Edit tour

Windows Analysis Report
https://gop-win.co/k3I0yr

Overview

General Information

Sample URL:	https://gop-win.co/k3I0yr
Analysis ID:	1540236
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6812 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,12194626097471155259,2016964568004695182,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gop-win.co/k3I0yr" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13

Source: global traffic	HTTP traffic detected: GET /k3I0yr HTTP/1.1Host: gop-win.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xrEGEK5HvhS+lcb&MD=BpA6rrL6 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=go&oit=1&cp=2&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop.&oit=1&cp=4&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop&oit=1&cp=3&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win&oit=1&cp=7&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win.com&oit=3&cp=11&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win.co&oit=3&cp=10&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: gop-win.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: gop-win.coConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xrEGEK5HvhS+lcb&MD=BpA6rrL6 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAb5G6NOO6clpDSRroKoZlJIHWd19ow0GV0DhcMtQSvsqXeExJtZ5JiwiI55yIDVq6WT1Zb8HnEtk99/LtfJHDbqZVgeBwx3Z1z6ch5c/4Fy2VCpewCQLKcViiqHxskR5Qq9NL9MkON2h0DORsC9Pe/H%2BRNfTSiqJDN9ncl%2B9RnIM2zIZHVcOy/mMUJJZ2ZGDLzek73F9ENxO6Rd794UhgTEV9P72mH%2BhzZ2IrfNmWBdNCf66M5YYhPZPZgtHyGErWTW5SrakD5/aO5%2BcPq2oZ2HX6eOMnWq4Un3qCEzq5nvxYrxmSh6j4C4BHc7IvInrA7%2Bxgu4KkjQYKIyO96Trvl8QZgAAELdrLep4nrTbUzNFC7dWScWwARWbv24pJH9dlPm2iiwtPnQHQ0iP7Wa4akZC6eCUePS0kYaP3LpeUYnk1f1YSJYX8T8nxQVrarEPBnjW%2BsDYWM0zf08q54MDcMICIpKRz%2Bvl/ZGs5%2BPJ%2BQjJKW/wn%2BuSk7%2B5TvD%2BAbzEwTrpcKIPCNB5Cd7bdp0hd%2B4NKOAvOrElyuw0X0volWP1SC6pIeYU3JTtQEhXJndyIK5Z4KrE6cUMMu69QyoNA1tAB9vg9TCcH%2B9f9iJyJ03A7QEdTO2g50MXjWy8jeoqMvbBNDfh4LFSGivxosMCvlavClVkXVmWGX48Q84nuDwvv2KoXQKDLAmYbSe0O10BpGqxWjpqa6pEMF4eL09JwEe/fsFO%2Buam6ZVi9jLeqivl4s95ZfU7%2Bsyp75lSw8fILFjTPkhWTemqdMibnaTAgB9wQOJtD3AHbIc0wSawT/T7NOtGaOLexkQKCYxxU17Cos6jItEs9eiZmAR13JBbzD7PE7IxLmE/CQcvTQtK07ui3IE%2B/5E7bsbB/xCdKjNYatIA0o7FzFGjKGuyu19kc9WQH3ZONcfvJDGbD%2B3gx0fEr64BKCN2OdoB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1729690663User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 9CB8EE4BF29C4B00A5ECADD9B0898727X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: gop-win.coConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: gop-win.co
Source: global traffic	DNS traffic detected: DNS query: not-found.domain
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: chromecache_146.1.dr	String found in binary or memory: http://gop.com
Source: chromecache_146.1.dr	String found in binary or memory: http://gop.com/2024gotv
Source: chromecache_146.1.dr	String found in binary or memory: http://gop.gov
Source: chromecache_147.1.dr, chromecache_154.1.dr, chromecache_148.1.dr	String found in binary or memory: http://gopwin.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.135:443 -> 192.168.2.17:49737 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@32/26@36/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,12194626097471155259,2016964568004695182,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gop-win.co/k3I0yr"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,12194626097471155259,2016964568004695182,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
google.com	142.250.74.206	true	false	unknown
www.google.com	142.250.186.100	true	false	unknown
gop-win.co	3.33.253.57	true	false	unknown
not-found.domain	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win&oit=1&cp=7&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop&oit=1&cp=3&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win.co&oit=3&cp=10&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=go&oit=1&cp=2&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://gop-win.co/	false	unknown
http://gop-win.co/	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop.&oit=1&cp=4&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://gop-win.co/k3I0yr	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win.com&oit=3&cp=11&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://gop.gov	chromecache_146.1.dr	false	unknown
http://gopwin.com	chromecache_147.1.dr, chromecache_154.1.dr, chromecache_148.1.dr	false	unknown
http://gop.com	chromecache_146.1.dr	false	unknown
http://gop.com/2024gotv	chromecache_146.1.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.33.253.57	gop-win.co	United States	8987	AMAZONEXPANSIONGB	false
13.248.192.114	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540236
Start date and time:	2024-10-23 15:36:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://gop-win.co/k3I0yr
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@32/26@36/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.99, 142.250.186.46, 142.251.168.84, 34.104.35.123, 192.229.221.95, 217.20.57.18, 142.250.185.206, 142.250.185.195, 199.232.214.172, 142.250.185.238
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, encrypted-tbn0.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, evoke-windowsservices-tas.msedge.net, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: https://gop-win.co/k3I0yr

