ/
Jan 31, 2024 11:29:09.333420038 CET	1286	IN	Data Raw: f5 c2 6e b1 6e 48 73 57 57 2a 9b 55 68 a9 89 da b7 fb 05 4e 62 38 29 0f 4d d4 52 2f 4b 61 ca f9 0b f3 4b 19 2c 97 c8 e2 0d 86 4e 87 1d 19 a6 cd ee bb 5d af c5 27 76 bd 1e 76 8e 1c 41 fb d8 31 04 a3 a3 18 d9 b7 88 70 66 a6 e4 f4 9a 34 55 99 6a da Data Ascii: nnHsWWUhNb8)MR/KaK,N]'vvA1pf4Uj2q)VX+77#Lv~-4b769vqa?1tpL[PwewTX#Kf9'r,dPCP:^"mm6h.Ek<LQJC~O2R%H8O
Jan 31, 2024 11:29:09.333462000 CET	1286	IN	Data Raw: 36 1f 1e 54 22 fe c5 be e9 b9 9f 94 01 28 f7 bb 2a c7 42 2b d1 a6 2e 5d d1 18 b8 5e 0f 1b 5f fe 2a da 47 8f 63 f6 9a e7 c3 4c 4d d7 7a 3e 4f 2c c2 a8 e6 74 3f 6e b7 b1 f2 a9 cf a0 bf be 9e 28 9f 21 a9 a7 8e ed fb b0 f2 a3 09 a9 98 b8 ea d9 b8 ee Data Ascii: 6T"(B+.]^_GcLMz>O,t?n(!hCE%Y<G7aajKIrK^Iq\|Z`qiS)EQ^mLFpMb=JV,K{&K5%u'1age]I#a5QU7\|
Jan 31, 2024 11:29:09.333497047 CET	1286	IN	Data Raw: 58 58 c3 d3 06 8b 35 1c 88 30 a5 fa d0 90 0e ce ec 4c d7 f5 4e 0f ed a3 a9 b4 80 e8 a0 18 e9 d3 a8 dc bc be 79 96 11 46 dc 5f 14 2b 0f 8b bc 48 93 b0 79 0e c9 8f a6 12 5a ab 96 37 49 c4 47 8f e1 c8 7b df 87 bd 0b f3 a5 75 d0 43 d7 3a 57 67 ca 29 Data Ascii: XX50LNyF_+HyZ7IG{uC:Wg)V^=:crJ+Dc20Tl<7uj>/pmH*%}`f4c}4SOjS!V1)t9b<Hiw C53TCUdr)cj
Jan 31, 2024 11:29:09.333535910 CET	1286	IN	Data Raw: 1a a7 9f 92 56 97 70 eb fa f2 e7 a1 fa 8d 28 55 ef 43 a3 86 47 ca aa a0 31 43 a4 62 f5 c3 5b 10 01 81 d1 c0 22 f8 c6 d7 f1 ad 5b 6e c6 be 8b 2f c2 f8 c4 58 32 b9 f2 69 a4 86 fc 34 94 99 7d c6 58 dc ff c0 43 68 7f f0 4e 84 c6 a0 c1 e4 f3 5a c3 fc Data Ascii: Vp(UCG1Cb["[n/X2i4}XChNZ3l}xG6gSeTu/^rh~[q`rr.O`!:.:[G $DloZX3UtwwQ;Rk*~+]RI9MHbZ\|
Jan 31, 2024 11:29:09.436332941 CET	1286	IN	Data Raw: 40 d4 ed c1 39 97 03 e2 c9 52 43 41 10 e2 91 a3 c7 f1 d9 2f dc 0d f7 ae df 40 78 e4 21 8c 67 91 c5 1a 8c a7 4d 63 55 01 50 39 df 60 dd e8 85 ea 85 e5 0d 8a f4 15 67 a4 aa db c9 4c fc 9f b9 75 ed c4 9d e7 02 30 c4 39 ba dd 31 b3 f0 03 b0 e6 bf 4f Data Ascii: @9RCA/@x!gMcUP9`gLu091OS,UZ:1DT.z"l]#7'Dpcp}G#G0Fi&`&xRISKE]\7ODx9=PCR.p_ym%WXs2
Jan 31, 2024 11:29:09.621187925 CET	442	OUT	GET /cgi-sys/images/404top_w.jpg HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://grandprairie-water-damage-restoration.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.731548071 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Last-Modified: Mon, 03 Oct 2022 09:33:32 GMT Accept-Ranges: bytes Content-Length: 4335 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 a9 03 64 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 01 00 02 03 01 00 00 00 00 00 00 00 00 00 00 00 01 02 04 03 07 08 05 ff c4 00 3a 10 01 00 01 03 00 07 04 07 07 04 02 03 00 00 00 00 00 01 03 07 11 02 04 06 16 17 81 c2 12 21 94 d2 31 36 46 51 74 84 91 05 13 14 61 71 b2 c3 41 56 b1 c1 26 b3 a1 d3 f0 ff c4 00 19 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 05 06 03 04 ff c4 00 27 11 01 00 03 01 00 02 02 01 03 05 01 01 00 00 00 00 00 04 15 52 01 91 a1 02 b1 05 03 11 51 12 21 31 33 d1 13 14 ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 f6 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: JFIFHHC!"$"$Cd:!16FQtaqAV&'RQ!13?X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	151.101.66.137	80	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 31, 2024 11:29:09.441508055 CET	347	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://grandprairie-water-damage-restoration.