Windows Analysis Report
file.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: file.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2020,i,1018589847313137636,1605898340956988895,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4476 --field-trial-handle=2020,i,1018589847313137636,1605898340956988895,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=2020,i,1018589847313137636,1605898340956988895,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2020,i,1018589847313137636,1605898340956988895,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4476 --field-trial-handle=2020,i,1018589847313137636,1605898340956988895,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=2020,i,1018589847313137636,1605898340956988895,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1166336 > 1048576

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E0A76 push ecx; ret

0_2_000E0A89

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000DF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_000DF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00151C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00151C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-97380

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1449			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 953			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 4.2 %

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 1449 delay: -10

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000FC2A2 FindFirstFileExW,	0_2_000FC2A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001368EE FindFirstFileW,FindClose,	0_2_001368EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0013698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0012D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0012D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00139642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00139642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0013979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00139B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00139B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0012DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00135C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00135C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found API chain indicative of debugger detection

Anti Debugging

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-97907

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0013EAA2 BlockInput,

0_2_0013EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000F2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E4CE8 mov eax, dword ptr fs:[00000030h]

0_2_000E4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00120B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00120B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000F2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000E083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E09D5 SetUnhandledExceptionFilter,	0_2_000E09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000E0C21

Source: C:\Users\user\Desktop\file.exe

0_2_00121201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00102BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00102BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0012B226 SendInput,keybd_event,

0_2_0012B226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001422DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_001422DA

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account

Source: C:\Users\user\Desktop\file.exe

0_2_00120B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00121663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00121663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E0698 cpuid

0_2_000E0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00138195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00138195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0011D27A GetUserNameW,

0_2_0011D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000FB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_000FB952

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe, 00000000.00000003.2338541226.0000000000FF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00141204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00141204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00141806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00141806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	31 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	31 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	2 Valid Accounts	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.AutoitInject
file.exe	100%	Avira	TR/AutoIt.zstul
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://play.google/intl/	0%	URL Reputation	safe
https://families.google.com/intl/	0%	URL Reputation	safe
https://youtube.com/t/terms?gl=	0%	URL Reputation	safe
https://policies.google.com/technologies/location-data	0%	URL Reputation	safe
https://apis.google.com/js/api.js	0%	URL Reputation	safe
https://policies.google.com/privacy/google-partners	0%	URL Reputation	safe
https://policies.google.com/terms/service-specific	0%	URL Reputation	safe
https://g.co/recover	0%	URL Reputation	safe
https://policies.google.com/privacy/additional	0%	URL Reputation	safe
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072	0%	URL Reputation	safe
https://policies.google.com/technologies/cookies	0%	URL Reputation	safe
https://policies.google.com/terms	0%	URL Reputation	safe
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	0%	URL Reputation	safe
https://policies.google.com/privacy/additional/embedded?gl=kr	0%	URL Reputation	safe
https://policies.google.com/terms/location/embedded	0%	URL Reputation	safe
https://www.youtube.com/t/terms?chromeless=1&hl=	0%	URL Reputation	safe
https://support.google.com/accounts?hl=	0%	URL Reputation	safe
https://policies.google.com/privacy	0%	URL Reputation	safe
https://support.google.com/accounts?p=new-si-ui	0%	URL Reputation	safe
https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage	0%	URL Reputation	safe
https://www.google.com/intl/	0%	Avira URL Cloud	safe
https://play.google.com/work/enroll?identifier=	0%	Avira URL Cloud	safe
https://www.youtube.com/account	0%	Avira URL Cloud	safe
https://play.google.com/log?format=json&hasfast=true&authuser=0	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://play.google.com/log?format=json&hasfast=true	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.youtube.com/account6	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
youtube-ui.l.google.com	142.250.185.206	true	false	unknown
www3.l.google.com	142.250.185.206	true	false	unknown
play.google.com	142.250.185.238	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
accounts.youtube.com	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/account	false	Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google/intl/	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://families.google.com/intl/	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://youtube.com/t/terms?gl=	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://policies.google.com/technologies/location-data	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://www.google.com/intl/	chromecache_82.4.dr	false	Avira URL Cloud: safe	unknown
https://apis.google.com/js/api.js	chromecache_89.4.dr	false	URL Reputation: safe	unknown
https://policies.google.com/privacy/google-partners	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://play.google.com/work/enroll?identifier=	chromecache_82.4.dr	false	Avira URL Cloud: safe	unknown
https://policies.google.com/terms/service-specific	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://g.co/recover	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://policies.google.com/privacy/additional	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://policies.google.com/technologies/cookies	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://policies.google.com/terms	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_89.4.dr	false	URL Reputation: safe	unknown
https://www.google.com	chromecache_82.4.dr	false	Avira URL Cloud: safe	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_82.4.dr	false	Avira URL Cloud: safe	unknown
https://policies.google.com/privacy/additional/embedded?gl=kr	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://policies.google.com/terms/location/embedded	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/t/terms?chromeless=1&hl=	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://support.google.com/accounts?hl=	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/account6	file.exe, 00000000.00000003.2334965604.00000000037D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335182728.00000000037EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2340164444.00000000037F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335152801.00000000037DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://policies.google.com/privacy	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://support.google.com/accounts?p=new-si-ui	chromecache_82.4.dr	false	URL Reputation: safe	unknown
https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage	chromecache_82.4.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.206	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.238	play.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467823
Start date and time:	2024-07-04 20:34:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@37/30@10/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 50 Number of non-executed functions: 302
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.110, 74.125.206.84, 142.250.185.227, 34.104.35.123, 142.250.185.99, 142.250.186.138, 142.250.184.202, 142.250.185.202, 216.58.206.74, 142.250.185.234, 216.58.206.42, 142.250.181.234, 142.250.185.138, 142.250.184.234, 142.250.185.74, 216.58.212.170, 142.250.185.106, 172.217.16.138, 142.250.186.74, 142.250.185.170, 142.250.186.42, 216.58.206.35, 142.250.186.106, 172.217.18.10, 142.250.74.202, 192.229.221.95, 88.221.110.96, 142.250.186.163, 142.251.173.84, 173.222.108.226
Excluded domains from analysis (whitelisted): clients1.google.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://chorbie.com/services/	Get hash	malicious	Unknown	Browse
	http://79.141.36.131	Get hash	malicious	Unknown	Browse
	https://share.mindmanager.com/#publish/mnPTcUqLfLnU6HRHMb6xC3qXYGZYU6tmBtOy3sS6	Get hash	malicious	HTMLPhisher	Browse
	hANEXOPDF.PDF40 234057.msi	Get hash	malicious	Unknown	Browse
	Invoice - 06736833774062515586349558087774116555577037575401 - Daiichi-sankyo.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://gateway.lighthouse.storage/ipfs/bafkreidrnkion27ep4wvaru45atnhtlbackpdwtf5j73djqjbyjdzvzmdm#mez.jiwaji@nic.bc.ca	Get hash	malicious	Unknown	Browse
	http://nassascha.synology.me/Photo.scr	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	http://circulaires.info	Get hash	malicious	Unknown	Browse
	https://iriss.online/i/ontransfer_pathways/login?p=login	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://chorbie.com/services/	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://79.141.36.131	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	hANEXOPDF.PDF40 234057.msi	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	Invoice - 06736833774062515586349558087774116555577037575401 - Daiichi-sankyo.pdf	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	40.68.123.157 184.28.90.27
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	40.68.123.157 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://circulaires.info	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://iriss.online/i/ontransfer_pathways/login?p=login	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://vi-822.pages.dev/robots.txt	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
3b5074b1b5d032e5620f69f9f700ff0e	TahsilatMakbuzu.cmd.exe	Get hash	malicious	Unknown	Browse	40.113.103.199
	TahsilatMakbuzu.cmd.exe	Get hash	malicious	Unknown	Browse	40.113.103.199
	hANEXOPDF.PDF40 234057.msi	Get hash	malicious	Unknown	Browse	40.113.103.199
	0001.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.113.103.199
	Luciana Alvarez CV.exe	Get hash	malicious	AgentTesla	Browse	40.113.103.199
	Acal BFi UK - Products List 020240704.exe	Get hash	malicious	AgentTesla, RedLine, StormKitty, XWorm	Browse	40.113.103.199
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	40.113.103.199
	5gO02Ijl9V.exe	Get hash	malicious	GuLoader	Browse	40.113.103.199
	0NJYTCJYLo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.113.103.199
	https://ipfs.io/ipfs/bafkreigwisqonlsn4eyx5zphwwujk5meihuzc6poy64tunmtpozna4a4cq	Get hash	malicious	Unknown	Browse	40.113.103.199

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (687)
Category:	downloaded
Size (bytes):	4140
Entropy (8bit):	5.371702264924607
Encrypted:	false
SSDEEP:	96:GPWUbFMvF/ygbQgs8qUoaCyPj8LvUe8tOFw:SWIF1R8qUVCywzzgt
MD5:	7DD911B1022E2F37811F8AAEEB74862E
SHA1:	36F79706B7E839CFF0DE16EE9CC7B026EE5019A2
SHA-256:	DD48C9475C9D2B02ED29382E9DD32791D671004BB217DB0B0F6750DA3011CD66
SHA-512:	03996AD04C65D47A9C364C63AEBCB3F58F41CCCE4DAD70840316853BEF2967A38797744FE62BFFF418B799EC71476DC6B49CFE3053F2B9BEBE62CF5A30EA7847
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,F6sNGb,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lRrMHd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,r1n9ec,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe"
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.xf(_.Joa);._.k("sOXFj");.var Wq=function(a){_.J.call(this,a.Fa)};_.B(Wq,_.J);Wq.Na=_.J.Na;Wq.Ba=_.J.Ba;Wq.prototype.aa=function(a){return a()};_.Pq(_.Ioa,Wq);._.l();._.k("oGtAuc");._.Dua=new _.Ce(_.Joa);._.l();._.k("q0xTif");.var Bva=function(a){var b=function(d){_.Wl(d)&&(_.Wl(d).Cc=null,_.ir(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},ur=function(a){_.up.call(this,a.Fa);this.Pa=this.dom=null;if(this.Ei()){var b=_.qk(this.Of(),[_.Ok,_.Nk]);b=_.vh([b[_.Ok],b[_.Nk]]).then(function(c){this.Pa=c[0];this.dom=c[1]},null,this);_.Jq(this,b)}this.Oa=a.Ih.Y8};_.B(ur,_.up);ur.Ba=function(){return{Ih:{Y8:function(){return _.nf(this)}}}};ur.prototype.getContext=function(a){return this.Oa.getContext(a)};.ur.prototype.getData=function(a){return this.Oa.getData(a)};ur.protot

Chrome Cache Entry: 81

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1192)
Category:	downloaded
Size (bytes):	96558
Entropy (8bit):	5.542959034430961
Encrypted:	false
SSDEEP:	1536:h5K9QgDoJZFMZZMR3Du4JnSyg/FyO7D4yQFPA0tEFHvnAwDyHK:K9rYFjDu4Jnzg/AO7hWPA0tE9vGHK
MD5:	E020446EC64C78D8127C8E4D0C8D08DB
SHA1:	6447A74183CD590FAB25C008E60F838D09BF12E1
SHA-256:	32779135C0EC086DA69B2DC597A8620CAEE8E104E079B5A02D98A8676712577E
SHA-512:	08348FAF64E033574D45446D75B8DFA01EE111C0FEE508ECE2E685C7C4986B833594279BD681E5DA2A02C5FB27DF039DF7E9751BB63A115AF4D3BB0688EA7659
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=AvtSve,CMcBD,EFQ78c,EN3i8d,F6sNGb,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,gJzDyc,hc6Ubd,inNHtf,lRrMHd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qmdT9,r1n9ec,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ltDFwf");.var jxb=_.y("ltDFwf");var CU=function(a){_.K.call(this,a.Fa);var b=this.oa();this.xb=this.Sa("P1ekSe");this.mb=this.Sa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.Cb("B6Vhqe");this.Oa=b.Cb("juhVM");this.wa=b.Cb("D6TUi");this.aa=b.Cb("qdulke");this.La=this.da!==0;this.Ka=this.ja!==1;this.Ga=[];this.ea=_.is(this).Vb(function(){this.Ga.length&&(this.Ga.forEach(this.g$,this),this.Ga=[]);this.La&&(this.La=!1,this.xb.rb("transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,this.mb.rb("transform","scaleX("+this.ja+")"));_.er(b,"B6Vhqe",this.Ca);_.er(b,"D6TUi",this.wa);_.er(b,"juhVM",this.Oa);_.er(b,"qdulke",this.aa)}).build();this.ea();_.Fg&&_.is(this).Vb(function(){b.tb("ieri7c")}).Fe().build()();_.bA(this.oa().el(),this.Ta.bind(this))};_.B(CU,_.K);CU.Ba=_.K.Ba;.CU.prototype.Ta=function(a,b){kxb(this