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 12:36:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.98145006357711
Encrypted:	false
SSDEEP:	48:8MgV+dTTk7pLH3idAKZdA1JehwiZUklqehNy+3:8MgVOARqy
MD5:	0A44656B7E0D0C8597A53D0C1B53F0CD
SHA1:	FA05400BA39D761BEFE10B8AE98F119A0BADE1B1
SHA-256:	EFFE5C5213B632ACB6B8B1950E4C5C46A8B69F849AD75DDBE4908DC13E30906C
SHA-512:	86AE0920C2FCE60B5830469714E2CCD9A49E2688E27BEE3A63195843F77B500D0D1B80943FD0650480732027B873DDBE305C7C7AD1DCDB5BD47752A66323B2A1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......P%......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IWY.l....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWY.l....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VWY.l....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VWY.l...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VWY.l...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 12:36:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9972973416469633
Encrypted:	false
SSDEEP:	48:84V+dTTk7pLH3idAKZdA10eh/iZUkAQkqehay+2:84VOAT9QDy
MD5:	4EFB0FD6DE0500A7AC5791C31D73FF31
SHA1:	F5B4A9D252062DAB68BA1D999FCDA5469C87E2B0
SHA-256:	57083EAB89322016AC393A748A2CD5B537C60FE2E9AA6C6F09EB52444A39199B
SHA-512:	8C8B57D3CE86335A66834485E1F14396FDC3DA3AB219F5FA72C6ACC493C3E496F3D148F8B4B47EF7A0B7017A937E4BCFE9387AD0DB80C4E44B33546A05CE24C8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....g..P%......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IWY.l....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWY.l....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VWY.l....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VWY.l...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VWY.l...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.01043466540974
Encrypted:	false
SSDEEP:	48:8eV+dTTk7pjH3idAKZdA14tIeh7sFiZUkmgqeh7sQy+BX:8eVOALnuy
MD5:	DBABA5779A17C2432A247BEDB28B2C13
SHA1:	48B2FA739E0B06E702285D7A5ED691B25B97DB5B
SHA-256:	40B1904202FE73198FC7CB521DCB2DC8B0B3A185B98813D5B68367AAB2E53D58
SHA-512:	D0F5B0873180C5EE9FD7420C12100EDA03C956513687DD22E3F792E3029B7910F515E0DACCEF03CB8066321F104FA867C772622B44505EEC3CAE663BFDE95567
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IWY.l....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWY.l....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VWY.l....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VWY.l...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 12:36:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.997522820260496
Encrypted:	false
SSDEEP:	48:8QV+dTTk7pLH3idAKZdA1behDiZUkwqehWy+R:8QVOAAYy
MD5:	C32CFC577D6CD3CB87B4C52AC63B3F92
SHA1:	00B7A52DF65F96A5108A28F38AD702DED43609B3
SHA-256:	B2E579E26F7E443F2A0135DC960F770BBAF1BD627E84711801711C6EB61302D9
SHA-512:	8C94DE82996A4631B2C32CE30C521D51B4E815A45C1C00139E55378E130516A5944A4D29DCDD89E78A3920C7849163B4325E438B28ED4A3BDBD080C6D8DE1613