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.543220043 CET	603	IN	HTTP/1.1 200 OK Connection: keep-alive Content-Length: 30288 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: W/"28feccc0-1538f" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Content-Encoding: gzip Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 31 Jan 2024 10:29:09 GMT Age: 11896347 X-Served-By: cache-lga13622-LGA, cache-pdk-kfty2130059-PDK X-Cache: HIT, HIT X-Cache-Hits: 8, 155575 X-Timer: S1706696949.495685,VS0,VE0 Vary: Accept-Encoding
Jan 31, 2024 11:29:09.543344021 CET	1286	IN	Data Raw: 1f 8b 08 00 00 00 00 00 02 03 bc bd 79 7b db 46 b2 2f fc ff fb 29 44 8c 8f 02 98 2d 4a 72 26 b9 77 40 b5 f9 38 5e 12 67 73 26 76 b6 43 31 79 20 b2 49 21 a6 00 06 00 b5 44 e4 7c f6 5b bf ea 05 0d 10 94 33 73 ee 7d 33 63 11 4b a3 d7 ea ea da eb f8 Data Ascii: y{F/)D-Jr&w@8^gs&vC1y I!D\|[3s}3cKqUqwp F_=xYRyvdT4"XWyQRX/JuJT}%}6a_BnU>[/u5oJefz'Q\W"9
Jan 31, 2024 11:29:09.543386936 CET	1286	IN	Data Raw: 7c 7a c5 93 d2 c2 83 38 5f 98 68 21 8a e5 04 a7 e9 73 8c e7 1e 0d 64 44 c2 e8 bd 31 2c ce 68 66 34 ac f6 4e f9 64 d7 b3 30 2e 88 d2 11 f8 89 a2 0b 3a a1 df 6f d5 92 a8 21 7c 5d e8 ee 7d f0 0b 0b 25 b4 b7 89 70 b9 7a e8 18 a1 13 37 c4 b9 5b 03 c7 Data Ascii: \|z8_h!sdD1,hf4Nd0.:o!\|]}%pz7[;p{:ORm+JNXEqiHdHn{]N(]4*Lw_YD+B"qOdEs&y\6@hiNu'nBPl% iT,q??t;m5
Jan 31, 2024 11:29:09.543427944 CET	1286	IN	Data Raw: cf 67 2a 2c fa fc 45 14 77 be 7c fa f4 f4 64 f3 c9 27 4f fe f1 a9 38 3d 79 f2 f1 61 b1 f9 e4 d3 8f 9f 80 b3 ae 94 3c a6 2e 13 fa bb 3d 9d 9f df fe af f9 64 f3 eb d1 88 26 9e 7e 1e 19 c4 68 de 1c 9d af 5f d1 7f 98 05 e2 5c 32 d5 7d 22 55 a3 e0 fc Data Ascii: g,Ew\|d'O8=ya<.=d&~h_\2}"UG+\|>bDij05{F9YR P>?cy]3NVsI:ZLZZXcQw_B7=VTIEdkyLQsJ0
Jan 31, 2024 11:29:09.543467999 CET	1286	IN	Data Raw: 1d fa a6 b9 5d 02 08 22 01 03 c6 bb ad 3a ba 45 fe 53 9f e1 b3 7d 14 90 fe 12 04 db 9e 2e 5e 36 ba 48 a0 47 84 dc 85 e8 b5 2a 44 5d 44 04 75 3c 0d 2f da dd 44 63 a3 b0 18 cc d3 65 a5 8a c1 eb 17 5d 70 ef 0e fb ff 26 ee d0 09 7b 3b a7 70 97 54 02 Data Ascii: ]":ES}.^6HGD]Du</Dce]p&{;pTDMdf8@ul61LTO[ml4n>(^q3=~7rov\|O#ca"0Y\0D/w>vhr/1~RVV,'oT5
Jan 31, 2024 11:29:09.543508053 CET	1286	IN	Data Raw: 88 c0 4d 55 04 6a 2f d6 b0 4b 26 ba af 14 53 69 50 ea db 0a 94 0b 0b b3 b5 36 17 24 0c 5e 84 2f 22 31 b7 5c 17 f1 fc e3 1c 5c 17 9f 31 c4 7d b2 cc cb b0 5c 79 14 79 b2 76 65 ac 9f 59 ec 28 08 45 5a 14 c4 42 7c 58 fc a5 90 e1 d1 e4 bf 83 23 44 87 Data Ascii: MUj/K&SiP6$^/"1\\1}\yyveY(EZB\|X#DwT8\|9[B1d#7if`I/l7#X-\=osU-:"YL)=NwZT1R,PKvA}==Nui_
Jan 31, 2024 11:29:09.543545961 CET	1286	IN	Data Raw: 29 84 7d d0 cb df 33 ec 0a f5 30 91 26 76 0c 8c 86 b3 fc 9e 6d a0 16 a3 6a c0 15 b5 6d 06 6f af 96 31 5e a0 fd f6 3b fd dc 9c 06 2c ad 6a 02 bd 36 e6 39 61 55 a1 1b 36 1f d8 5b 0d 15 6d 31 6a db ca 2b aa c5 a8 34 51 55 52 34 9c c7 7d 4b dd 7c 9a Data Ascii: )}30&vmjmo1^;,j69aU6[m1j+4QUR4}K\|hn}-yaZmya%~6H2\|N8:%ZVlE6Xc_ha3N#au\|B]d&bezq?DWVf;WJVGFIOXu
Jan 31, 2024 11:29:09.543584108 CET	1286	IN	Data Raw: 29 48 f0 e5 8b 51 ea 7d de 43 e0 25 28 f7 7b 52 2e b1 29 a0 04 88 6a 48 9b 9a e2 f1 dc 5c d4 d1 aa b4 28 21 dd 4e 86 eb b3 7c b8 36 71 96 9a 63 5d 9b b1 46 d4 01 ea 2a e1 a0 15 1d f4 d1 a4 c6 7b 99 23 6a bc e2 66 9e b5 ee 15 4f cd e9 1a 41 f2 a7 Data Ascii: )HQ}C%({R.)jH\(!N\|6qc]F*{#jfOAg:zRnnjm~J8Od{_#&Z=Uh+A'Y8BgU\|G%-e=e_5Ozn16;+VR.nR<IalMaL]_j.