Chrome Cache Entry: 82

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (44533)
Category:	downloaded
Size (bytes):	836241
Entropy (8bit):	5.751370782507753
Encrypted:	false
SSDEEP:	6144:PLTYSPd+lWTqKZF8hmDrIMmqu3+jgX0BWj4+X+bW1wp8S+lo:PLTYSF+lWTASNjGXLC9
MD5:	775F8A77AAE74DB7478D5EDADF67460A
SHA1:	740A72415AC75C2F1E08654386BC7B1B5E21BC5C
SHA-256:	01917BB57EA57B80D14AD3FACD6560106AA6935A26077C0AD13BF460751D8A65
SHA-512:	E8FFE4E59CC021EB2DC32B7050922BA61EC75A17C40245F399AE4064BBCD2029DA014E5D33D44F8447120DA2727ACC55DB6838A75563F6E7C276462907F92679
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,m9oV,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,lRrMHd,xBaz7b,F6sNGb,eVCnO,r1n9ec,LDQI"
Preview:	"use strict";_F_installCss(".VfPpkd-Sx9Kwc .VfPpkd-P5QLlc{background-color:#fff;background-color:var(--mdc-theme-surface,#fff)}.VfPpkd-Sx9Kwc .VfPpkd-IE5DDf,.VfPpkd-Sx9Kwc .VfPpkd-P5QLlc-GGAcbc{background-color:rgba(0,0,0,.32)}.VfPpkd-Sx9Kwc .VfPpkd-k2Wrsb{color:rgba(0,0,0,.87)}.VfPpkd-Sx9Kwc .VfPpkd-cnG4Wd{color:rgba(0,0,0,.6)}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub{color:#000;color:var(--mdc-theme-on-surface,#000)}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub .VfPpkd-Bz112c-Jh9lGc::after{background-color:#000;background-color:var(--mdc-ripple-color,var(--mdc-theme-on-surface,#000))}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub:hover .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub.VfPpkd-ksKsZd-XxIAqe-OWXEXe-ZmdkE .VfPpkd-Bz112c-Jh9lGc::before{opacity:.04;opacity:var(--mdc-ripple-hover-opacity,.04)}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub:not(.VfPpkd-ksKsZd-mWPk3d):

Chrome Cache Entry: 83

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 84

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	downloaded
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:	1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 85

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (467)
Category:	downloaded
Size (bytes):	1884
Entropy (8bit):	5.280363294341128
Encrypted:	false
SSDEEP:	48:o74b7AJ0qbL3AUFQp9/j7kOXTf43Z/rm7ZbZrw:oKFSLrFw/3FXjaeZbVw
MD5:	6759666E5C2624986C2FBE9208D39C80
SHA1:	4732C0CE332CEED1414CD2A6D4BEBEFD06A59115
SHA-256:	C0F98E792B9160E018D61998788E81396C68FB14E058C168E538A9AD6167533F
SHA-512:	BCF00B74425A487A6F378FDEBAE1591E1FF6EF50B065850182ADDF239FFDBBA1882E96EF54775AB490CC4F4342337AA9E01286F85424856836082B33866FA26D
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,F6sNGb,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lRrMHd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,r1n9ec,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.DY=function(a){_.J.call(this,a.Fa);this.window=a.Da.window.get();this.Dc=a.Da.Dc};_.B(_.DY,_.J);_.DY.Na=_.J.Na;_.DY.Ba=function(){return{Da:{window:_.Tq,Dc:_.mC}}};_.DY.prototype.wo=function(){};_.DY.prototype.addEncryptionRecoveryMethod=function(){};_.EY=function(a){return(a==null?void 0:a.Bq)\|\|function(){}};_.FY=function(a){return(a==null?void 0:a.vda)\|\|function(){}};_.GY=function(a){return(a==null?void 0:a.oo)\|\|function(){}};._.IDb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.JDb=function(a){setTimeout(function(){throw a;},0)};_.DY.prototype.lK=function(){return!0};_.Pq(_.Fl,_.DY);._.l();._.k("ziXSP");.var eZ=function(a){_.DY.call(this,a.Fa)};_.B(eZ,_.DY);eZ.Na=_.DY.Na;eZ.Ba=_.DY.Ba;eZ.prototype.wo=function(a,b,c){var d;

Chrome Cache Entry: 86

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4478)
Category:	downloaded
Size (bytes):	19418
Entropy (8bit):	5.379195390856238
Encrypted:	false
SSDEEP:	384:gJEePjmMfOH3Qm45RAGSeIMPW2NYZvnXYv3HAEfqwuhU3p9uj9QtJg:oROXQm456AYZvoPhfVIUSj9QtJg
MD5:	9CE9445F24BFC74018956880D606553C
SHA1:	ECF89E11E2091ACB1AF6735C9AF94AB19984F602
SHA-256:	797EF136123058C1D54A0AE365896D4E56FB3D84E83D60EF840D16BBAD8AC6BB
SHA-512:	7B25B6EB9B03A2118AE112AE00E774CBD9928DF69F49DA762D88255F30533CD3E6F576C82F0220FC393FA5E08544188ED210135CE17FB03B76505BF03F48A9BE
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,F6sNGb,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lRrMHd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,r1n9ec,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var HDa=_.ca.URL,IDa,JDa,LDa,KDa;try{new HDa("http://example.com"),IDa=!0}catch(a){IDa=!1}JDa=IDa;.LDa=function(a){var b=_.hh("A");try{_.Jb(b,new _.xb(a));var c=b.protocol}catch(e){throw Error("qc`"+a);}if(c===""\|\|c===":"\|\|c[c.length-1]!=":")throw Error("qc`"+a);if(!KDa.has(c))throw Error("qc`"+a);if(!b.hostname)throw Error("qc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};KDa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):.(a.host=b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.MDa=function(a){if(JDa){try{var b=new HDa(a)}catch(d){throw Error("qc`"+a);}var c=KDa.get(b.protocol);if(!c)throw Error("qc`"+a);if(!b.hostname)throw Error("qc`"+a);b.origin=="null"&&(a={href:b.hre

Chrome Cache Entry: 87

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (777)
Category:	downloaded
Size (bytes):	1481
Entropy (8bit):	5.316577802144649
Encrypted:	false
SSDEEP:	24:kMYD7xmEu0IvxqcNzoYcurO/qb99nyobhzWuNA+CkadpUGbX7MNa4VGbwCSF57M8:o7xmR0I5kc7b91xbf0dpUGbYNa4VGbwl
MD5:	FC2DC9D5B7292B603D399F3E3046665B
SHA1:	92D25D672FDDD209D97ED306541CE686B6FD51CE
SHA-256:	614049A345B7E332826D74B79163DF74EDDE93CA1A661EE468352D4E5F94574C
SHA-512:	7348DBAF2A5A1FC87E3017B9E504EF22A3EBA65EC6FD255DD127DB78384B56B80A101BE9101F5BADBA4717FBE460C6A8DBE07DBA5F918413BE36EF0D88716C50
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,F6sNGb,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lRrMHd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,r1n9ec,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("kMFpHd");._.FWa=new _.Ce(_.Kk);._.l();._.k("bm51tf");.var IWa=!!(_.$f[0]>>26&1);var KWa=function(a,b,c,d,e){this.ea=a;this.wa=b;this.ja=c;this.Ca=d;this.Ga=e;this.aa=0;this.da=JWa(this)},LWa=function(a){var b={};_.Ma(a.xO(),function(e){b[e]=!0});var c=a.jO(),d=a.pO();return new KWa(a.dL(),c.aa()1E3,a.NN(),d.aa()1E3,b)},JWa=function(a){return Math.random()Math.min(a.waMath.pow(a.ja,a.aa),a.Ca)},oE=function(a,b){return a.aa>=a.ea?!1:b!=null?!!a.Ga[b]:!0};var pE=function(a){_.J.call(this,a.Fa);this.Jc=null;this.ea=a.Da.sR;this.ja=a.Da.metadata;a=a.Da.Faa;this.da=a.ea.bind(a)};_.B(pE,_.J);pE.Na=_.J.Na;pE.Ba=function(){return{Da:{sR:_.GWa,metadata:_.FWa,Faa:_.zWa}}};pE.prototype.aa=function(a,b){if(this.ja.getType(a.Hd())!=1)return _.Vk(a);var c=this.ea.aa;return(c=c?LWa(c):null)&&oE(c)?_.Aua(a,MWa(this,a,b,c)):_.Vk(a)};.var MWa=function(a,b,c,d){return c.then(function(e)

Chrome Cache Entry: 88

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1694)
Category:	downloaded
Size (bytes):	30637
Entropy (8bit):	5.379716376439597
Encrypted:	false
SSDEEP:	768:ciVQqn5YPB1v2C82vd9BvjT4spXo6PVS+B3BWvJB6VSiV:cYYn2CzBvjT4GHPD00V
MD5:	1522EC1FD2855DE971E2341EA0A137BB
SHA1:	2E7564BBD084594968A105D2EBA5053A69F51F48
SHA-256:	B942FFA89D4E8337AE16D76A6D571DC0652D28D179D5B1BE9456D6967431FAEA
SHA-512:	5D35B151BE7A2D0D46E326A058622DF12FAE12687F0BC78C3E89CC1F65BC9043FEBE513FFAEF812BCEAB340F27EB16642545AE7AED4FAB1C820F9A76E2CC8619
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var Bqa=function(a,b){this.da=a;this.ea=b;if(!c){var c=new _.An("//www.google.com/images/cleardot.gif");_.Ln(c)}this.ja=c};_.h=Bqa.prototype;_.h.Jc=null;_.h.UU=1E4;_.h.Nx=!1;_.h.fM=0;_.h.pG=null;_.h.QQ=null;_.h.setTimeout=function(a){this.UU=a};_.h.start=function(){if(this.Nx)throw Error("lb");this.Nx=!0;this.fM=0;Cqa(this)};_.h.stop=function(){Dqa(this);this.Nx=!1};.var Cqa=function(a){a.fM++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.Ik((0,_.vf)(a.dE,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.vf)(a.tda,a),a.aa.onerror=(0,_.vf)(a.sda,a),a.aa.onabort=(0,_.vf)(a.rda,a),a.pG=_.Ik(a.uda,a.UU,a),a.aa.src=String(a.ja))};_.h=Bqa.prototype;_.h.tda=function(){this.dE(!0)};_.h.sda=function(){this.dE(!1)};_.h.rda=function(){this.dE(!1)};_.h.uda=function(){this.dE(!1)};._.h.dE=function(a){Dqa(this);a?(this.Nx=!1,this.da.call(this.ea,!0)):this.fM<=0?Cqa(this):(this.Nx=!1,