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........P%......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IWY.l....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWY.l....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VWY.l....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VWY.l...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VWY.l...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 12:36:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9855639346665486
Encrypted:	false
SSDEEP:	48:8AgV+dTTk7pLH3idAKZdA1VehBiZUk1W1qehky+C:8AgVOAA9Ey
MD5:	28F10CDFDA6E4C8E599621264133D535
SHA1:	29BCE57C049F94F7650356FC0F59A22D37057518
SHA-256:	9DE2DFCC6494C19D4033D290CDC47142461ACE7996121943331041F9C5E73621
SHA-512:	3E8F2EC72B5E569FA7B71C69E26DDC24BAB7CCC27EB30B7D5A0334B23765F46862A60FADA3B5FF74821ED0B2EA0141AA468709A33027EAF70097BE694EF96E0E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Z...P%......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IWY.l....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWY.l....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VWY.l....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VWY.l...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VWY.l...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 12:36:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9962779329270175
Encrypted:	false
SSDEEP:	48:8iV+dTTk7pLH3idAKZdA1duT6ehOuTbbiZUk5OjqehOuTbuy+yT+:8iVOAqTTTbxWOvTbuy7T
MD5:	74B4BC352408CCF461A402B3A58ED28F
SHA1:	621A56C717AA1EB1B0492AFB50C6A37EF5F02CEE
SHA-256:	917137625A19819D147BA74645EC57B52FC117A72D5941B7894E5DE2DA79C466
SHA-512:	4DE3D837BB0799ADA0C13EA541C6B9288EC381AACE7888EFAFA1B8F882E879873CEA6A37768B152E8E9BAAEB3F719D2C1DC9E182F73653B129EAF0F9F8F9B814
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....bv.P%......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IWY.l....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWY.l....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VWY.l....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VWY.l...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VWY.l...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (573)
Category:	downloaded
Size (bytes):	578
Entropy (8bit):	5.036325418523739
Encrypted:	false
SSDEEP:	12:ukXIih/bMGl4GtwBHslriFuZsgFFVVdwuwJZw4/ffffffUwzgO:FX3h/Y2TqBHslguZsgFF/mzcmffffff/
MD5:	91D594AD321018BEE38B2BB8B47FCA5F
SHA1:	FD453F069FD2487DBC9C0745ED1F629A7284D03D
SHA-256:	51C46856724A039D9BA1E87A93A823A16FAAB2777263BD45E2BC9968EC806B96
SHA-512:	1B2B37A07C113C2172A0ED6301CA4368BA32F341738FC9C8401873F5B95D2971C945DC1FF8667409F08BF76CFF234C5009FAE2DB7F393F9D2E7D205B69CA67C3
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop.&oit=1&cp=4&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["gop.",["gop.platform","gop.com platform","gop.data center","gop.com phone number","gop.com store","gop.meaning","gopl.io","http://gop.com","http://gop.gov","http://gop.com/2024gotv"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,554,553,552,551,550,402,401,400],"google:suggestsubtypes":[[512],[512],[512],[512],[512],[512],[512,10],[44],[44],[44]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","NAVIGATION","NAVIGATION","NAVIGATION"],"google:verbatimrelevance":1136}]