Jan 31, 2024 11:29:09.543622017 CET	1286	IN	Data Raw: 08 e3 b8 c9 5e 9c df f0 9e 6d 33 3b 03 0b 36 22 18 a7 7c 37 f4 2c 58 6b f3 ad 68 4f 40 67 ec 17 33 73 9e c2 83 e5 e3 44 6a 57 67 05 cb 2d a9 ca 7a b7 87 29 62 f2 72 54 eb 5a b8 65 44 b9 99 6c 35 00 79 88 5f 93 9e 17 68 c6 51 89 e7 63 f9 f4 74 e4 Data Ascii: ^m3;6"\|7,XkhO@g3sDjWg-z)brTZeDl5y_hQct%je7F?<8mgJp4&4v~[mZ;/g&yx\|i,!wS:5\|2#lMO^aB(m6t:,2
Jan 31, 2024 11:29:09.543659925 CET	1286	IN	Data Raw: 9b c7 27 9d d5 f5 52 b6 f4 53 3f a5 55 23 2d 48 8d b0 53 86 bd b1 12 56 43 61 4c 7f 46 d6 f6 96 f8 d3 49 0d 50 82 1a f7 96 14 75 77 f4 75 39 b0 8d b6 33 1d 79 df 75 f6 b7 d8 3a bc b1 f4 4c 8f 5e fb 6b 56 eb 26 7f aa bd 83 bd a7 8f ac bd 84 41 b4 Data Ascii: 'RS?U#-HSVCaLFIPuwu93yu:L^kV&AcUZ?\/Y)YZbWTY]t\x"/xgSph^ cu<Ow\|o@xH14=OL85]ZNhZ90UiJ 'MrWv
Jan 31, 2024 11:29:09.543697119 CET	1286	IN	Data Raw: 25 21 ce 5d 75 9d e3 fc 6a 11 79 c6 21 1b 8d ca c9 d9 c4 57 ec 49 4c 23 4d e8 a0 2c 6c de c8 12 46 df f6 95 67 07 9f 8e 54 bc 1c d9 7e 44 f1 7a a4 83 b2 80 13 23 64 ff 33 21 9f a3 ab f2 e8 58 fc 20 8f 8f b4 8d 40 e4 4b a4 7e 6c ca cd 07 55 fe c3 Data Ascii: %!]ujy!WIL#M,lFgT~Dz#d3!X @K~lUj\>gP^H$A?y Nm+p`-SO?3?ZAVBV(c\A:OE $O=Rx6jq[WEsBfQI2v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	192.185.99.217	80	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 31, 2024 11:29:09.683950901 CET	314	OUT	GET /cgi-sys/images/f.png HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.791115046 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Mon, 03 Oct 2022 09:33:42 GMT Accept-Ranges: bytes Content-Length: 18239 Keep-Alive: timeout=5, max=75 Content-Type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 8c 08 06 00 00 00 ae c0 41 3e 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 dd 08 1c 14 1b 17 79 01 43 46 00 00 20 00 49 44 41 54 78 da ed bd 69 98 24 d7 75 1d 78 ce 7b 11 99 59 fb d6 5d 55 dd 0d a0 b1 11 20 20 ae e0 02 41 00 28 91 b4 24 ee 04 d0 00 49 7d 96 65 ea 93 64 8d 38 a3 b1 c7 96 3c 14 c7 1a 2d 94 2c 5b b2 ad 95 9f e8 a1 c6 5a c8 cf 63 11 68 80 d4 42 93 92 b8 89 a4 c4 0d e2 4e 11 3b 1a dd 0d 54 57 55 57 15 6a c9 2d e2 dd 3b 3f 62 7b 11 19 59 dd 8d ee 06 01 09 49 16 ba 32 2b 2b 2b 33 e2 c4 bd e7 9c 7b df 7d c0 33 b7 67 6e cf dc 86 df ee 9a 9a 3a 27 af 73 e7 e4 e4 3f ca e3 c7 7f a8 1f ec ce d1 79 dc d2 5e 2e ee 4f cf 52 4d 68 55 69 8d f6 67 d5 34 ae 51 e8 73 41 5c 49 f0 12 05 0e 10 d8 ab c0 14 01 a8 2a 48 f6 00 ac 29 b0 44 e8 c3 02 dc 6f 14 df 34 2a 5f 71 c6 fe 3d 55 44 01 77 eb da b2 cb ff ce d8 02 6e d9 39 f1 0c 60 9e 2e b7 3f 1e 5b c0 9b d3 13 76 57 30 3f 16 8f f3 66 63 f0 46 90 af 04 d0 02 10 02 08 54 15 50 05 52 70 9c ce a1 22 01 90 00 09 02 4e 81 18 64 4c 91 fb 15 f8 20 55 ee 3c b4 be f2 95 67 22 cc d3 e4 f6 fe b0 35 62 26 a6 de 04 f2 87 00 5c 0d 60 01 22 54 e7 60 9a 4d 4c 5c 7e 19 9a 7b e6 60 47 46 60 47 46 c0 46 03 26 08 40 12 30 4c 40 e1 bd 5e 0e 23 55 a8 08 d4 09 24 8e e0 3a 1d 48 af 87 68 73 0b ed 47 8e 6a e7 b1 c7 48 63 c0 20 00 80 2d 00 27 28 7a a7 c0 fd f7 db d6 57 bf 02 00 87 a7 f7 e0 d0 c6 ea 33 80 f9 b6 73 92 3d 8b 0b b1 e8 1b 0c f9 23 00 5f 2a 2e 26 00 8c 1d 3c 88 e6 dc 2c 5a 8b 0b 08 a7 a6 61 c2 00 10 49 4e bc 17 5d fc 7f 4f 15 67 48 66 df e4 5f c6 5a 40 15 f1 4e 1b dd e5 13 e8 af ad 63 e7 91 a3 1a 6f 6d 93 09 18 1f 51 95 4f 02 fa ee 5b d7 96 ff 06 00 3e 38 37 87 37 9e 3c f9 0c 60 9e ac db 1d a3 07 42 b4 a2 1b 41 f3 af 01 bc 16 22 08 26 26 b4 31 3d c5 c9 ab 9e 8d d6 fc 02 00 85 3a 97 83 43 45 4a 00 51 1f 30 7a 86 47 2b 05 0e 33 e0 78 df 67 91 c6 b5 db d8 bc e7 5e 74 57 56 b4 fb d8 12 69 2d 48 3e a0 d0 df 55 c7 ff 71 db c6 d2 71 00 f8 18 80 57 3c 03 98 f3 73 3b 3c b7 38 a9 a2 ff 1c 86 bf 08 d5 69 d3 68 68 38 31 c1 b9 eb ae 45 73 7a 1a 12 c7 05 40 54 01 91 e2 fb 1c 1f 5e 74 81 a6 ff d7 d3 3c 58 2c 01 26 fb 3e 01 8b ff bd 07 1e 63 a0 22 d8 ba f7 3e 6c dd 7b 1f e2 76 3b fb d3 ef 0f e3 de 4f af 6e 8e 3f f2 23 38 fa b4 89 3a 4f 79 c0 7c 08 7b 10 cd 49 2b d6 f0 67 95 e6 1d 20 00 11 cc 