Chrome Cache Entry: 89

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2362)
Category:	downloaded
Size (bytes):	233234
Entropy (8bit):	5.4611037721061075
Encrypted:	false
SSDEEP:	3072:TSX0CBd2Buj8T4HvzoHfKxTadov0roCsu29d4XB:TA0CBd2BhT4EHS8rYEXB
MD5:	C1544473B310EC2623BC2BCABC3945D2
SHA1:	0CACCE70EAF08EEB64B2D96FD8D3EF09D97ABEFB
SHA-256:	D2DD3595FA23A5565F0E2D4BD6E4B36ACE3987FD2C942DF3C298A010FD84B92D
SHA-512:	CA6EA5ED5ADB531D0A9B7AF5A7F547AC7481063039591ECB3225EC68082DB3AE78B80D6118A225013638AAA24DA789D551ABBE03418F695219FEDF66A533D48E
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEyIpqkGROwjeIZ9SCPrKCNVnFaYg/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x818601e, 0x51cf74, 0x739cf10, 0xa500f8, 0x321, 0x0, 0x19680000, 0xcc80, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT./.var baa,eaa,haa,laa,Va,Xa,Ya,maa,naa,Za,oaa,paa,qaa,db,vaa,yaa,vb,wb,zb,Iaa,Kaa,Oaa,Wb,Xb,Qaa,Raa,Waa,dba,eba,iba,lba,fba,kba,jba,hba,gba,mba,pc,rba,sba,pba,tba,xba,yba,zba,Dba,Eba,Fba,Gba,Hba,Kba,Xc,Nba,Mba,Pba,ad,Zc,Rba,Qba,Uba,Tba,dd,Xba,Yba,aca,bca,nd,dca,eca,Ed,md,rd,rca,oca,sca,tca,wca,yca,zca,mca,Lca,he,Nca,ie,Oca,Qca,Sca,Wca,Xca,Yca,Zca,bda,dda,kda,lda,mda,qda,zda,vda,Cda,$e,Fda,Gda,Hda,Kda,Mda,Pda,Qda,Rda,Sda,Tda,Wda,Xda,Yda,dea,fea,gea,hea

Chrome Cache Entry: 90

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (574)
Category:	downloaded
Size (bytes):	3477
Entropy (8bit):	5.499342889552936
Encrypted:	false
SSDEEP:	96:oIByrBKfKVHcikUJFtlPMETAKv78pUCCjIw:INKS/vP3hv7mUbZ
MD5:	E18219F32F2747C14548BCFEE58B13CD
SHA1:	85307A7D3376A623245EB21D245B8BC4FA481908
SHA-256:	6479CFCD0C8840DD31DA0C55F596BDA37C28074517B5F063F5A5830EC27D0280
SHA-512:	EFE83897B3C1EE154EA3C14B3FFB4C242C065303F3F5A3DFA3E6E26C154B44509FE8E580D2402553CCDFABACEDD3F000FAC9171E861BBF22E6D56C5A6355CF47
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,F6sNGb,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,lRrMHd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,r1n9ec,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("Wt6vjf");.var jua=function(){var a=_.ge();return _.Bi(a,1)};var wq=function(a){this.Ea=_.t(a,0,wq.messageId)};_.B(wq,_.v);wq.prototype.Ha=function(){return _.ti(this,1)};wq.prototype.Za=function(a){return _.Ki(this,1,a)};wq.messageId="f.bo";var xq=function(){_.Fk.call(this)};_.B(xq,_.Fk);xq.prototype.Yc=function(){this.BP=!1;kua(this);_.Fk.prototype.Yc.call(this)};xq.prototype.aa=function(){lua(this);if(this.nA)return mua(this),!1;if(!this.xR)return yq(this),!0;this.dispatchEvent("p");if(!this.hL)return yq(this),!0;this.fJ?(this.dispatchEvent("r"),yq(this)):mua(this);return!1};.var nua=function(a){var b=new _.An(a.J0);a.iM!=null&&_.Ml(b,"authuser",a.iM);return b},mua=function(a){a.nA=!0;var b=nua(a),c="rt=r&f_uid="+_.Sg(a.hL);_.jl(b,(0,_.vf)(a.ea,a),"POST",c)};.xq.prototype.ea=function(a){a=a.target;lua(this);if(_.ml(a)){this.hH=0;if(this.fJ)this.nA=!1,this.dispatchEvent

Chrome Cache Entry: 91

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (693)
Category:	downloaded
Size (bytes):	3143
Entropy (8bit):	5.37079395351489
Encrypted:	false
SSDEEP:	48:o7gbuQLkZHPLbrzOw3KP757NQ8jsKyYqb6f4np/EkGuf/x06IZ2rw:orQGXJaT57OMNwp/kufJRgqw
MD5:	DB38B407EAF251C03254DA070DF97E29
SHA1:	440A9FE061A55A3C2E20FC8D5421CB89B691C4D5
SHA-256:	7071B6E12C5D15142A9D5EF16103678A3038B6D8FFDCDCE248C9E26B9D4D0E81
SHA-512:	B99B5DDA32BACF2C79CB23FFD9EC624AD678243C6DBEC19409C298C09486E8F38F31AD658A23BC9D5E249E7D906BA66C303EA3B84F63FD6B053CF588B718F377
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,F6sNGb,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lRrMHd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,r1n9ec,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var gw=function(a){_.J.call(this,a.Fa)};_.B(gw,_.J);gw.Na=_.J.Na;gw.Ba=_.J.Ba;gw.prototype.aO=function(a){return _.qe(this,{ab:{hP:_.zj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.sh(function(e){window._wjdc=function(f){d(f);e(EFa(f,b,a))}}):EFa(c,b,a)})};var EFa=function(a,b,c){return(a=a&&a[c])?a:b.ab.hP.aO(c)};.gw.prototype.aa=function(a,b){var c=_.Vta(b).Fi;if(c.startsWith("$")){var d=_.Zl.get(a);_.$p[b]&&(d\|\|(d={},_.Zl.set(a,d)),d[c]=_.$p[b],delete _.$p[b],_.aq--);if(d)if(a=d[c])b=_.pe(a);else throw Error("Xb`"+b);else b=null}else b=null;return b};_.Pq(_.mea,gw);._.l();._.k("SNUn3");._.DFa=new _.Ce(_.yf);._.l();._.k("RMhBfe");.var FFa=function(a,b){a=_.msa(a,b);return a.length==0?null:a[0].ctor},GFa=function(){return Object.values(_.Yo).reduce(function(a,b){return a+Object.keys(b).length},0)},HFa=function(){return Object.entries

Chrome Cache Entry: 92

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (777)
Category:	downloaded
Size (bytes):	7624
Entropy (8bit):	5.356859202879639
Encrypted:	false
SSDEEP:	192:mnwTgK8AwrKbbW8UFBlkU+/IrlQFsq1o98fYlp2PDYGym4nV9U:9ZwrKbaV/38xW8jn
MD5:	23ED78C00699D0EF97404A3901525DD3
SHA1:	09125039F07B8B3DE33761BFEBB4E0754AEA6738
SHA-256:	B21A2E0BD7B733D42DB2FBC676E0710D00CF95491967ED46C8A204605DBFDA29
SHA-512:	22AE4F4142F19399EE8C5ACF4EED70F9D91C41E3BB138522F340684CBA2C4E1FFF5233950DC9328861F79970ACABE2F5A28B396392AA72AD1A92429D61425D67
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,F6sNGb,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,lRrMHd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,r1n9ec,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.ENa=_.y("wg1P6b",[_.Nx,_.Hl,_.Ol]);._.k("wg1P6b");.var K2a=function(a,b){b=b\|\|_.Ha;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var g=b(0,a[f]);g>0?c=f+1:(d=f,e=!g)}return e?c:-c-1},L2a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},M2a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return L2a(b,a)},N2a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if("sourceIndex"in a\|\|a.parentNode&&"sourceIndex"in a.parentNode){var c=a.nodeType==.1,d=b.nodeType==1;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?L2a(a,b):!c&&_.lh(e,b)?-1*M2a(a,b):!d&&_.lh(f,a)?M2a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.ah(a);c=d.createRange();c.selectNode(a);c.collapse(!0);a=d.createRange();a.selectNode(b);a.colla

Chrome Cache Entry: 93

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	44
Entropy (8bit):	4.453416561671607
Encrypted:	false
SSDEEP:	3:8VKJmQcwVbF7KnZ:BJmjwVbF7KZ
MD5:	491DC96011445194971CFAE6A7A0B191
SHA1:	74BD675A8CBC8AF507C0EB5509727EA3F9B85060
SHA-256:	C3BA6FCBB38A83C87009DEE4BAB93A9B3274553128D77E5B2C04077ECD35C1D3
SHA-512:	38356EF67B6B704F2129828299E516B04B29EA1EEB25CF356E22E3AFEC7A875E2187F70E9E7CF0467DEFA14F11D802ACF00D69B2B13EFEA025942E21383AC35E
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
Preview:	Ch8KBw0ZARP6GgAKCw3oIX6GGgQISxgCCgcN05ioBxoA

Chrome Cache Entry: 94

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (405)
Category:	downloaded
Size (bytes):	1600
Entropy (8bit):	5.234706685474562
Encrypted:	false
SSDEEP:	48:o79bWW+d1xb0KeRV8YtQy0aqdHgxbaQ77DfTBpbrw:oAB6KOVddbqSnLzw
MD5:	777F1FD23230384A286E78C5ACD6AC33
SHA1:	CC33BAC75FDD7CE9AD535CBCEAD5C91D974DF975
SHA-256:	277C957E852CD541B5D6D50B9A1CC3E6E6120DC704B529AADDA0171367557D98
SHA-512:	F785634C17C38826894B2D0D4363C26110418A9160AB36ACDFF2E6B76A2E07D32DD1BDA3D2D0F4D9BE3254DB834EB808FEA392A95B224AB5B94B429E69EBD1F0
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ZU1EFvXsC20.es5.O/ck=boq-identity.AccountsSignInUi.DDD9SPcAL2k.L.B1.O/am=HmAYCN1zFADxnHPgA5QCIQMAAAAAAAAAgJYBMgM/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,F6sNGb,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lRrMHd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,r1n9ec,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEXqJoaGwEo5TjSaLcvO8AROXJTtw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:F6sNGb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.xf(_.mja);_.ew=function(a){_.J.call(this,a.Fa);this.aa=a.ab.cache};_.B(_.ew,_.J);_.ew.Na=_.J.Na;_.ew.Ba=function(){return{ab:{cache:_.mp}}};_.ew.prototype.execute=function(a){_.kb(a,function(b){var c;_.oe(b)&&(c=b.eb.Qb(b.jb));c&&this.aa.FD(c)},this);return{}};_.Pq(_.Hja,_.ew);._.l();._.k("VwDzFe");.var IE=function(a){_.J.call(this,a.Fa);this.aa=a.Da.Pj;this.ea=a.Da.metadata;this.da=a.Da.Zq};_.B(IE,_.J);IE.Na=_.J.Na;IE.Ba=function(){return{Da:{Pj:_.iE,metadata:_.FWa,Zq:_.fE}}};IE.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.kb(a,function(c){var d=b.ea.getType(c.Hd())===2?b.aa.Vb(c):b.aa.aa(c);return _.Lj(c,_.jE)?d.then(function(e){return _.gd(e)}):d},this)};_.Pq(_.Mja,IE);._.l();._.k("sP4Vbe");._.EWa=new _.Ce(_.Ija);._.l();._.k("A7fCU");.var nE=function(a){_.J.call(this,a.Fa);this.aa=a.Da.lM};_.B(nE,_.J);nE.Na=_.J.Na;nE.Ba=function(){r