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	237
Entropy (8bit):	4.870960303082342
Encrypted:	false
SSDEEP:	6:VwzRAw0V4YNnBHsLrYriFGHLLCwGRVfJJZwGdGD7wWeXFEL13:uEnBHsgriFu3CwuRJZw4m7wzC3
MD5:	51FA90933E1A36169D7E45028A5B1BD9
SHA1:	E4482EA5B6FCBEDD3851D4DDC35DC84EC68E3F07
SHA-256:	B75D063B8D34B27921F16BC76F86A526C4FEC9A17F068F933127D9FBCAAC305A
SHA-512:	3E63D66900A5D4E8F54C5CE9C441F45DAE456FDD3524B68E3EDB2C75F8E83E3ED135029874C0BC7C218B19847ADE0A3126AB99D8FFA380E8D7AC10F5E0B4CDF7
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win.com&oit=3&cp=11&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["gop-win.com",["http://gopwin.com"],[""],[],{"google:clientdata":{"bpc":false,"pre":0,"tlw":false},"google:suggestrelevance":[852],"google:suggestsubtypes":[[44]],"google:suggesttype":["NAVIGATION"],"google:verbatimrelevance":851}]

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	239
Entropy (8bit):	4.882899705418633
Encrypted:	false
SSDEEP:	6:Vwzcp0V4YNnBHsLrYriFGHLLCwGRVZ4JLwGdGD7wWeXFEL13:uQ2nBHsgriFu3Cwucw4m7wzC3
MD5:	FB0A76C98AC14101365BC89D0676C95B
SHA1:	208C25304DD470F046BA9C27E18D526A8D3C4448
SHA-256:	65C1750C6D444696D8FA35C42F24555C8B6EE2CE99412BE3BC884F23485F23CD
SHA-512:	33C62E676D59FF613B422C4BFFB6B9C99CA14BAAFD289F07AB9D6BF2D5F1C01AB845C55BF6B6ACBD8D55C88394D31A9E4DA717E9203F28115A869BD7097B791E
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win.co&oit=3&cp=10&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["gop-win.co",["http://gopwin.com"],[""],[],{"google:clientdata":{"bpc":false,"pre":0,"tlw":false},"google:suggestrelevance":[852],"google:suggestsubtypes":[[44,10]],"google:suggesttype":["NAVIGATION"],"google:verbatimrelevance":851}]

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	1722
Entropy (8bit):	7.652227667598845
Encrypted:	false
SSDEEP:	24:rQU0PgCrlzijBTFz+9TaY8V+kP/UNXGdc5h46RNsmeVCvpejoQG4DuCk4z7I:rsoCxOB+9TaYUUAdc3V4meVapiowkSM
MD5:	DC5FE2AB83F47ED938A60FC4DB00FBCB
SHA1:	1F242917F86E305072BBBD7B527F62F927A83F81
SHA-256:	DA2B7E8394810A86420D1BC298F401A91826A8A277B2EAF39A4FE6DAF64DE1D4
SHA-512:	8CA37A1444DBDFDCC5D08B12C883CD61AA7E68657D8B4C87D9BEDD0214DF367B525F9FED623BEBA48D4CC5A5B07106462F810F1458EA0E9468E623EBAC73C2D3
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRqk3q_bg2bz6cbsspSo91unDYhJk-tGWOSJ0t1UxznM40oxfJKOLaas_M&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@..".......................................2......................!....1A."Qa.2q..#B....$R....................................................!.1A..............?.,m#H..$.7.. ....2=4.5.........E.....?.^..EH...SF$..Z...}n....~.......R..C..H...7...{..I..s.......DM[]U.R@....4m{X.lG.O{[\....M.9VY......:..6....~f[.:.;...A:...Zv.YM</..{......{}t.l):..../..!X....8.N+.<9 c.T......{.&1<5.].v...;......./...U.......1.s..Rl,P..l..;k5QSE.F.T.\......*........pz..t...M.y..8++(....$P...V._...{.Q..1i..M....&.F..K!S.2(..q....]..juV.kcQ................o.k.....s^...F.(...o/_Lj.<.o..%...lJ..x....s.<..2{._1.OO...ke.Y..Y\|.......'......[l..m./"B.m4q.....f!.[..b.........e.1..2...lM./a..}+.R.;E,..1#.1R.d`........mC....,x.A\|...XM.A...7....6T.1.T#dVX^LI~.l_.1..4.&!.R.._@...t.<e.d.LA.qc.p}tI....`.{.3D.....X.$v.kC....T.7_..U. .2\|...]..