7f cf cb 30 ba 7f 3f 24 05 45 1e 45 72 b0 68 0e 0e 02 10 f5 22 4c f6 1c 3f 25 55 bf 1f cc 47 e5 e8 52 49 4d 84 17 6d 8c c9 01 64 8c 81 a6 8f d1 18 48 af 87 95 bf f9 2c 7a 2b 2b aa aa 04 f4 73 56 e5 c7 6e 5e 5b f9 1a 00 fc 29 16 f1 7a 2c 3d 03 98 33 4e 3b b3 8b b8 75 6d 09 87 67 16 7e 19 d6 fc b4 8a 84 e1 d4 a4 ee bd f1 06 86 e3 e3 c9 f9 cd 00 92 ff ab 05 20 50 06 51 ce 51 b4 00 cd e9 2b a4 1a 2e e3 01 a8 a4 9e 6a 40 44 63 12 52 9d fe 9c c6 40 e2 18 3b 0f 1d d1 b5 bb ef 26 8c 71 50 7c c9 c6 f2 cf 6f de 5c fe e6 33 11 e6 89 a4 9f 99 f9 b7 aa 31 ff 41 9d 5b 18 d9 bf 4f 67 5e f8 42 36 66 a6 81 94 97 Data Ascii: PNGIHDRA>sRGBbKGDpHYstIMEyCF IDATxi$ux{Y]U A($I}ed8<-,[ZchBN;TWUWj-;?b{YI2+++3{}3gn:'s?y^.ORMhUig4QsA\IH)Do4_q=UDwn9`.?[vW0?fcFTPRp"NdL U<g"5b&\`"T`ML\~{`GF`GFF&@0L@^#U$:HhsGjHc -'(zW3s=#_*.&<,ZaIN]OgHf_Z@NcomQO[>877<`BA"&&1=:CEJQ0zG+3xg^tWVi-H>UqqW<s;<8ihh81Esz@T^t<X,&>c">l{v;On?#8:Oy\|{I+g 0?$EErh"L?%UGRIMmdH,z++sVn^[)z,=3N;umg~ PQQ+.j@DcR@;&qP\|o\31A[Og^B6f
Jan 31, 2024 11:29:09.791132927 CET	1286	IN	Data Raw: 94 40 92 47 16 8f d0 7a 00 da 4d 42 9f e9 01 d0 ba 03 58 e5 34 a6 00 4e a2 c0 0c 48 93 82 c7 7b dc 5a a8 73 d8 79 f8 08 d6 be f8 45 90 46 44 f5 23 70 ee 47 6e 7b 7c f5 b1 3b f7 ec c1 2d ab ab cf 00 a6 d6 68 9b 9b c3 2d 27 4f e2 8e d9 85 17 92 e6 Data Ascii: @GzMBX4NH{ZsyEFD#pGn{\|;-h-'OT5={tgkqIJFd3H"FtF&S%9xxLT;~M7Fc\|&}plo#jM/]D_ YCS.Gkp'F9sdJ)A
Jan 31, 2024 11:29:09.791148901 CET	1286	IN	Data Raw: 95 f4 95 2b 25 12 aa 5e 7d 2a 4d 51 59 4a 82 0d 8a f4 64 2d a2 8d c7 f5 d1 ff f9 11 1a 63 fe 4c a5 7f b3 81 8d 6f d9 58 79 7a 02 e6 f0 cc fc f5 4a 7e 6c 64 ff fe 70 fe 7b 5e c6 52 0a ca 23 4a ec 49 e8 02 08 f4 b8 4a 8e 94 ba ba 90 9f 8e 3c fe 42 Data Ascii: +%^}*MQYJd-cLoXyzJ~ldp{^R#JIJ<B/z\%Gx~W_ND2a"4[;I$Tc8>$^.!hBl\|yI\zTO0w-Bbw1:WB-WTiSARN#O8
Jan 31, 2024 11:29:09.791167974 CET	1286	IN	Data Raw: 47 9d 43 38 3d 85 e9 e7 3e 07 97 bf ed 7f c1 ec b5 2f 41 b8 b0 80 a8 1f a5 ca 45 f3 1e e0 42 1d a5 20 c9 c0 0b 2d f7 0e 27 2c 18 9a 46 22 d1 f2 7b c8 d2 53 42 6f 2b 7c 4b 04 30 06 ad 8b 2f c6 de 37 be 0e 33 df fd dd 08 2f b8 00 91 73 85 c5 04 2f Data Ascii: GC8=>/AEB -',F"{SBo+\|K0/73/s/yit!%{~^w%FZ{(A<F"h]pg,RH%$>K"3r^z]vr_}x;UE870KAY1#("6{R!y(<G
Jan 31, 2024 11:29:09.791184902 CET	1286	IN	Data Raw: 7a d1 20 95 e7 57 78 dd 73 18 94 cc 25 5f 86 a5 f5 d1 5a f9 2a e4 33 0a 7e e1 a9 a4 72 8b 66 d1 0e 99 d5 86 0a 35 24 85 0a 02 4a 60 29 45 96 0c f8 99 61 28 52 fc 6d d5 34 da 64 d5 67 57 10 5f 49 8d cb d4 8f 49 00 a2 79 1a 12 49 a2 8b a4 4a 4d b4 Data Ascii: z Wxs%_Z3~rf5$J`)Ea(Rm4dgW_IIyIJMA_gRb$wNNx}fO^}5VBL26AMu5edBQz8S2S\|"I~-KOYT'XiR;jq\{9SZ
Jan 31, 2024 11:29:09.791208982 CET	1286	IN	Data Raw: 22 53 4e 03 29 5e 50 aa c5 4d 3e fb 4a a8 8b 61 60 df 72 6e 53 d2 f4 c2 2b 55 75 a2 b9 30 5f 34 31 49 39 af 73 60 fe 6d c5 57 f1 56 01 6a 25 6a d4 7a 34 18 d2 ca 90 2d 0e ab 59 2e 5b 44 5f cd c1 e2 2f 05 29 24 70 71 a4 15 a8 05 4b 49 9e aa 2b 2a Data Ascii: "SN)^PM>Ja`rnS+Uu0_41I9s`mWVj%jz4-Y.[D_/)$pqKI+Lv.bHkh^[K^p2xjHWc9`# KcQb"S5F51oWWuYXL'kN:F+D$!yJmH<_~6[P.qGq##Q9D.z[[onBD"DQ/
Jan 31, 2024 11:29:09.791225910 CET	1286	IN	Data Raw: f5 c2 6e b1 6e 48 73 57 57 2a 9b 55 68 a9 89 da b7 fb 05 4e 62 38 29 0f 4d d4 52 2f 4b 61 ca f9 0b f3 4b 19 2c 97 c8 e2 0d 86 4e 87 1d 19 a6 cd ee bb 5d af c5 27 76 bd 1e 76 8e 1c 41 fb d8 31 04 a3 a3 18 d9 b7 88 70 66 a6 e4 f4 9a 34 55 99 6a da Data Ascii: nnHsWWUhNb8)MR/KaK,N]'vvA1pf4Uj2q)VX+77#Lv~-4b769vqa?1tpL[PwewTX#Kf9'r,dPCP:^"mm6h.Ek<LQJC~O2R%H8O
Jan 31, 2024 11:29:09.791243076 CET	1286	IN	Data Raw: 36 1f 1e 54 22 fe c5 be e9 b9 9f 94 01 28 f7 bb 2a c7 42 2b d1 a6 2e 5d d1 18 b8 5e 0f 1b 5f fe 2a da 47 8f 63 f6 9a e7 c3 4c 4d d7 7a 3e 4f 2c c2 a8 e6 74 3f 6e b7 b1 f2 a9 cf a0 bf be 9e 28 9f 21 a9 a7 8e ed fb b0 f2 a3 09 a9 98 b8 ea d9 b8 ee Data Ascii: 6T"(B+.]^_GcLMz>O,t?n(!hCE%Y<G7aajKIrK^Iq\|Z`qiS)EQ^mLFpMb=JV,K{&K5%u'1age]I#a5QU7\|