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.035563548290413
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'166'336 bytes
MD5:	619f9806ab2fad61f931922dd30ede7f
SHA1:	e37a5d0abee7f33f31001dfb6352f7282fae174a
SHA256:	6948115e88783353bec40bf54a6d10c614fd1332848e6ce2f8a1932c918998ac
SHA512:	3b6df4cd430ac31e10a4d957a995073bfe582fd3965d69a108d62d0d6429a26083e533fc954e734b1c1e16450ea258e86bec6923a24373ab842f231600ff6935
SSDEEP:	24576:gqDEvCTbMWu7rQYlBQcBiT6rprG8au/2+b+HdiJUX:gTvC/MTQYxsWR7au/2+b+HoJU
TLSH:	C545BF027391C062FF9B92734F5AF6115BBC69260123E61F13981DBABE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6686DEC1 [Thu Jul 4 17:41:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F98405004A3h
jmp 00007F98404FFDAFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F98404FFF8Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F98404FFF5Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F9840502B4Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F9840502B98h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F9840502B81h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x4617c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11b000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x4617c	0x46200	c2c7827c7524ac47cc17f50b3295d9d2	False	0.9065877061051694	data	7.844090278150599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11b000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x3d444	data			1.0003427004797807
RT_GROUP_ICON	0x119bfc	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x119c74	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x119c88	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x119c9c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x119cb0	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x119d8c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 20:34:49.834351063 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 4, 2024 20:34:49.834351063 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 4, 2024 20:34:50.162570953 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 4, 2024 20:34:53.465082884 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:53.465096951 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:53.465142012 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:53.467050076 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:53.467066050 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.148607969 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.148906946 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:54.148921013 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.149254084 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.149327040 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:54.149844885 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.149905920 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:54.150860071 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:54.150918961 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.151046038 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:54.151062012 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.200023890 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:54.472429991 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.472451925 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.472527027 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:54.472548962 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.472697973 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.473058939 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:54.476346970 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:54.476346970 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:54.476370096 CEST	443	49713	142.250.185.206	192.168.2.6
Jul 4, 2024 20:34:54.476871967 CEST	49713	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:34:57.341916084 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:34:57.341934919 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:34:57.342000961 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:34:57.342216969 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:34:57.342227936 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:34:57.991724014 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:57.991749048 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:57.991817951 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:57.993483067 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:57.993494034 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:58.005970955 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:34:58.006401062 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:34:58.006408930 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:34:58.007394075 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:34:58.007453918 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:34:58.008380890 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:34:58.008435965 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:34:58.054126024 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:34:58.054131985 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:34:58.103091955 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:34:58.670813084 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:58.671008110 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:58.674293041 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:58.674299955 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:58.674534082 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:58.712954044 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:58.756515026 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:58.948301077 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:58.948350906 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:58.948400021 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:58.948498011 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:58.948510885 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:58.948522091 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:58.948529005 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:58.990547895 CEST	49730	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:58.990653992 CEST	443	49730	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:58.990760088 CEST	49730	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:58.991106987 CEST	49730	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:58.991143942 CEST	443	49730	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:59.080302954 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:34:59.080329895 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 4, 2024 20:34:59.080379963 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:34:59.080924988 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:34:59.080939054 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 4, 2024 20:34:59.443030119 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 4, 2024 20:34:59.443030119 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 4, 2024 20:34:59.642990112 CEST	443	49730	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:59.643079996 CEST	49730	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:59.645386934 CEST	49730	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:59.645397902 CEST	443	49730	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:59.645648003 CEST	443	49730	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:59.646744013 CEST	49730	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:59.692488909 CEST	443	49730	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:59.771313906 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 4, 2024 20:34:59.892556906 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 4, 2024 20:34:59.892627001 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:34:59.897423983 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:34:59.897449970 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 4, 2024 20:34:59.897687912 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 4, 2024 20:34:59.900713921 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:34:59.900803089 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:34:59.900813103 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 4, 2024 20:34:59.900904894 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:34:59.930063963 CEST	443	49730	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:59.930129051 CEST	443	49730	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:59.931308031 CEST	49730	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:59.931344032 CEST	49730	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:59.931365013 CEST	443	49730	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:59.931395054 CEST	49730	443	192.168.2.6	184.28.90.27
Jul 4, 2024 20:34:59.931401968 CEST	443	49730	184.28.90.27	192.168.2.6
Jul 4, 2024 20:34:59.948513985 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:00.085235119 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:00.085639000 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:00.086726904 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:00.097992897 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:00.098014116 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:01.279266119 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:01.279299021 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:01.279424906 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:01.279874086 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:01.279886007 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:01.489970922 CEST	443	49705	173.222.162.64	192.168.2.6
Jul 4, 2024 20:35:01.490058899 CEST	49705	443	192.168.2.6	173.222.162.64
Jul 4, 2024 20:35:01.933110952 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:01.933530092 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:01.933547974 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:01.933895111 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:01.933985949 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:01.934503078 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:01.934551001 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:01.943705082 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:01.943769932 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:01.944058895 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:01.944073915 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:01.990325928 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.249540091 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.249582052 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.249667883 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.249681950 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.249733925 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.249802113 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.249850035 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.255326033 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.255423069 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.261492014 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.261524916 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.261583090 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.261590004 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.261657000 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.269727945 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.269798040 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.273407936 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.273495913 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.273530006 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.273535967 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.273578882 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.342746019 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.342787981 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.342809916 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.342832088 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.342931986 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.343120098 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.343128920 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.344582081 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.344618082 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.344645023 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.344650984 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.344670057 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.350312948 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.350750923 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.350756884 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.356374979 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.356400013 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.356502056 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.356507063 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.356580973 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.362276077 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.368706942 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.368745089 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.368820906 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.368828058 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.368969917 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.368974924 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.368993044 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.369118929 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.601649046 CEST	49739	443	192.168.2.6	142.250.185.206
Jul 4, 2024 20:35:02.601664066 CEST	443	49739	142.250.185.206	192.168.2.6
Jul 4, 2024 20:35:02.649183989 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:02.649218082 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:02.649333954 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:02.649774075 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:02.649786949 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:02.701739073 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:02.701775074 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:02.701844931 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:02.702394962 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:02.702411890 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.350214005 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.350666046 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.350675106 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.351027966 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.351090908 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.351723909 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.351777077 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.352722883 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.352781057 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.353053093 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.353059053 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.394092083 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.394359112 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.394371033 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.394684076 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.394745111 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.395298004 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.395380020 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.396112919 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.396164894 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.396449089 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.396454096 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.397032976 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.443464994 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.630973101 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.631108999 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.631165028 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.632637978 CEST	49744	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.632652044 CEST	443	49744	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.633924961 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.633949041 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.634032965 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.634529114 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.634546041 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.675834894 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.675899029 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.675976038 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.678620100 CEST	49743	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.678630114 CEST	443	49743	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.679769993 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.679785967 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:03.679869890 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.680866003 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:03.680876017 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.308753967 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.315104008 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.315138102 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.315692902 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.315761089 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.316380024 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.316437006 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.316590071 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.316651106 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.316838026 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.316849947 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.316868067 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.340585947 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.340794086 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.340805054 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.341167927 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.341222048 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.341881990 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.341938972 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.342173100 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.342238903 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.342403889 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.342417002 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.342433929 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.364501953 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.365262032 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.388500929 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.396573067 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.532821894 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.532957077 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.533036947 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.533998966 CEST	49749	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.534020901 CEST	443	49749	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.536468029 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.536850929 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.536911011 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.537818909 CEST	49750	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:04.537836075 CEST	443	49750	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:04.630651951 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:04.672503948 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:04.904772043 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:04.904808998 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:04.904836893 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:04.904849052 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:04.904860020 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:04.904870033 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:04.904921055 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:04.904937029 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:04.904977083 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:04.905033112 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:04.905071974 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:04.905111074 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:04.906713963 CEST	49721	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:04.906724930 CEST	443	49721	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:07.174556971 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:07.174571991 CEST	443	49756	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:07.174662113 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:07.175450087 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:07.175460100 CEST	443	49756	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:07.972490072 CEST	443	49756	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:07.972735882 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:07.974977016 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:07.974989891 CEST	443	49756	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:07.975193977 CEST	443	49756	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:07.977201939 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:07.977258921 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:07.977262974 CEST	443	49756	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:07.977417946 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:08.020507097 CEST	443	49756	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:08.151561975 CEST	443	49756	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:08.151904106 CEST	443	49756	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:08.151966095 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:08.152589083 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:08.152610064 CEST	443	49756	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:08.152625084 CEST	49756	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:09.999947071 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:10.000005007 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:10.000087976 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:10.001221895 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:10.001239061 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:10.367719889 CEST	49759	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:10.367772102 CEST	443	49759	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:10.367837906 CEST	49759	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:10.368302107 CEST	49759	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:10.368340015 CEST	443	49759	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:10.831104040 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:10.831191063 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:10.835541964 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:10.835570097 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:10.835782051 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:10.879565001 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:10.902615070 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:10.948504925 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:11.043445110 CEST	443	49759	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:11.045222044 CEST	49759	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:11.045264006 CEST	443	49759	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:11.045594931 CEST	443	49759	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:11.049120903 CEST	49759	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:11.049184084 CEST	443	49759	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:11.049338102 CEST	49759	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:11.049355030 CEST	49759	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:11.049366951 CEST	443	49759	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:11.177021027 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:11.177041054 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:11.177047968 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:11.177056074 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:11.177078962 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:11.177156925 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:11.177208900 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:11.177253962 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:11.178396940 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:11.178468943 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:11.178514957 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:11.178540945 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:11.200525045 CEST	49758	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:11.200567961 CEST	443	49758	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:11.357909918 