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1896)
Category:	downloaded
Size (bytes):	1901
Entropy (8bit):	5.89988296668135
Encrypted:	false
SSDEEP:	48:ZKQ4KlgNFSiKKN9kl9EMnWfW7WZWGXK9iD9km9HEaaXx0qu0l4FZbAmfjffVuV:EQjlXiKA9ffW7WewD9z9ZaXxXlAbZfj6
MD5:	00E0718A3744B974E228C12700221DD0
SHA1:	92EE0E9659D83DDAE209489B0E7AC29536E2DCFF
SHA-256:	1B22ED6634AF63A7147872B4B591153101BC816A0B1F71487092204F90230A5D
SHA-512:	877F5977E6ACAF15B61BB9EC9B6DAEBBAA9DB2E6D482BA6FD6E4A846926BD4492F1914506CC2015708A569AAEB7AA3FADCC46D0C9E0ECCFFE7F21B716D96D6B0
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop&oit=1&cp=3&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["gop",["gop","gopro","gopro","gopher","gopuff","gopher football","gopher sports","gop meaning","gopher football schedule","gopnik"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{},{"google:entityinfo":"CgovbS8waDFmZDMwEhJUZWNobm9sb2d5IGNvbXBhbnkyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1FNME9oYjJXSXZ5Q1QtRVZ1Q1UyaTdKbTVPRDVmalV5a243NHFpdk9NJnM9MTA6BUdvUHJvSgcjMDA3N2EzUjNnc19zc3A9ZUp6ajR0TFAxVGZJTUV4TE1UWlFZRFJnZEdEd1lrM1BMeWpLQndCRGpnWGVwFw\u003d\u003d"},{"google:entityinfo":"CgkvbS8wMjFjZHcSB1JvZGVudHMydGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1JxazNxX2JnMmJ6NmNic3NwU285MXVuRFloSmstdEdXT1NKMHQxVXh6bk00MG94ZkpLT0xhYXNfTSZzPTEwOgZHb3BoZXJKByM0MjQyNDJSLmdzX3NzcD1lSnpqNHRUUDFUY3dNa3hPS1RkZzlHSkx6eV9JU0MwQ0FEUjlCYllwDQ\u003d\u003d"},{"google:entityinfo":"Cg0vZy8xMWc5cWg4NmR6Eg5SZXRhaWwgY29tcGFueTJkaHR0cHM6Ly9lbmNyeXB0ZWQtdGJuMC5nc3RhdGljLmNvbS9pbWFnZXM/cT10Ym

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4153)
Category:	downloaded
Size (bytes):	4158
Entropy (8bit):	5.813763966374924
Encrypted:	false
SSDEEP:	96:B+kSliIgIN6666Vx7NPeA0wToXu/L0OHqJm3kfZGUfWyjF9WYZfffQfo:gDxN6666VzAu5mtkiJp97
MD5:	D2318E8BDC57DFCB7DC879B19CBCAA8C
SHA1:	D0B646148EDD9F236B1EE846F38BE315FBD60983
SHA-256:	63AD1F1D4A9D1370A4E2CD9909C5880E6DAFFD85BA4EADA9AFD9F7F3E6B1617B
SHA-512:	67C5906947483335CB1CF5A3B0F9D845488A83EA71B5E4F9B4B45F349214180224A49B3F4A2D29A331B44DD1C3F01292277DA81B19A633C7D2877D74F92A312C
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["trail of treats monopoly go rewards","interest rates mortgages","biltmore house hurricane helene","how much are epic universe tickets","nba tnt","spacex falcon 9 rocket launch","ambessa medarda champion abilities","shari restaurants"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgkvbS8wYmpsM2cSEkFtZXJpY2FuIGdhbWUgc2hvdzLfEmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWFBQUFDQXdFQkFBQUFBQUFBQUFBQUFBQUZCZ01FQndFQy84UUFOeEFBQVFNQ0JBTUZCQWtGQUFBQUFBQUFBUUlEQkFVUkFCSWhNUVlUUVNKUllYR1JNa0tCc1JRVkkx