Jan 31, 2024 11:29:09.791259050 CET	1286	IN	Data Raw: 58 58 c3 d3 06 8b 35 1c 88 30 a5 fa d0 90 0e ce ec 4c d7 f5 4e 0f ed a3 a9 b4 80 e8 a0 18 e9 d3 a8 dc bc be 79 96 11 46 dc 5f 14 2b 0f 8b bc 48 93 b0 79 0e c9 8f a6 12 5a ab 96 37 49 c4 47 8f e1 c8 7b df 87 bd 0b f3 a5 75 d0 43 d7 3a 57 67 ca 29 Data Ascii: XX50LNyF_+HyZ7IG{uC:Wg)V^=:crJ+Dc20Tl<7uj>/pmH*%}`f4c}4SOjS!V1)t9b<Hiw C53TCUdr)cj
Jan 31, 2024 11:29:09.791277885 CET	1286	IN	Data Raw: 1a a7 9f 92 56 97 70 eb fa f2 e7 a1 fa 8d 28 55 ef 43 a3 86 47 ca aa a0 31 43 a4 62 f5 c3 5b 10 01 81 d1 c0 22 f8 c6 d7 f1 ad 5b 6e c6 be 8b 2f c2 f8 c4 58 32 b9 f2 69 a4 86 fc 34 94 99 7d c6 58 dc ff c0 43 68 7f f0 4e 84 c6 a0 c1 e4 f3 5a c3 fc Data Ascii: Vp(UCG1Cb["[n/X2i4}XChNZ3l}xG6gSeTu/^rh~[q`rr.O`!:.:[G $DloZX3UtwwQ;Rk*~+]RI9MHbZ\|
Jan 31, 2024 11:29:09.893333912 CET	1286	IN	Data Raw: 40 d4 ed c1 39 97 03 e2 c9 52 43 41 10 e2 91 a3 c7 f1 d9 2f dc 0d f7 ae df 40 78 e4 21 8c 67 91 c5 1a 8c a7 4d 63 55 01 50 39 df 60 dd e8 85 ea 85 e5 0d 8a f4 15 67 a4 aa db c9 4c fc 9f b9 75 ed c4 9d e7 02 30 c4 39 ba dd 31 b3 f0 03 b0 e6 bf 4f Data Ascii: @9RCA/@x!gMcUP9`gLu091OS,UZ:1DT.z"l]#7'Dpcp}G#G0Fi&`&xRISKE]\7ODx9=PCR.p_ym%WXs2
Jan 31, 2024 11:29:09.911947966 CET	322	OUT	GET /cgi-sys/images/404bottom.gif HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:10.020350933 CET	778	IN	HTTP/1.1 200 OK Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Last-Modified: Fri, 30 Sep 2022 16:19:40 GMT Accept-Ranges: bytes Content-Length: 537 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: image/gif Data Raw: 47 49 46 38 39 61 64 03 0e 00 d5 00 00 36 65 94 f7 f9 fb ad c0 d4 9d b4 cb cd d9 e4 7c 9b b9 a2 b8 ce 6d 8f b1 e6 ec f2 5c 82 a9 8c a7 c2 bd cd dc 4e 77 a1 f2 f5 f8 b0 c3 d5 85 a2 be dc e4 ec 93 ad c6 ff ff ff 58 7f a6 73 94 b5 a7 bc d0 c5 d2 e0 64 89 ad 81 9e bc d1 dc e7 ea ef f4 f6 f8 fa b3 c5 d7 7b 94 b5 7e 9d bb 8c ad c5 6b 94 b5 8c a5 bd 63 87 ac 59 80 a7 d4 de e8 ed f1 f5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 0e 00 00 06 ff 40 83 41 42 2c 1a 8f c8 a4 72 c9 6c 3a 9f d0 a8 74 4a ad 5a af d8 ac 76 cb ed 7a bf e0 b0 78 4c 2e 9b cf e8 b4 7a 5d 54 08 87 ec b8 7c 4e af db ef f8 bc 7e cf ef fb ff 80 4f 6e 42 81 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 55 6e 15 03 91 96 97 98 99 9a 9b 9c 9d 9e 9f 53 1e 0e 0e 11 a0 a6 a7 a8 a9 aa ab ac ad 9e a2 16 18 ae b3 b4 b5 b6 b7 b8 b9 ba 17 04 10 07 ba c0 c1 c2 c3 c4 c5 c6 66 0c 08 1b 17 01 c7 ce cf d0 d1 d2 d3 a7 01 00 44 14 04 d4 db dc dd de df e0 66 0b bf 12 15 1e e1 e8 e9 ea eb ec d4 05 1c 44 0d 23 70 ed f5 f6 f7 f8 f9 98 02 e4 45 13 d9 1b f4 09 1c 48 b0 a0 c1 32 0d 16 14 a0 80 e0 c8 06 0e 14 12 88 a0 f0 40 81 82 08 18 23 bc d9 c8 b1 a3 c7 8f 20 43 8a 1c 49 b2 a4 c9 93 28 53 aa 5c c9 b2 a5 cb 97 30 63 ca 9c 49 b3 a6 cd 9b 38 73 ea dc c9 b3 a7 cf 36 9f 2a 07 64 8c a0 00 03 85 0b 09 28 70 68 b6 44 43 86 05 1c 38 08 98 5a 01 a8 d5 ab 58 b3 6a dd ca b5 ab d7 af 60 c3 8a 1d 4b b6 ec c6 a9 53 39 58 20 51 22 49 10 00 3b Data Ascii: GIF89ad6e\|m\NwXsd{~kcY!,d@AB,rl:tJZvzxL.z]T\|N~OnBUnSfDfD#pEH2@# CI(S\0cI8s6*d(phDC8ZXj`KS9X Q"I;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	192.185.99.217	80	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 31, 2024 11:29:09.729981899 CET	443	OUT	GET /cgi-sys/images/404bottom.gif HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://grandprairie-water-damage-restoration.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.840579033 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Fri, 30 Sep 2022 16:19:40 GMT Accept-Ranges: bytes Content-Length: 537 Keep-Alive: timeout=5, max=75 Content-Type: image/gif Data Raw: 47 49 46 38 39 61 64 03 0e 00 d5 00 00 36 65 94 f7 f9 fb ad c0 d4 9d b4 cb cd d9 e4 7c 9b b9 a2 b8 ce 6d 8f b1 e6 ec f2 5c 82 a9 8c a7 c2 bd cd dc 4e 77 a1 f2 f5 f8 b0 c3 d5 85 a2 be dc e4 ec 93 ad c6 ff ff ff 58 7f a6 73 94 b5 a7 bc d0 c5 d2 e0 64 89 ad 81 9e bc d1 dc e7 ea ef f4 f6 f8 fa b3 c5 d7 7b 94 b5 7e 9d bb 8c ad c5 6b 94 b5 8c a5 bd 63 87 ac 59 80 a7 d4 de e8 ed f1 