CEST	443	49759	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:11.358077049 CEST	443	49759	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:11.358141899 CEST	49759	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:11.358839989 CEST	49759	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:11.358860970 CEST	443	49759	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:19.496682882 CEST	49764	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:19.496745110 CEST	443	49764	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:19.496834993 CEST	49764	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:19.497426033 CEST	49764	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:19.497446060 CEST	443	49764	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:20.306452990 CEST	443	49764	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:20.306528091 CEST	49764	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:20.313566923 CEST	49764	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:20.313621044 CEST	443	49764	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:20.313853979 CEST	443	49764	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:20.316647053 CEST	49764	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:20.316761971 CEST	49764	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:20.316771030 CEST	443	49764	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:20.316935062 CEST	49764	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:20.364510059 CEST	443	49764	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:20.507817030 CEST	443	49764	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:20.508001089 CEST	443	49764	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:20.508066893 CEST	49764	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:20.508203030 CEST	49764	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:20.508227110 CEST	443	49764	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:33.008377075 CEST	49765	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.008435011 CEST	443	49765	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.008514881 CEST	49765	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.008853912 CEST	49765	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.008869886 CEST	443	49765	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.648406029 CEST	49766	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.648468018 CEST	443	49766	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.648550987 CEST	49766	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.648839951 CEST	49766	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.648854017 CEST	443	49766	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.691818953 CEST	443	49765	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.692672014 CEST	49765	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.692730904 CEST	443	49765	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.693068027 CEST	443	49765	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.695457935 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.695508957 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.695576906 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.695867062 CEST	49765	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.695926905 CEST	443	49765	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.696156979 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.696171999 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.696448088 CEST	49765	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.696470022 CEST	49765	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.696486950 CEST	443	49765	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.979104042 CEST	443	49765	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.979223013 CEST	443	49765	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:33.979293108 CEST	49765	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.979749918 CEST	49765	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:33.979772091 CEST	443	49765	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.343453884 CEST	443	49766	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.343847990 CEST	49766	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.343887091 CEST	443	49766	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.344253063 CEST	443	49766	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.344839096 CEST	49766	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.344914913 CEST	443	49766	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.345340014 CEST	49766	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.345362902 CEST	49766	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.345412970 CEST	443	49766	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.349263906 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.349756002 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.349781036 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.350102901 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.350171089 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.350709915 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.350766897 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.351078987 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.351135015 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.351346016 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.351353884 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.351371050 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.392498016 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.395457983 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.544306993 CEST	443	49766	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.544444084 CEST	443	49766	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.544492006 CEST	49766	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.545372009 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.545490980 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.545531034 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.559844971 CEST	49767	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.559880972 CEST	443	49767	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:34.561125994 CEST	49766	443	192.168.2.6	142.250.185.238
Jul 4, 2024 20:35:34.561146975 CEST	443	49766	142.250.185.238	192.168.2.6
Jul 4, 2024 20:35:38.624353886 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:38.624399900 CEST	443	49768	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:38.624474049 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:38.625224113 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:38.625238895 CEST	443	49768	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:39.425875902 CEST	443	49768	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:39.425940037 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:39.428442955 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:39.428467035 CEST	443	49768	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:39.428679943 CEST	443	49768	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:39.430851936 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:39.430936098 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:39.430939913 CEST	443	49768	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:39.431116104 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:39.472489119 CEST	443	49768	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:39.607716084 CEST	443	49768	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:39.608153105 CEST	443	49768	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:39.608201027 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:39.608464956 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:39.608495951 CEST	443	49768	40.113.103.199	192.168.2.6
Jul 4, 2024 20:35:39.608514071 CEST	49768	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:35:47.758979082 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:47.759021997 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:47.759130001 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:47.759479046 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:47.759495020 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.632366896 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.632561922 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:48.634157896 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:48.634169102 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.634371996 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.643074989 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:48.688504934 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.985445976 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.985467911 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.985510111 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.985745907 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:48.985769987 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.985836983 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:48.986666918 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.986707926 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.986732006 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:48.986737967 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.986767054 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:48.987036943 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.987080097 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:48.991499901 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:48.991512060 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:48.991520882 CEST	49769	443	192.168.2.6	40.68.123.157
Jul 4, 2024 20:35:48.991524935 CEST	443	49769	40.68.123.157	192.168.2.6
Jul 4, 2024 20:35:57.396732092 CEST	49771	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:57.396753073 CEST	443	49771	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:57.396878958 CEST	49771	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:57.397089005 CEST	49771	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:57.397099972 CEST	443	49771	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:58.077616930 CEST	443	49771	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:58.077977896 CEST	49771	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:58.077986002 CEST	443	49771	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:58.078315020 CEST	443	49771	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:58.078658104 CEST	49771	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:35:58.078708887 CEST	443	49771	142.250.186.68	192.168.2.6
Jul 4, 2024 20:35:58.129693985 CEST	49771	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:36:03.575171947 CEST	49773	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:03.575282097 CEST	443	49773	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:03.575366974 CEST	49773	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:03.575994968 CEST	49773	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:03.576033115 CEST	443	49773	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:04.477679968 CEST	443	49773	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:04.477766037 CEST	49773	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:04.480664968 CEST	49773	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:04.480678082 CEST	443	49773	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:04.480884075 CEST	443	49773	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:04.482877016 CEST	49773	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:04.482935905 CEST	49773	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:04.482942104 CEST	443	49773	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:04.483103991 CEST	49773	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:04.528527021 CEST	443	49773	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:04.659440041 CEST	443	49773	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:04.659517050 CEST	443	49773	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:04.659634113 CEST	49773	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:04.659969091 CEST	49773	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:04.660020113 CEST	443	49773	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:04.955043077 CEST	49774	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:04.955084085 CEST	443	49774	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:04.955140114 CEST	49774	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:04.955380917 CEST	49774	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:04.955395937 CEST	443	49774	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:05.571984053 CEST	49775	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:05.572012901 CEST	443	49775	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:05.572102070 CEST	49775	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:05.572484970 CEST	49775	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:05.572494984 CEST	443	49775	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:05.633405924 CEST	443	49774	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:05.633934021 CEST	49774	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:05.633974075 CEST	443	49774	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:05.634350061 CEST	443	49774	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:05.634741068 CEST	49774	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:05.634804010 CEST	443	49774	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:05.635298014 CEST	49774	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:05.635324955 CEST	49774	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:05.635329962 CEST	443	49774	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:05.834383011 CEST	443	49774	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:05.834749937 CEST	443	49774	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:05.834835052 CEST	49774	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:05.834965944 CEST	49774	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:05.834985018 CEST	443	49774	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:06.219459057 CEST	443	49775	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:06.219789028 CEST	49775	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:06.219799995 CEST	443	49775	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:06.220130920 CEST	443	49775	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:06.220443964 CEST	49775	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:06.220505953 CEST	443	49775	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:06.220599890 CEST	49775	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:06.220599890 CEST	49775	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:06.220628023 CEST	443	49775	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:06.415251017 CEST	443	49775	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:06.415386915 CEST	443	49775	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:06.415484905 CEST	49775	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:06.415893078 CEST	49775	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:06.415906906 CEST	443	49775	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:07.984555006 CEST	443	49771	142.250.186.68	192.168.2.6
Jul 4, 2024 20:36:07.984620094 CEST	443	49771	142.250.186.68	192.168.2.6
Jul 4, 2024 20:36:07.984699011 CEST	49771	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:36:21.412820101 CEST	49771	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:36:21.412837029 CEST	443	49771	142.250.186.68	192.168.2.6
Jul 4, 2024 20:36:29.560549021 CEST	49778	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:29.560609102 CEST	443	49778	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:29.560698986 CEST	49778	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:29.561295986 CEST	49778	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:29.561317921 CEST	443	49778	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:29.755140066 CEST	49704	80	192.168.2.6	199.232.210.172
Jul 4, 2024 20:36:29.762376070 CEST	80	49704	199.232.210.172	192.168.2.6
Jul 4, 2024 20:36:29.762423992 CEST	49704	80	192.168.2.6	199.232.210.172
Jul 4, 2024 20:36:30.361021996 CEST	443	49778	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:30.361136913 CEST	49778	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:30.365293980 CEST	49778	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:30.365304947 CEST	443	49778	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:30.365549088 CEST	443	49778	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:30.367507935 CEST	49778	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:30.367573023 CEST	49778	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:30.367580891 CEST	443	49778	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:30.367750883 CEST	49778	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:30.408507109 CEST	443	49778	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:30.541538954 CEST	443	49778	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:30.541631937 CEST	443	49778	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:30.541692019 CEST	49778	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:30.541815042 CEST	49778	443	192.168.2.6	40.113.103.199
Jul 4, 2024 20:36:30.541832924 CEST	443	49778	40.113.103.199	192.168.2.6
Jul 4, 2024 20:36:37.617432117 CEST	49779	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:37.617470026 CEST	443	49779	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:37.617563009 CEST	49779	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:37.618201017 CEST	49779	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:37.618218899 CEST	443	49779	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:38.265189886 CEST	443	49779	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:38.265703917 CEST	49779	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:38.265733957 CEST	443	49779	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:38.266047001 CEST	443	49779	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:38.266355991 CEST	49779	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:38.266415119 CEST	443	49779	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:38.266525030 CEST	49779	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:38.266546965 CEST	49779	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:38.266557932 CEST	443	49779	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:38.545324087 CEST	443	49779	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:38.545416117 CEST	443	49779	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:38.545465946 CEST	49779	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:38.545882940 CEST	49779	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:38.545912981 CEST	443	49779	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:39.445370913 CEST	49780	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:39.445400953 CEST	443	49780	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:39.445491076 CEST	49780	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:39.446119070 CEST	49780	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:39.446130037 CEST	443	49780	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:40.090966940 CEST	443	49780	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:40.091316938 CEST	49780	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:40.091327906 CEST	443	49780	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:40.091639996 CEST	443	49780	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:40.091995001 CEST	49780	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:40.092047930 CEST	443	49780	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:40.092289925 CEST	49780	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:40.092302084 CEST	49780	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:40.092312098 CEST	443	49780	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:40.290115118 CEST	443	49780	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:40.290255070 CEST	443	49780	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:40.290318012 CEST	49780	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:40.290947914 CEST	49780	443	192.168.2.6	142.250.185.174
Jul 4, 2024 20:36:40.290956974 CEST	443	49780	142.250.185.174	192.168.2.6
Jul 4, 2024 20:36:57.459374905 CEST	49781	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:36:57.459414005 CEST	443	49781	142.250.186.68	192.168.2.6
Jul 4, 2024 20:36:57.459578037 CEST	49781	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:36:57.459839106 CEST	49781	443	192.168.2.6	142.250.186.68
Jul 4, 2024 20:36:57.459851980 CEST	443	49781	142.250.186.68	192.168.2.6
Jul 4, 2024 20:36:58.135533094 CEST	443	49781	142.250.186.68	192.168.2.6
Jul 4, 2024 20:36:58.176286936 CEST	49781	443	192.168.2.6	142.250.186.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 20:34:53.425580978 CEST	65452	53	192.168.2.6	1.1.1.1
Jul 4, 2024 20:34:53.427036047 CEST	60220	53	192.168.2.6	1.1.1.1
Jul 4, 2024 20:34:53.439368010 CEST	53	65452	1.1.1.1	192.168.2.6
Jul 4, 2024 20:34:53.442979097 CEST	53	60220	1.1.1.1	192.168.2.6
Jul 4, 2024 20:34:53.452152014 CEST	53	50151	1.1.1.1	192.168.2.6
Jul 4, 2024 20:34:53.460702896 CEST	53	61245	1.1.1.1	192.168.2.6
Jul 4, 2024 20:34:54.460215092 CEST	53	55698	1.1.1.1	192.168.2.6
Jul 4, 2024 20:34:57.300218105 CEST	53	62939	1.1.1.1	192.168.2.6
Jul 4, 2024 20:34:57.333913088 CEST	62478	53	192.168.2.6	1.1.1.1
Jul 4, 2024 20:34:57.334060907 CEST	53440	53	192.168.2.6	1.1.1.1
Jul 4, 2024 20:34:57.340914965 CEST	53	62478	1.1.1.1	192.168.2.6
Jul 4, 2024 20:34:57.341274023 CEST	53	53440	1.1.1.1	192.168.2.6
Jul 4, 2024 20:34:57.874986887 CEST	53	58908	1.1.1.1	192.168.2.6
Jul 4, 2024 20:34:57.911535025 CEST	53	51290	1.1.1.1	192.168.2.6
Jul 4, 2024 20:34:58.627774000 CEST	53	50437	1.1.1.1	192.168.2.6
Jul 4, 2024 20:35:01.269723892 CEST	61905	53	192.168.2.6	1.1.1.1
Jul 4, 2024 20:35:01.270278931 CEST	52819	53	192.168.2.6	1.1.1.1
Jul 4, 2024 20:35:01.277746916 CEST	53	52819	1.1.1.1	192.168.2.6
Jul 4, 2024 20:35:01.278793097 CEST	53	61905	1.1.1.1	192.168.2.6
Jul 4, 2024 20:35:02.617343903 CEST	63260	53	192.168.2.6	1.1.1.1
Jul 4, 2024 20:35:02.617497921 CEST	51503	53	192.168.2.6	1.1.1.1
Jul 4, 2024 20:35:02.625596046 CEST	53	51503	1.1.1.1	192.168.2.6
Jul 4, 2024 20:35:02.629069090 CEST	53	63260	1.1.1.1	192.168.2.6
Jul 4, 2024 20:35:11.490328074 CEST	53	59066	1.1.1.1	192.168.2.6
Jul 4, 2024 20:35:30.576807976 CEST	53	61642	1.1.1.1	192.168.2.6
Jul 4, 2024 20:35:52.612874985 CEST	53	58103	1.1.1.1	192.168.2.6
Jul 4, 2024 20:35:53.014149904 CEST	53	49319	1.1.1.1	192.168.2.6
Jul 4, 2024 20:36:03.376764059 CEST	53	49376	1.1.1.1	192.168.2.6
Jul 4, 2024 20:36:04.945907116 CEST	62117	53	192.168.2.6	1.1.1.1
Jul 4, 2024 20:36:04.946288109 CEST	56472	53	192.168.2.6	1.1.1.1
Jul 4, 2024 20:36:04.953735113 CEST	53	62117	1.1.1.1	192.168.2.6
Jul 4, 2024 20:36:04.954624891 CEST	53	56472	1.1.1.1	192.168.2.6
Jul 4, 2024 20:36:21.583492994 CEST	53	62752	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 4, 2024 20:34:53.425580978 CEST	192.168.2.6	1.1.1.1	0x6e8e	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.427036047 CEST	192.168.2.6	1.1.1.1	0x60c6	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jul 4, 2024 20:34:57.333913088 CEST	192.168.2.6	1.1.1.1	0x6110	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:57.334060907 CEST	192.168.2.6	1.1.1.1	0x2d9b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 4, 2024 20:35:01.269723892 CEST	192.168.2.6	1.1.1.1	0xba2	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:35:01.270278931 CEST	192.168.2.6	1.1.1.1	0x862b	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Jul 4, 2024 20:35:02.617343903 CEST	192.168.2.6	1.1.1.1	0x1678	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:35:02.617497921 CEST	192.168.2.6	1.1.1.1	0x3cb2	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jul 4, 2024 20:36:04.945907116 CEST	192.168.2.6	1.1.1.1	0xdb2	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:36:04.946288109 CEST	192.168.2.6	1.1.1.1	0xdec7	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.439368010 CEST	1.1.1.1	192.168.2.6	0x6e8e	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:53.442979097 CEST	1.1.1.1	192.168.2.6	0x60c6	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 20:34:53.442979097 CEST	1.1.1.1	192.168.2.6	0x60c6	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jul 4, 2024 20:34:57.340914965 CEST	1.1.1.1	192.168.2.6	0x6110	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:34:57.341274023 CEST	1.1.1.1	192.168.2.6	0x2d9b	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 4, 2024 20:35:01.277746916 CEST	1.1.1.1	192.168.2.6	0x862b	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 20:35:01.278793097 CEST	1.1.1.1	192.168.2.6	0xba2	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 20:35:01.278793097 CEST	1.1.1.1	192.168.2.6	0xba2	No error (0)	www3.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:35:02.629069090 CEST	1.1.1.1	192.168.2.6	0x1678	No error (0)	play.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 4, 2024 20:36:04.953735113 CEST	1.1.1.1	192.168.2.6	0xdb2	No error (0)	play.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.youtube.com