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	561
Entropy (8bit):	7.331663666710978
Encrypted:	false
SSDEEP:	12:6v/7sA/lljlkRQdUOYXAwaRsqVPutl96C2/YXOTMOJAd:qBkRQX7wa6/MC2/DTY
MD5:	29E91CB6C6A69D6D2D3E900E32E63A41
SHA1:	FABCC35CEE7C5E1F28AD6DDBA43DF4288C1BA120
SHA-256:	72F58A9240862459AFE886D7FC0DF5C5D840A13514EDD11B0D8B08B996616637
SHA-512:	D923F9708C231E426410E33A10A3B581C330804A8A24910C258224B2719CEA252D294D95A66698028CD10D3CDDD89942BFF0DCE968F27AF31CB791C3FED91F58
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSTpGObfdRrqj18WNtO3Lwo7zDwdTpK50A2x91LwZw&s=10
Preview:	.PNG........IHDR...@...@............ZPLTE...............K.............................Y.....j..a.....A........y..!..5.................(....IDATX..S.n.0.3%......t...i.b1.[...(.#..s.......".I_..~.Fm.!z..o...T.k.@^.@R\N.f"...5.W..Q=I" .).....:a....VHJc....I....?..R.}U.0>.B..]...FbJ...W.tB%..4)..t..........u...10....JU.`....<....7.b....H....]s.Z}..O.V..9K.Vp..U....lY6Q.o.;..FZ.....s.s.X.Hce.!..$.....mN...T... ....[.#..(.sJ..r.....X9S.N@.U....q.(0.......c..U..?!.C..<..O.n...6...%..g8...i.5Mg[...~.[L...i.............._!....."....IEND.B`.

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	1357
Entropy (8bit):	7.5563338296055935
Encrypted:	false
SSDEEP:	24:rQUVRefn5hqauKY/bWkJ4wUi07TE6420dsAvUpNT81trcLvKB:rP45hqaubykJ4I07TJQdsAspv8
MD5:	BBA10358F1ABBFF4C50D8AC24AE76844
SHA1:	F3121A94E891B4D064ADF463D44CE514A2771B7F
SHA-256:	7A3C7B12A817661CEE224D1DF0D49E5343859F94510C89717C67DF3553CCBBEA
SHA-512:	5B161B7426D2731FA3E8CBE2D094E4317351B42B4D639C32111C2C6BA9A64C5A7BEC5C5E34AF8965161B287B4B44E370F3AA42769E353136135A6B1F6D5D6739
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcR8WijsIO9bvRIQGl1spcJfx4pXOE5A9zMVqYVcHpc&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@........................................../...........................!1A"aQRq...#Bb2r................................./......................!..1..AQaq......".2Rr..............?..l......J..*.4.B...6.8....(G.6n"..T.r.>u~[.o(s....9.....4....I....Q.U.@'n..~.w..P..a-.g.L.H.\...f<..:y.P.g....B...L4I..(....X.m...],...a.u.......8...[._il4Ez......v<R.......fd.^3.M.kk.Pw.le..#.$.u;....$.:..;[.5I..33g@..n.0.(.+..H%].:........b.t.J..ag].r3..].......13.Rh..+.?..K.]I,......N...$3`.........+....b...J..Zx'........y.>.2..".!.a.....!_.].Z.\|.........x...B...c..O.s$..L..I....?.o...^....xm...i.z....z...v.e..<.....UX...(}.\|..NCP..i..Z...........Dd.?L......K.GR...@.9...\|..@..`k.#...o.]x.....!.o....I9V.H.T.i...K......b.....x.t.].......=..V.w.hfg...3..Wd....}~......J.^..:..`C.y._O%...A#.4_...;H#.`..W.Ek..KJ

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (599)
Category:	downloaded
Size (bytes):	604
Entropy (8bit):	4.956884147824775
Encrypted:	false
SSDEEP:	12:urY7Ry6bqLLX67RF/+sBHsrriFuqPFVVSJLwu7Zw4/ffffffffUwzL:eMRy8iT6FF/hBHsrguqPF/5tmffffffx
MD5:	68BE6869DC2D351C71FEA344E1DB81AF
SHA1:	065ACBDF41CC92C30ACF35C7C09444BB11E2CF8D
SHA-256:	CDC9F8D4137ED3866F18A184407E381FADD36ABC87149DE943A592505A2ADBDA
SHA-512:	7F79A92C59D94411C6D7F014B5D257A62B8C34BCBA111B4EAC5BFA17877A267905FD2CDA601165D072DE4F7A7B768B7D20B57335A6B24B1027890296D5A3CE97
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win&oit=1&cp=7&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["gop-win",["gopwin","gop winner","gop winners and losers","windows gpo","gop winner take all primaries","gop winred","gop winner tonight","gop winner debate","gpo windows server","http://gopwin.com"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"phi":0,"pre":0,"tlw":false},"google:suggestrelevance":[1252,601,600,555,554,553,552,551,550,400],"google:suggestsubtypes":[[512,10],[30],[30],[30,10],[30],[30],[30],[30],[30,10],[44,10]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","NAVIGATION"],"google:verbatimrelevance":1251}]