f5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 0e 00 00 06 ff 40 83 41 42 2c 1a 8f c8 a4 72 c9 6c 3a 9f d0 a8 74 4a ad 5a af d8 ac 76 cb ed 7a bf e0 b0 78 4c 2e 9b cf e8 b4 7a 5d 54 08 87 ec b8 7c 4e af db ef f8 bc 7e cf ef fb ff 80 4f 6e 42 81 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 55 6e 15 03 91 96 97 98 99 9a 9b 9c 9d 9e 9f 53 1e 0e 0e 11 a0 a6 a7 a8 a9 aa ab ac ad 9e a2 16 18 ae b3 b4 b5 b6 b7 b8 b9 ba 17 04 10 07 ba c0 c1 c2 c3 c4 c5 c6 66 0c 08 1b 17 01 c7 ce cf d0 d1 d2 d3 a7 01 00 44 14 04 d4 db dc dd de df e0 66 0b bf 12 15 1e e1 e8 e9 ea eb ec d4 05 1c 44 0d 23 70 ed f5 f6 f7 f8 f9 98 02 e4 45 13 d9 1b f4 09 1c 48 b0 a0 c1 32 0d 16 14 a0 80 e0 c8 06 0e 14 12 88 a0 f0 40 81 82 08 18 23 bc d9 c8 b1 a3 c7 8f 20 43 8a 1c 49 b2 a4 c9 93 28 53 aa 5c c9 b2 a5 cb 97 30 63 ca 9c 49 b3 a6 cd 9b 38 73 ea dc c9 b3 a7 cf 36 9f 2a 07 64 8c a0 00 03 85 0b 09 28 70 68 b6 44 43 86 05 1c 38 08 98 5a 01 a8 d5 ab 58 b3 6a dd ca b5 ab d7 af 60 c3 8a 1d 4b b6 ec c6 a9 53 39 58 20 51 22 49 10 00 3b Data Ascii: GIF89ad6e\|m\NwXsd{~kcY!,d@AB,rl:tJZvzxL.z]T\|N~OnBUnSfDfD#pEH2@# CI(S\0cI8s6*d(phDC8ZXj`KS9X Q"I;
Jan 31, 2024 11:29:09.865864038 CET	426	OUT	GET /favicon.ico HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://grandprairie-water-damage-restoration.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.979393959 CET	1286	IN	HTTP/1.1 404 Not Found Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Last-Modified: Fri, 30 Sep 2022 16:21:54 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4677 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 28 a5 1e fc 61 7b e3 38 6a 6f 8e 17 74 1e c2 45 49 2e fb b6 b1 d1 1f 36 b2 b2 ac 14 f6 71 5e 09 9d 3e 04 59 8a 5a a9 b3 ae 51 08 8e 8d e9 fc 48 ac 5d f3 72 42 69 73 5f 89 34 95 3a 1f 1e 8c 4a 61 72 a9 f9 21 63 0f fb 99 28 a5 6a 86 05 aa 29 3a 99 88 d1 9f cb 7b 7b de 64 21 35 9a fb ee ce cf 07 d5 1c 44 ed 68 34 93 a9 2b 86 bf fe f2 6b 35 df 79 03 f6 1c 55 ec f7 fd 44 24 77 b9 a1 5a a7 7d 59 8a 1c 87 b5 51 4f 9f 2c f5 86 35 1b f1 49 3e ff 69 36 f8 a3 ca 9f 3c 1b ad 5d 32 58 a1 70 43 4d dd d3 c6 e4 02 65 5e b8 e1 e1 57 68 94 32 fd 2e 1a 7c 7e 90 cb 6c 27 89 f6 a7 df 7c 83 fa 76 2c ec e5 c2 91 99 90 73 54 de 57 64 a5 93 a4 19 47 09 27 a7 38 52 98 b9 e1 d1 0b 46 c9 14 f1 00 ff fe 4f 00 e7 f3 f9 fd da e1 45 ac c7 3e 99 a3 17 ff c6 df 87 fc 38 82 2e b1 90 56 fb d5 3f 5c a4 f7 f5 09 7e 09 b5 5b 9f e2 4b d5 17 4a e6 7a 98 f0 16 9a ef 70 a0 83 83 3d 34 86 4c 42 29 de 87 e2 59 f9 0f 1c 1e 79 ae e1 75 d6 46 f9 eb c1 c1 b7 e2 4d 84 de ae e6 01 ff fb d6 eb 05 59 87 e9 a4 b9 df 1e bf 62 f7 f3 f3 05 3b eb 1a 85 43 e9 d8 83 64 b4 35 f1 5b 07 26 54 57 a4 ef 13 52 64 86 7b 2f 5f 1d 1c 6c 0e fb 79 e7 b0 6f 04 cf d1 59 27 0c 2b 02 f1 c5 11 47 87 3b 47 fc 8b fe af 8d 5c 84 e0 fd 3f 7a fe c5 4a 4c c8 39 2a 19 e5 7e 22 92 bb dc 50 ad d3 be 2c 45 8e c3 da a8 a7 4f a2 24 97 7d db d8 28 ac d9 88 4f b6 57 06 b9 cc 9e 3c 1b ad dd 32 58 21 b7 53 53 f7 b4 51 c8 a2 d5 72 78 fc ed e5 cc c4 e7 4f ab fd 85 1e 78 1e 22 0e df 23 a8 44 9a 4a 9d 0f e1 b0 4d be fd 19 41 a2 50 98 21 33 2d be 75 9a 48 12 32 a9 e4 36 ac c2 81 17 07 3f 8e a0 95 01 bf 3c 67 ec 11 94 52 f7 3b 31 3c ad 5d ea 98 1d 80 a8 1d 8d c0 e1 dc f5 39 c6 9c d7 12 06 47 f3 dd 24 a0 56 70 bf 8e a3 30 73 df 8f 42 bb 51 1e 3d fa 66 04 25 61 db 90 ef 66 51 6d 42 3c ff 71 d3 a2 7f 4d 5a 71 d4 a1 ce ba 30 26 a4 d2 ef d3 56 1c ef 82 80 96 ab 6b 14 93 95 8e 49 26 3b f9 fa 41 83 05 ea 7d 2a 6d a5 44 33 d4 a4 71 b1 99 49 63 79 2b 21 45 66 c8 7d ce 7e f9 e5 e0 60 b1 69 91 ef a6 ab dd a3 c9 f3 17 2f 7e 5d ec Data Ascii: RmssgJ&av$NmRmHInM=_cpw~y3(\G(z}[832qQtjEl0;hQoAqK/^zPP`1PP%J^Vyg::<s}k9=v]Ivs8w>;]Np3xyvGe)e,v&FVIJqM3Hhp8(a{8jotEI.6q^>YZQH]rBis_4:Jar!c(j):{{d!5Dh4+k5yUD$wZ}YQO,5I>i6<]2XpCMe^Wh2.\|~l'\|v,sTWdG'8RFOE>8.V?\~[KJzp=4LB)YyuFMYb;Cd5[&TWRd{/_lyoY'+G;G\?zJL9~"P,EO$}(OW<2X!SSQrxOx"#DJMAP!3-uH26?<gR;1<]9G$Vp0sBQ=f%afQmB<qMZq0&VkI&;A}mD3qIcy+!Ef}~`i/~]