fs.microsoft.com

https:

accounts.youtube.com

play.google.com

www.google.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49713	142.250.185.206	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:34:54 UTC	790	OUT	GET /account HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 18:34:54 UTC	2470	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 04 Jul 2024 18:34:54 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Thu, 04-Jul-2024 19:04:54 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=KEb26Gg3p40; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_INFO1_LIVE=CQxUX50tc2g; Domain=.youtube.com; Expires=Tue, 31-Dec-2024 18:34:54 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgSg%3D%3D; Domain=.youtube.com; Expires=Tue, 31-Dec-2024 18:34:54 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49724	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:34:58 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 18:34:58 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=44944 Date: Thu, 04 Jul 2024 18:34:58 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49730	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:34:59 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 18:34:59 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=44964 Date: Thu, 04 Jul 2024 18:34:59 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-04 18:34:59 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49731	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:34:59 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 67 59 62 6f 7a 43 6e 4a 6b 61 4d 70 30 2f 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 30 37 39 39 38 62 35 34 61 30 61 36 63 36 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: NgYbozCnJkaMp0/N.1Context: 807998b54a0a6c66
2024-07-04 18:34:59 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 18:34:59 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 4e 67 59 62 6f 7a 43 6e 4a 6b 61 4d 70 30 2f 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 30 37 39 39 38 62 35 34 61 30 61 36 63 36 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 76 43 75 4a 6f 77 43 6d 6d 47 69 64 74 78 57 76 4d 30 74 6e 42 66 55 4c 73 75 39 72 4d 2b 64 48 63 43 36 6e 4a 64 5a 68 75 76 56 58 67 4a 52 63 4b 54 53 72 73 70 36 30 78 51 43 32 59 4d 57 55 56 68 56 6b 35 42 6f 2b 63 58 54 78 4b 4c 79 59 4d 6a 6f 6b 33 45 67 4d 51 39 51 54 4a 41 64 58 57 54 65 67 63 71 67 73 58 47 61 71 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: NgYbozCnJkaMp0/N.2Context: 807998b54a0a6c66<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWvCuJowCmmGidtxWvM0tnBfULsu9rM+dHcC6nJdZhuvVXgJRcKTSrsp60xQC2YMWUVhVk5Bo+cXTxKLyYMjok3EgMQ9QTJAdXWTegcqgsXGaq
2024-07-04 18:34:59 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 67 59 62 6f 7a 43 6e 4a 6b 61 4d 70 30 2f 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 30 37 39 39 38 62 35 34 61 30 61 36 63 36 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: NgYbozCnJkaMp0/N.3Context: 807998b54a0a6c66<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-04 18:35:00 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 18:35:00 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 75 48 35 68 37 51 42 72 55 53 6b 55 43 39 6b 44 74 57 6f 32 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: AuH5h7QBrUSkUC9kDtWo2g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49739	142.250.185.206	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:01 UTC	1205	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1296713850&timestamp=1720118100616 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 18:35:02 UTC	1951	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: script-src 'report-sample' 'nonce-qYHrE4eDGr3yDPLK-aEC2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 04 Jul 2024 18:35:02 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Resource-Policy: cross-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzj0tDikmLw0JBikPj6kkkNiJ3SZ7AGAHHSv_OsBUC8JOIi64HEi6xC3BzXrs3ewibwYc10OyW9pPzC-MyU1LySzJLKlPzcxMy85Pz87MzU4uLUorLUongjAyMTAzMjYz0Di_gCAwDSNiZn" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-04 18:35:02 UTC	1951	IN	Data Raw: 37 36 36 36 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 71 59 48 72 45 34 65 44 47 72 33 79 44 50 4c 4b 2d 61 45 43 32 67 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f Data Ascii: 7666<html><head><script nonce="qYHrE4eDGr3yDPLK-aEC2g">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
2024-07-04 18:35:02 UTC	1951	IN	Data Raw: 64 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 20 69 6e 20 62 7d 29 5d 7c 7c 22 22 7d 7d 2c 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 0a 66 61 28 29 3b 69 66 28 61 3d 3d 3d 22 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 29 7b 69 66 28 6a 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 Data Ascii: d(function(d){return d in b})]\|\|""}},qa=function(a){var b=fa();if(a==="Internet Explorer"){if(ja())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])sw
2024-07-04 18:35:02 UTC	1951	IN	Data Raw: 3b 7a 61 3d 76 6f 69 64 20 30 3b 69 66 28 61 3d 3d 6e 75 6c 6c 29 7b 76 61 72 20 64 3d 39 36 3b 63 3f 28 61 3d 5b 63 5d 2c 64 7c 3d 35 31 32 29 3a 61 3d 5b 5d 3b 62 26 26 28 64 3d 64 26 2d 31 36 37 36 30 38 33 33 7c 28 62 26 31 30 32 33 29 3c 3c 31 34 29 7d 65 6c 73 65 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6e 22 29 3b 64 3d 7a 28 61 29 3b 69 66 28 64 26 32 30 34 38 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6f 22 29 3b 69 66 28 64 26 0a 36 34 29 72 65 74 75 72 6e 20 61 3b 64 7c 3d 36 34 3b 69 66 28 63 26 26 28 64 7c 3d 35 31 32 2c 63 21 3d 3d 61 5b 30 5d 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 70 22 29 3b 61 3a 7b 63 3d 61 3b 76 61 72 20 65 3d 63 2e 6c 65 6e 67 74 68 3b 69 66 28 65 29 Data Ascii: ;za=void 0;if(a==null){var d=96;c?(a=[c],d\|=512):a=[];b&&(d=d&-16760833\|(b&1023)<<14)}else{if(!Array.isArray(a))throw Error("n");d=z(a);if(d&2048)throw Error("o");if(d&64)return a;d\|=64;if(c&&(d\|=512,c!==a[0]))throw Error("p");a:{c=a;var e=c.length;if(e)
2024-07-04 18:35:02 UTC	1951	IN	Data Raw: 3a 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 63 61 3b 76 61 72 20 65 3d 4b 61 28 63 3f 61 2e 43 3a 62 29 3b 69 66 28 61 3d 62 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 66 3d 62 5b 61 2d 31 5d 2c 68 3d 77 61 28 66 29 3b 68 3f 61 2d 2d 3a 66 3d 76 6f 69 64 20 30 3b 65 3d 2b 21 21 28 65 26 35 31 32 29 2d 31 3b 76 61 72 20 67 3d 62 3b 69 66 28 68 29 7b 62 3a 7b 76 61 72 20 6b 3d 66 3b 76 61 72 20 6c 3d 7b 7d 3b 68 3d 21 31 3b 69 66 28 6b 29 66 6f 72 28 76 61 72 20 6d 20 69 6e 20 6b 29 69 66 28 69 73 4e 61 4e 28 2b 6d 29 29 6c 5b 6d 5d 3d 6b 5b 6d 5d 3b 65 6c 73 65 7b 76 61 72 20 71 3d 6b 5b 6d 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 71 29 26 26 28 41 28 71 2c 64 2c 0a 2b 6d 29 7c 7c 76 61 28 71 29 26 26 71 2e 73 69 7a 65 3d 3d 3d 30 29 26 26 28 71 3d 6e Data Ascii: :a.constructor.ca;var e=Ka(c?a.C:b);if(a=b.length){var f=b[a-1],h=wa(f);h?a--:f=void 0;e=+!!(e&512)-1;var g=b;if(h){b:{var k=f;var l={};h=!1;if(k)for(var m in k)if(isNaN(+m))l[m]=k[m];else{var q=k[m];Array.isArray(q)&&(A(q,d,+m)\|\|va(q)&&q.size===0)&&(q=n
2024-07-04 18:35:02 UTC	1951	IN	Data Raw: 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 50 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 45 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 51 61 28 4e 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 0a 76 61 72 20 51 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 Data Ascii: gth;c++){var d=Pa[b[c]];typeof d==="function"&&typeof d.prototype[a]!="function"&&E(d.prototype,a,{configurable:!0,writable:!0,value:function(){return Qa(Na(this))}})}return a});var Qa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};ret
2024-07-04 18:35:02 UTC	1951	IN	Data Raw: 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 48 28 6b 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6a 60 22 2b 6b 29 3b 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3d 6c 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 48 28 6b 2c 66 29 3f 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3a 76 6f 69 64 20 30 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 48 28 6b 2c 66 29 26 26 48 28 6b 5b 66 5d 2c 74 68 69 73 2e 67 29 7d 3b 67 2e 70 72 Data Ascii: rototype.set=function(k,l){if(!c(k))throw Error("i");d(k);if(!H(k,f))throw Error("j`"+k);k[f][this.g]=l;return this};g.prototype.get=function(k){return c(k)&&H(k,f)?k[f][this.g]:void 0};g.prototype.has=function(k){return c(k)&&H(k,f)&&H(k[f],this.g)};g.pr
2024-07-04 18:35:02 UTC	1951	IN	Data Raw: 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29 3f 6c 3d 62 2e 67 65 74 28 6b 29 3a 28 6c 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6b 2c 6c 29 29 3a 6c 3d 22 70 5f 22 2b 6b 3b 76 61 72 20 6d 3d 67 5b 30 5d 5b 6c 5d 3b 69 66 28 6d 26 26 48 28 67 5b 30 5d 2c 6c 29 29 66 6f 72 28 67 3d 30 3b 67 3c 6d 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 7b 76 61 72 20 71 3d 6d 5b 67 5d 3b 69 66 28 6b 21 3d 3d 6b 26 26 71 2e 6b 65 79 21 3d 3d 71 2e 6b 65 79 7c 7c 6b 3d 3d 3d 71 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 Data Ascii: otype.entries;var d=function(g,k){var l=k&&typeof k;l=="object"\|\|l=="function"?b.has(k)?l=b.get(k):(l=""+ ++h,b.set(k,l)):l="p_"+k;var m=g[0][l];if(m&&H(g[0],l))for(g=0;g<m.length;g++){var q=m[g];if(k!==k&&q.key!==q.key\|\|k===q.key)return{id:l,list:m,index
2024-07-04 18:35:02 UTC	1951	IN	Data Raw: 72 20 68 3d 30 3b 21 28 66 3d 62 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 66 2e 76 61 6c 75 65 2c 68 2b 2b 29 29 7d 65 6c 73 65 20 66 6f 72 28 66 3d 62 2e 6c 65 6e 67 74 68 2c 68 3d 30 3b 68 3c 66 3b 68 2b 2b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 62 5b 68 5d 2c 68 29 29 3b 72 65 74 75 72 6e 20 65 7d 7d 29 3b 76 61 72 20 5a 61 3d 5a 61 7c 7c 7b 7d 2c 72 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 61 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 24 61 28 22 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 2e 6f 78 4e 33 6e 62 22 29 3b 61 3d 63 26 26 63 5b 61 5d 3b 72 65 74 75 72 6e 20 61 21 3d 6e 75 6c 6c 3f 61 3a 62 7d 2c 49 3d 72 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 24 61 Data Ascii: r h=0;!(f=b.next()).done;)e.push(c.call(d,f.value,h++))}else for(f=b.length,h=0;h<f;h++)e.push(c.call(d,b[h],h));return e}});var Za=Za\|\|{},r=this\|\|self,ab=function(a,b){var c=$a("WIZ_global_data.oxN3nb");a=c&&c[a];return a!=null?a:b},I=r._F_toggles\|\|[],$a
2024-07-04 18:35:02 UTC	1951	IN	Data Raw: 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 3f 61 2e 73 70 6c 69 74 28 22 22 29 3a 61 2c 66 3d 30 3b 66 3c 64 3b 66 2b 2b 29 66 20 69 6e 20 65 26 26 62 2e 63 61 6c 6c 28 63 2c 65 5b 66 5d 2c 66 2c 61 29 7d 3b 76 61 72 20 63 61 3d 22 63 6f 6e 73 74 72 75 63 74 6f 72 20 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 20 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 20 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 20 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 20 74 6f 53 74 72 69 6e 67 20 76 61 6c 75 65 4f 66 22 2e 73 70 6c 69 74 28 22 20 22 29 3b 76 61 72 20 6a 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 72 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f Data Ascii: peof a==="string"?a.split(""):a,f=0;f<d;f++)f in e&&b.call(c,e[f],f,a)};var ca="constructor hasOwnProperty isPrototypeOf propertyIsEnumerable toLocaleString toString valueOf".split(" ");var jb=function(a,b,c){c=c\|\|r;var d=c.onerror,e=!!b;c.onerror=functio
2024-07-04 18:35:02 UTC	1951	IN	Data Raw: 65 6e 74 73 2c 65 3d 30 3b 64 26 26 65 3c 64 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 65 3e 30 26 26 63 2e 70 75 73 68 28 22 2c 20 22 29 3b 76 61 72 20 66 3d 64 5b 65 5d 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 66 29 7b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 66 3d 66 3f 22 6f 62 6a 65 63 74 22 3a 22 6e 75 6c 6c 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 73 74 72 69 6e 67 22 3a 62 72 65 61 6b 3b 63 61 73 65 20 22 6e 75 6d 62 65 72 22 3a 66 3d 53 74 72 69 6e 67 28 66 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 66 3d 66 3f 22 74 72 75 65 22 3a 22 66 61 6c 73 65 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 66 3d 28 66 3d 6c 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c Data Ascii: ents,e=0;d&&e<d.length;e++){e>0&&c.push(", ");var f=d[e];switch(typeof f){case "object":f=f?"object":"null";break;case "string":break;case "number":f=String(f);break;case "boolean":f=f?"true":"false";break;case "function":f=(f=lb(f))?f:"[fn]";break;defaul