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 23, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	525
Entropy (8bit):	7.181798322679032
Encrypted:	false
SSDEEP:	12:6v/7Aka6d3JH5h8XCfwLPrUecyQtSNe++mfEl6V8Idxval1:Pka6/ZuCIjMUNeuA6mt
MD5:	AE5EE79E552D12577EA9AEC851352E14
SHA1:	20B4CE0E55DB87395589FE1D6807D58A2247F075
SHA-256:	6F5D7D6A2C9DA284C086731D344C2718BECA316C45335ECE8FB8E867C2D67591
SHA-512:	3ED3C97C91F69B18265428EA8A2FF9CE82A6A62637BF9BFF79286CF6F23B5DB2EDED8CA827F4E16EFFD00F1AFFFD717FCCA0931C89BFC4F91E40E26B0E35435E
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQM0Ohb2WIvyCT-EVuCU2i7Jm5OD5fjUykn74qivOM&s=10
Preview:	.PNG........IHDR...@..........<......PLTE............,,,.Kg.Z\|....]................`....BBB.......(Jmmm....0YWWW..........aaa...KKKPPP.K.www......444....AY. +..&..:%%%....'5..-..e...>IDAT8...r.0.F..Z.!% ..E.?.}..k..m..uz..]6..6.........9...eW.PW.T.....K..I<..I[f..Jw.. 8.xha..G. Y..#hb.0.jJ.h...8.&H.{....o,.hJP.N...D..5.......A.....h...i.....7$~.v.x.C.....sA=4.e..w.74-<x...m.xG.h..V.j..P./\.,k.}Xl.....<...Z.u..0..Y....`.`.a..,.K+.'...Q.2&Rf.<g2h.{...L#.. Dil.....4..,\|...8V0.q.E.G...T.A.%......IEND.B`.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 15:36:53.272367954 CEST	49676	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:36:53.272367001 CEST	49677	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:36:53.272367954 CEST	49678	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:37:00.066679001 CEST	49701	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.066751003 CEST	443	49701	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.066900969 CEST	49701	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.067274094 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.067307949 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.067393064 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.067672968 CEST	49701	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.067702055 CEST	443	49701	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.068048954 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.068063974 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.854886055 CEST	443	49701	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.855431080 CEST	49701	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.855484009 CEST	443	49701	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.856581926 CEST	443	49701	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.856709003 CEST	49701	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.857697010 CEST	49701	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.857790947 CEST	443	49701	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.857891083 CEST	49701	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.857909918 CEST	443	49701	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.875148058 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.875494003 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.875556946 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.879184008 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.879329920 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.879621983 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.879801035 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.913278103 CEST	49701	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.929254055 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:00.929282904 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:00.977308989 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:01.025262117 CEST	443	49701	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:01.025444984 CEST	443	49701	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:01.025648117 CEST	49701	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:01.026155949 CEST	49701	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:01.026182890 CEST	443	49701	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:02.377304077 CEST	49703	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:02.377361059 CEST	443	49703	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:02.377456903 CEST	49703	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:02.377698898 CEST	49703	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:02.377715111 CEST	443	49703	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:03.240175009 CEST	443	49703	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:03.240617990 CEST	49703	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:03.240664959 CEST	443	49703	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:03.241717100 CEST	443	49703	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:03.241827965 CEST	49703	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:03.243128061 CEST	49703	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:03.243211985 CEST	443	49703	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:03.291362047 CEST	49703	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:03.291474104 CEST	443	49703	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:03.339369059 CEST	49703	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:03.556974888 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:03.557041883 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:03.557132006 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:03.559458017 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:03.559478045 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:04.674114943 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:04.674235106 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:04.677020073 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:04.677027941 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:04.677290916 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:04.731545925 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:04.741035938 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:04.787344933 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.116940022 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.116967916 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.116974115 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.117002010 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.117011070 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.117021084 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.117058039 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:05.117086887 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.117104053 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:05.117132902 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:05.198542118 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.198627949 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:05.198657990 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.198807001 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:05.198822021 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.198836088 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:05.198982954 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.199013948 CEST	443	49704	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:05.199059963 CEST	49704	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:11.880906105 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 23, 2024 15:37:12.183388948 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 23, 2024 15:37:12.788358927 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 23, 2024 15:37:13.252368927 CEST	443	49703	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:13.252444983 CEST	443	49703	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:13.252568960 CEST	49703	