Jan 31, 2024 11:29:09.979432106 CET	1286	IN	Data Raw: ba 42 9a b5 cd c3 17 bf 26 87 2f 56 43 53 84 7b 98 88 e4 2e 37 54 eb b4 bf 38 87 cf fd bf 11 0b 31 29 f2 c2 cf d5 1c 2c 29 99 f2 56 8a 87 e9 e1 08 2a 91 a6 52 e7 43 78 ce 7b 6b 7f 5f d6 68 0b 54 ea fe 21 64 6e 44 33 da c1 62 a2 78 69 04 dd db ac Data Ascii: B&/VCS{.7T81),)VRCx{k_hT!dnD3bxixqTHr2=-c/7UtoGc-'9_e$'(e66FANz=86CG]__^g^v/o[[iG^6\|h7+(Dk
Jan 31, 2024 11:29:09.979485989 CET	1286	IN	Data Raw: 99 05 e8 94 42 b3 be e6 ec ff c9 54 67 1a 30 2b f3 7c c0 9d 7f 7e 40 28 27 a3 a2 c2 c4 c1 7f 48 9c c1 95 9f 7b a1 33 da 0f 6a 73 72 14 8e bf c3 54 0a b8 15 93 4d 85 8f e2 89 a2 e4 ee 73 4d dc 93 44 09 6b 3d bb 14 7b e3 c2 b9 6a 18 2d da 1c 9a 9d Data Ascii: BTg0+\|~@('H{3jsrTMsMDk={j-o\|m4aG+.<W6CYkGm^jTRm=9tMj=;74O'y'*22m=3}J'5Ks]lT:_0Y26F8InG.6_dzUZq4"s5R4=
Jan 31, 2024 11:29:09.979522943 CET	1115	IN	Data Raw: 40 d8 55 cc fb f0 da d4 95 50 fb f0 37 a2 52 89 70 e5 1d 57 4f fb 7e a6 e9 fa a0 ae 62 ab 21 d6 2f 10 97 72 01 9f 08 bd 14 f9 40 e3 85 f3 fd ae 88 fb cd ed 6c 9d f6 05 2d 45 03 1a db 0a fb ea 6c 0d 09 c9 f1 51 4b be d9 24 b5 db 67 c9 06 a6 de f8 Data Ascii: @UP7RpWO~b!/r@l-ElQK$gYzKoFfKl]DX>+5Oj<u.K!t[EVdpiJ<8)3~(9szG\|o(X\v#S3fuHpi"S)*f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	192.185.99.217	80	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 31, 2024 11:29:09.846935034 CET	321	OUT	GET /cgi-sys/images/404top_w.jpg HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.957348108 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Mon, 03 Oct 2022 09:33:32 GMT Accept-Ranges: bytes Content-Length: 4335 Keep-Alive: timeout=5, max=75 Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 a9 03 64 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 01 00 02 03 01 00 00 00 00 00 00 00 00 00 00 00 01 02 04 03 07 08 05 ff c4 00 3a 10 01 00 01 03 00 07 04 07 07 04 02 03 00 00 00 00 00 01 03 07 11 02 04 06 16 17 81 c2 12 21 94 d2 31 36 46 51 74 84 91 05 13 14 61 71 b2 c3 41 56 b1 c1 26 b3 a1 d3 f0 ff c4 00 19 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 05 06 03 04 ff c4 00 27 11 01 00 03 01 00 02 02 01 03 05 01 01 00 00 00 00 00 04 15 52 01 91 a1 02 b1 05 03 11 51 12 21 31 33 d1 13 14 ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 f6 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: JFIFHHC!"$"$Cd:!16FQtaqAV&'RQ!13?X
Jan 31, 2024 11:29:09.957426071 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 31, 2024 11:29:09.957463980 CET	1286	IN	Data Raw: 7a 4a d8 d8 e7 9e 96 12 34 ba 37 96 e5 46 71 b5 15 bb fd fa b5 19 e8 2b 63 63 9e 7a 58 48 d1 17 96 e5 67 3b d1 5b 3f 0d 47 1f 4e c1 5b 1b 1c f3 d2 c2 46 8e 32 dc bc e7 7a 2b 7e 9f 86 a1 e5 2b 63 63 9e 7a 58 48 d1 c6 6b 97 9c ef 45 5f 0b 43 c8 56 Data Ascii: zJ47Fq+cczXHg;[?GN[F2z+~+cczXHkE_CV4qj#,$hrjellsK&\,$ixrWC?_+bK8s1<52.8r*hOqpXHEqE^z+cczXHqmE^~Bya#G_z
Jan 31, 2024 11:29:09.957511902 CET	746	IN	Data Raw: 7f 27 1b 2e 5c 47 ac 7f 5d 52 84 f4 15 71 71 f6 58 48 d2 71 b2 e5 c7 b4 5f 5d 4e 8f 90 ab 8b 8f b2 c2 46 88 bd 97 2e 27 d6 2c fc 9d 1f 21 57 1b 1f 65 84 8d 1c 6c b9 79 ce f1 e7 e4 e8 f9 0a b8 d8 fb 2c 24 68 e3 65 cb ce 67 68 f3 1f 07 46 3a 0a b8 Data Ascii: '.\G]RqqXHq_]NF.',!Wely,$heghF:,$if\(GAWe&\XFF:,$if\,\|!Wel~JB.>N6\b6)Bz,$h]RQxZ+Sch{CNUDkw2%~7?W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	192.185.99.217	80	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 31, 2024 11:29:09.850219011 CET	319	OUT	GET /cgi-sys/images/404mid.gif HTTP/1.1 Host: grandprairie-water-damage-restoration.