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49744	142.250.185.238	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:03 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 18:35:03 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:35:03 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49743	142.250.185.238	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:03 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 18:35:03 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:35:03 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49749	142.250.185.238	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:04 UTC	1112	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 522 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 18:35:04 UTC	522	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 30 31 31 38 31 30 31 39 36 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1720118101965",null,null,null
2024-07-04 18:35:04 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=515=sqa-q49fln2MWIFiP8NiFTk4TD__q979zO9VhtcnYIWv5koTwIb1IwINTWJynda-f50sbGKGENMNSE66cOgp404Jx-RZ9KbMkwavTOTDdObAorpNENBFTFxYkNL2NNRc3_rSVuh3nxIF_HNXv6F37IQs9LsRaJtJl5bFBX9yQfs; expires=Fri, 03-Jan-2025 18:35:04 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:35:04 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 04 Jul 2024 18:35:04 GMT Connection: close Transfer-Encoding: chunked
2024-07-04 18:35:04 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-04 18:35:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49750	142.250.185.238	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:04 UTC	1112	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 522 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 18:35:04 UTC	522	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 30 31 31 38 31 30 32 30 34 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1720118102046",null,null,null
2024-07-04 18:35:04 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=515=YobLsI1MOFaaDYrrYufgYj5r0J6p-BD456iKrsY_TLlr7TxcJuRccSbEolIdWocqVL6dWbu54RxyR5IAT_9xWUfsmQWKH1e5F3x-JLslaVIE1CBvWu0SNoZ0HiA72SFQ_G_T9rdbJlWQZhZB97MHZSDZDjWQbS1gDGbkmZCJ7To; expires=Fri, 03-Jan-2025 18:35:04 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:35:04 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 04 Jul 2024 18:35:04 GMT Connection: close Transfer-Encoding: chunked
2024-07-04 18:35:04 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-04 18:35:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49721	142.250.186.68	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:04 UTC	1194	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=515=YobLsI1MOFaaDYrrYufgYj5r0J6p-BD456iKrsY_TLlr7TxcJuRccSbEolIdWocqVL6dWbu54RxyR5IAT_9xWUfsmQWKH1e5F3x-JLslaVIE1CBvWu0SNoZ0HiA72SFQ_G_T9rdbJlWQZhZB97MHZSDZDjWQbS1gDGbkmZCJ7To
2024-07-04 18:35:04 UTC	706	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 04 Jul 2024 14:54:00 GMT Expires: Fri, 12 Jul 2024 14:54:00 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 13264 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-04 18:35:04 UTC	684	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-07-04 18:35:04 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<
2024-07-04 18:35:04 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-07-04 18:35:04 UTC	1390	IN	Data Raw: 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBF!4I
2024-07-04 18:35:04 UTC	576	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49756	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 56 31 37 47 4c 75 54 34 6d 30 4f 54 4b 70 58 42 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 30 66 35 64 37 64 63 64 62 63 62 64 36 30 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: V17GLuT4m0OTKpXB.1Context: 50f5d7dcdbcbd60d
2024-07-04 18:35:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 18:35:07 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 56 31 37 47 4c 75 54 34 6d 30 4f 54 4b 70 58 42 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 30 66 35 64 37 64 63 64 62 63 62 64 36 30 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 76 43 75 4a 6f 77 43 6d 6d 47 69 64 74 78 57 76 4d 30 74 6e 42 66 55 4c 73 75 39 72 4d 2b 64 48 63 43 36 6e 4a 64 5a 68 75 76 56 58 67 4a 52 63 4b 54 53 72 73 70 36 30 78 51 43 32 59 4d 57 55 56 68 56 6b 35 42 6f 2b 63 58 54 78 4b 4c 79 59 4d 6a 6f 6b 33 45 67 4d 51 39 51 54 4a 41 64 58 57 54 65 67 63 71 67 73 58 47 61 71 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: V17GLuT4m0OTKpXB.2Context: 50f5d7dcdbcbd60d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWvCuJowCmmGidtxWvM0tnBfULsu9rM+dHcC6nJdZhuvVXgJRcKTSrsp60xQC2YMWUVhVk5Bo+cXTxKLyYMjok3EgMQ9QTJAdXWTegcqgsXGaq
2024-07-04 18:35:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 56 31 37 47 4c 75 54 34 6d 30 4f 54 4b 70 58 42 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 30 66 35 64 37 64 63 64 62 63 62 64 36 30 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: V17GLuT4m0OTKpXB.3Context: 50f5d7dcdbcbd60d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-04 18:35:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 18:35:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 59 78 2b 57 2b 49 30 37 6b 75 57 6e 46 43 4a 4c 45 2f 37 49 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: kYx+W+I07kuWnFCJLE/7Iw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49758	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:10 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=a+mBd8HZOS6O9l4&MD=cuxxAeMC HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-04 18:35:11 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ed5a07e5-95db-4504-81e9-9fe09de3437c MS-RequestId: b757c872-4189-474d-b9b2-57b5646a0b2e MS-CV: xb/9cHgy5kKkXCQO.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 04 Jul 2024 18:35:10 GMT Connection: close Content-Length: 24490
2024-07-04 18:35:11 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-04 18:35:11 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49759	142.250.185.238	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:11 UTC	1278	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 929 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=515=YobLsI1MOFaaDYrrYufgYj5r0J6p-BD456iKrsY_TLlr7TxcJuRccSbEolIdWocqVL6dWbu54RxyR5IAT_9xWUfsmQWKH1e5F3x-JLslaVIE1CBvWu0SNoZ0HiA72SFQ_G_T9rdbJlWQZhZB97MHZSDZDjWQbS1gDGbkmZCJ7To
2024-07-04 18:35:11 UTC	929	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 32 30 31 31 38 30 39 39 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[4,0,0,0,0]]],558,[["1720118099000",null,null,null,
2024-07-04 18:35:11 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=515=kbTd-hubtish7zQUYvollTwbfhxJyxsSmPE7gLqTK7EYkucw4HJ9IUVc5D98X91XXmZFEZzKTqVF_Z1gFreTgVNyA8FY9Igv0Zn_DyvpqhSwf4-Pr0EVeADZooKzOLzeMmMrMiUUurkug4yltbTVH8x2d-W8y6xBpOiJhQ9pQdc; expires=Fri, 03-Jan-2025 18:35:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:35:11 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 04 Jul 2024 18:35:11 GMT Connection: close Transfer-Encoding: chunked
2024-07-04 18:35:11 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-04 18:35:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49764	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:20 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2f 57 49 42 75 56 4f 54 37 30 6d 42 79 66 54 6b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 63 37 36 32 66 65 31 64 31 61 36 38 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: /WIBuVOT70mByfTk.1Context: 2f8c762fe1d1a68d
2024-07-04 18:35:20 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 18:35:20 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 2f 57 49 42 75 56 4f 54 37 30 6d 42 79 66 54 6b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 63 37 36 32 66 65 31 64 31 61 36 38 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 76 43 75 4a 6f 77 43 6d 6d 47 69 64 74 78 57 76 4d 30 74 6e 42 66 55 4c 73 75 39 72 4d 2b 64 48 63 43 36 6e 4a 64 5a 68 75 76 56 58 67 4a 52 63 4b 54 53 72 73 70 36 30 78 51 43 32 59 4d 57 55 56 68 56 6b 35 42 6f 2b 63 58 54 78 4b 4c 79 59 4d 6a 6f 6b 33 45 67 4d 51 39 51 54 4a 41 64 58 57 54 65 67 63 71 67 73 58 47 61 71 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: /WIBuVOT70mByfTk.2Context: 2f8c762fe1d1a68d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWvCuJowCmmGidtxWvM0tnBfULsu9rM+dHcC6nJdZhuvVXgJRcKTSrsp60xQC2YMWUVhVk5Bo+cXTxKLyYMjok3EgMQ9QTJAdXWTegcqgsXGaq
2024-07-04 18:35:20 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2f 57 49 42 75 56 4f 54 37 30 6d 42 79 66 54 6b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 63 37 36 32 66 65 31 64 31 61 36 38 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: /WIBuVOT70mByfTk.3Context: 2f8c762fe1d1a68d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-04 18:35:20 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 18:35:20 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 4e 50 79 47 65 53 4b 70 55 65 77 71 50 5a 75 45 6f 76 44 31 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: XNPyGeSKpUewqPZuEovD1g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49765	142.250.185.238	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:33 UTC	1301	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 882 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=515=kbTd-hubtish7zQUYvollTwbfhxJyxsSmPE7gLqTK7EYkucw4HJ9IUVc5D98X91XXmZFEZzKTqVF_Z1gFreTgVNyA8FY9Igv0Zn_DyvpqhSwf4-Pr0EVeADZooKzOLzeMmMrMiUUurkug4yltbTVH8x2d-W8y6xBpOiJhQ9pQdc
2024-07-04 18:35:33 UTC	882	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 30 31 31 38 31 33 32 33 35 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1720118132355",null,null,null
2024-07-04 18:35:33 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:35:33 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-04 18:35:33 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-04 18:35:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49766	142.250.185.238	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:34 UTC	1302	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1078 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=515=kbTd-hubtish7zQUYvollTwbfhxJyxsSmPE7gLqTK7EYkucw4HJ9IUVc5D98X91XXmZFEZzKTqVF_Z1gFreTgVNyA8FY9Igv0Zn_DyvpqhSwf4-Pr0EVeADZooKzOLzeMmMrMiUUurkug4yltbTVH8x2d-W8y6xBpOiJhQ9pQdc
2024-07-04 18:35:34 UTC	1078	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 30 31 31 38 31 33 32 39 39 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1720118132996",null,null,null
2024-07-04 18:35:34 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:35:34 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-04 18:35:34 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-04 18:35:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49767	142.250.185.238	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:34 UTC	1278	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 842 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=515=kbTd-hubtish7zQUYvollTwbfhxJyxsSmPE7gLqTK7EYkucw4HJ9IUVc5D98X91XXmZFEZzKTqVF_Z1gFreTgVNyA8FY9Igv0Zn_DyvpqhSwf4-Pr0EVeADZooKzOLzeMmMrMiUUurkug4yltbTVH8x2d-W8y6xBpOiJhQ9pQdc