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 31, 2024 11:29:09.959000111 CET	387	IN	HTTP/1.1 200 OK Date: Wed, 31 Jan 2024 10:29:09 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Fri, 30 Sep 2022 16:20:18 GMT Accept-Ranges: bytes Content-Length: 120 Keep-Alive: timeout=5, max=75 Content-Type: image/gif Data Raw: 47 49 46 38 39 61 64 03 04 00 91 00 00 9a b2 c9 ff ff ff a0 b6 cc a1 b7 cd 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 04 00 00 02 49 dc 82 a9 cb ed 0f a3 9c b4 da 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a6 ea ca b6 ee 9b 00 80 01 d7 f6 8d e7 fa ce f7 fe 0f 0c 0a 87 44 8a 8c 56 4c 2a 97 cc a6 f3 09 8d 4a a7 54 cc f1 50 cd 6a b7 dc ae f7 0b 0e 8b 2d b2 02 00 3b Data Ascii: GIF89ad!,dIHDVL*JTPj-;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	192.185.99.217	80	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 31, 2024 11:29:54.966842890 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	142.251.15.84	443	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-31 10:29:07 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-01-31 10:29:07 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-01-31 10:29:07 UTC	1799	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 31 Jan 2024 10:29:07 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-Grpn_npifdjksVDz5v0AvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmLw1JBiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQJiIR6OzwdfrGUTePHpTgszALzGGGs" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-31 10:29:07 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-01-31 10:29:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	172.217.215.139	443	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-31 10:29:07 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-31 10:29:07 UTC	731	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-vh7IqtScd-97DI0_KLJuMg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 31 Jan 2024 10:29:07 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6239 X-Daystart: 8947 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-31 10:29:07 UTC	521	IN	Data Raw: 32 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 33 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 38 39 34 37 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20 Data Ascii: 2c8<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6239" elapsed_seconds="8947"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-01-31 10:29:07 UTC	198	IN	Data Raw: 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 3f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-01-31 10:29:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49748	23.216.73.151	443

Timestamp	Bytes transferred	Direction	Data
2024-01-31 10:29:13 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-01-31 10:29:13 UTC	533	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-MSEdge-Ref: Ref A: EEC59EDCE6D0498FBA9751466E5AC20F Ref B: BLUEDGE1713 Ref C: 2024-01-31T04:09:00Z Cache-Control: public, max-age=236425 Date: Wed, 31 Jan 2024 10:29:13 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49749	23.216.73.151	443

Timestamp	Bytes transferred	Direction	Data
2024-01-31 10:29:13 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-01-31 10:29:13 UTC	531	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Content-Type: application/octet-stream ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 09LWqYgAAAADmFyStmK2XS7L0AtJkl2s+QVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=194161 Date: Wed, 31 Jan 2024 10:29:13 GMT Content-Length: 55 Connection: close X-CID: 2
2024-01-31 10:29:13 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Target ID:	0
Start time:	11:29:00
Start date:	31/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:29:05
Start date:	31/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,6419500029572030545,6045319169889960985,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:29:07
Start date:	31/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "http://grandprairie-water-damage-restoration.com
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://grandprairie-water-damage-restoration.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 47

Chrome Cache Entry: 48

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 3164, Parent PID: 2860

General

Windows Analysis Report
http://grandprairie-water-damage-restoration.com