2024-07-04 18:35:34 UTC	842	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 30 36 32 33 2e 30 37 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 34 2c 30 2c 30 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_identityfrontendauthuiserver_20240623.07_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[4,0,0
2024-07-04 18:35:34 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:35:34 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-04 18:35:34 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-04 18:35:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49768	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 65 34 36 42 77 52 50 79 39 55 71 47 53 4a 49 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 61 31 38 65 35 36 61 33 64 62 37 37 32 62 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: e46BwRPy9UqGSJI1.1Context: aa18e56a3db772b5
2024-07-04 18:35:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 18:35:39 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 65 34 36 42 77 52 50 79 39 55 71 47 53 4a 49 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 61 31 38 65 35 36 61 33 64 62 37 37 32 62 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 76 43 75 4a 6f 77 43 6d 6d 47 69 64 74 78 57 76 4d 30 74 6e 42 66 55 4c 73 75 39 72 4d 2b 64 48 63 43 36 6e 4a 64 5a 68 75 76 56 58 67 4a 52 63 4b 54 53 72 73 70 36 30 78 51 43 32 59 4d 57 55 56 68 56 6b 35 42 6f 2b 63 58 54 78 4b 4c 79 59 4d 6a 6f 6b 33 45 67 4d 51 39 51 54 4a 41 64 58 57 54 65 67 63 71 67 73 58 47 61 71 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: e46BwRPy9UqGSJI1.2Context: aa18e56a3db772b5<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWvCuJowCmmGidtxWvM0tnBfULsu9rM+dHcC6nJdZhuvVXgJRcKTSrsp60xQC2YMWUVhVk5Bo+cXTxKLyYMjok3EgMQ9QTJAdXWTegcqgsXGaq
2024-07-04 18:35:39 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 65 34 36 42 77 52 50 79 39 55 71 47 53 4a 49 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 61 31 38 65 35 36 61 33 64 62 37 37 32 62 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: e46BwRPy9UqGSJI1.3Context: aa18e56a3db772b5<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-04 18:35:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 18:35:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 78 54 33 71 55 32 4e 6a 43 45 69 4e 61 4b 65 4a 79 6d 4b 6c 63 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: xT3qU2NjCEiNaKeJymKlcQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49769	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:35:48 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=a+mBd8HZOS6O9l4&MD=cuxxAeMC HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-04 18:35:48 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 0a743b55-3bcb-4dd1-bc5f-a92795187f3c MS-RequestId: 7fad0a92-ea26-47af-ac8f-ae4bcc5d029b MS-CV: cJdLoniobEya1DsI.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 04 Jul 2024 18:35:48 GMT Connection: close Content-Length: 30005
2024-07-04 18:35:48 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-04 18:35:48 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49773	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:36:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 53 71 71 42 69 56 42 41 30 75 51 39 43 53 75 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 36 61 66 38 31 38 62 39 37 65 35 34 35 39 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: tSqqBiVBA0uQ9CSu.1Context: 46af818b97e54595
2024-07-04 18:36:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 18:36:04 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 74 53 71 71 42 69 56 42 41 30 75 51 39 43 53 75 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 36 61 66 38 31 38 62 39 37 65 35 34 35 39 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 76 43 75 4a 6f 77 43 6d 6d 47 69 64 74 78 57 76 4d 30 74 6e 42 66 55 4c 73 75 39 72 4d 2b 64 48 63 43 36 6e 4a 64 5a 68 75 76 56 58 67 4a 52 63 4b 54 53 72 73 70 36 30 78 51 43 32 59 4d 57 55 56 68 56 6b 35 42 6f 2b 63 58 54 78 4b 4c 79 59 4d 6a 6f 6b 33 45 67 4d 51 39 51 54 4a 41 64 58 57 54 65 67 63 71 67 73 58 47 61 71 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: tSqqBiVBA0uQ9CSu.2Context: 46af818b97e54595<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWvCuJowCmmGidtxWvM0tnBfULsu9rM+dHcC6nJdZhuvVXgJRcKTSrsp60xQC2YMWUVhVk5Bo+cXTxKLyYMjok3EgMQ9QTJAdXWTegcqgsXGaq
2024-07-04 18:36:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 74 53 71 71 42 69 56 42 41 30 75 51 39 43 53 75 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 36 61 66 38 31 38 62 39 37 65 35 34 35 39 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: tSqqBiVBA0uQ9CSu.3Context: 46af818b97e54595<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-04 18:36:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 18:36:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 37 2b 64 41 50 4a 4a 51 55 4b 4a 2f 66 69 78 63 68 6a 46 4d 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 97+dAPJJQUKJ/fixchjFMA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49774	142.250.185.174	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:36:05 UTC	1301	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 845 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=515=kbTd-hubtish7zQUYvollTwbfhxJyxsSmPE7gLqTK7EYkucw4HJ9IUVc5D98X91XXmZFEZzKTqVF_Z1gFreTgVNyA8FY9Igv0Zn_DyvpqhSwf4-Pr0EVeADZooKzOLzeMmMrMiUUurkug4yltbTVH8x2d-W8y6xBpOiJhQ9pQdc
2024-07-04 18:36:05 UTC	845	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 30 31 31 38 31 36 34 33 30 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1720118164301",null,null,null
2024-07-04 18:36:05 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:36:05 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-04 18:36:05 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-04 18:36:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49775	142.250.185.174	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:36:06 UTC	1301	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 765 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=515=kbTd-hubtish7zQUYvollTwbfhxJyxsSmPE7gLqTK7EYkucw4HJ9IUVc5D98X91XXmZFEZzKTqVF_Z1gFreTgVNyA8FY9Igv0Zn_DyvpqhSwf4-Pr0EVeADZooKzOLzeMmMrMiUUurkug4yltbTVH8x2d-W8y6xBpOiJhQ9pQdc
2024-07-04 18:36:06 UTC	765	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 30 31 31 38 31 36 34 39 32 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1720118164927",null,null,null
2024-07-04 18:36:06 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:36:06 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-04 18:36:06 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-04 18:36:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49778	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:36:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 32 2f 56 77 37 68 69 30 45 79 6b 31 69 68 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 66 31 66 33 35 33 31 30 61 66 31 61 35 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 92/Vw7hi0Eyk1ihr.1Context: 57f1f35310af1a59
2024-07-04 18:36:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 18:36:30 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 39 32 2f 56 77 37 68 69 30 45 79 6b 31 69 68 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 66 31 66 33 35 33 31 30 61 66 31 61 35 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 76 43 75 4a 6f 77 43 6d 6d 47 69 64 74 78 57 76 4d 30 74 6e 42 66 55 4c 73 75 39 72 4d 2b 64 48 63 43 36 6e 4a 64 5a 68 75 76 56 58 67 4a 52 63 4b 54 53 72 73 70 36 30 78 51 43 32 59 4d 57 55 56 68 56 6b 35 42 6f 2b 63 58 54 78 4b 4c 79 59 4d 6a 6f 6b 33 45 67 4d 51 39 51 54 4a 41 64 58 57 54 65 67 63 71 67 73 58 47 61 71 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 92/Vw7hi0Eyk1ihr.2Context: 57f1f35310af1a59<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWvCuJowCmmGidtxWvM0tnBfULsu9rM+dHcC6nJdZhuvVXgJRcKTSrsp60xQC2YMWUVhVk5Bo+cXTxKLyYMjok3EgMQ9QTJAdXWTegcqgsXGaq
2024-07-04 18:36:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 39 32 2f 56 77 37 68 69 30 45 79 6b 31 69 68 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 66 31 66 33 35 33 31 30 61 66 31 61 35 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 92/Vw7hi0Eyk1ihr.3Context: 57f1f35310af1a59<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-04 18:36:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 18:36:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 67 6a 76 63 74 56 70 2b 45 65 46 6d 6a 70 4e 67 56 4f 74 7a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tgjvctVp+EeFmjpNgVOtzQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49779	142.250.185.174	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:36:38 UTC	1302	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1189 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=515=kbTd-hubtish7zQUYvollTwbfhxJyxsSmPE7gLqTK7EYkucw4HJ9IUVc5D98X91XXmZFEZzKTqVF_Z1gFreTgVNyA8FY9Igv0Zn_DyvpqhSwf4-Pr0EVeADZooKzOLzeMmMrMiUUurkug4yltbTVH8x2d-W8y6xBpOiJhQ9pQdc
2024-07-04 18:36:38 UTC	1189	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 30 31 31 38 31 39 36 39 37 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1720118196973",null,null,null
2024-07-04 18:36:38 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:36:38 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-04 18:36:38 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-04 18:36:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49780	142.250.185.174	443	1756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 18:36:40 UTC	1302	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1066 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=515=kbTd-hubtish7zQUYvollTwbfhxJyxsSmPE7gLqTK7EYkucw4HJ9IUVc5D98X91XXmZFEZzKTqVF_Z1gFreTgVNyA8FY9Igv0Zn_DyvpqhSwf4-Pr0EVeADZooKzOLzeMmMrMiUUurkug4yltbTVH8x2d-W8y6xBpOiJhQ9pQdc
2024-07-04 18:36:40 UTC	1066	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 30 31 31 38 31 39 38 38 30 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1720118198801",null,null,null
2024-07-04 18:36:40 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 04 Jul 2024 18:36:40 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-04 18:36:40 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-04 18:36:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:34:50
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc0000
File size:	1'166'336 bytes
MD5 hash:	619F9806AB2FAD61F931922DD30EDE7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	14:34:51
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	14:34:51
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2020,i,1018589847313137636,1605898340956988895,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	14:35:02
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4476 --field-trial-handle=2020,i,1018589847313137636,1605898340956988895,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	14:35:02
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=2020,i,1018589847313137636,1605898340956988895,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true