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:14.002290964 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 23, 2024 15:37:14.042074919 CEST	49710	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:14.042114973 CEST	443	49710	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:14.042196035 CEST	49710	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:14.043178082 CEST	49710	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:14.043196917 CEST	443	49710	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:14.291137934 CEST	49703	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:14.291230917 CEST	443	49703	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:14.888039112 CEST	443	49710	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:14.888163090 CEST	49710	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:14.891271114 CEST	49710	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:14.891288996 CEST	443	49710	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:14.891573906 CEST	443	49710	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:14.936564922 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:14.936655045 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:14.936763048 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:14.937215090 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:14.937247038 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:14.943310976 CEST	49710	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:14.955770016 CEST	49710	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:15.003333092 CEST	443	49710	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:15.198404074 CEST	443	49710	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:15.198499918 CEST	443	49710	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:15.198611021 CEST	49710	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:15.198767900 CEST	49710	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:15.198786020 CEST	443	49710	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:15.198796034 CEST	49710	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:15.198801041 CEST	443	49710	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:15.277256012 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:15.277355909 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:15.277482986 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:15.277782917 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:15.277817011 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:15.794888973 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:15.798311949 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:15.798393965 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:15.799545050 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:15.802054882 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:15.802196026 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:15.802222013 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:15.802268982 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:15.844356060 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:16.051825047 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 23, 2024 15:37:16.077356100 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:16.077431917 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:16.077469110 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:16.077517033 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:16.077554941 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:16.077610016 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:16.080882072 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:16.081140041 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:16.081224918 CEST	443	49711	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:16.081305027 CEST	49711	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:16.134095907 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:16.134251118 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:16.135688066 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:16.135704994 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:16.135915041 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:16.137204885 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:16.183326006 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:16.354491949 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 23, 2024 15:37:16.417321920 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 23, 2024 15:37:16.686202049 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:16.686268091 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:16.686351061 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:16.687125921 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:16.687174082 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:16.687206030 CEST	49712	443	192.168.2.17	184.28.90.27
Oct 23, 2024 15:37:16.687222004 CEST	443	49712	184.28.90.27	192.168.2.17
Oct 23, 2024 15:37:16.960477114 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 23, 2024 15:37:16.981292963 CEST	49713	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:16.981348038 CEST	443	49713	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:16.981439114 CEST	49713	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:16.981770992 CEST	49713	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:16.981795073 CEST	443	49713	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.089286089 CEST	49714	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.089355946 CEST	443	49714	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.089461088 CEST	49714	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.089828968 CEST	49714	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.089842081 CEST	443	49714	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.828053951 CEST	443	49713	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.828443050 CEST	49713	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.828489065 CEST	443	49713	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.829593897 CEST	443	49713	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.829683065 CEST	49713	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.830070972 CEST	49713	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.830137968 CEST	443	49713	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.830248117 CEST	49713	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.830271006 CEST	443	49713	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.839565992 CEST	49713	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.839632034 CEST	443	49713	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.839699030 CEST	49713	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.841144085 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.841197014 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.841337919 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.841655970 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.841682911 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.942806005 CEST	443	49714	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.943160057 CEST	49714	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.943193913 CEST	443	49714	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.943547010 CEST	443	49714	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.944009066 CEST	49714	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.944086075 CEST	443	49714	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:17.949402094 CEST	49714	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:17.995337009 CEST	443	49714	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:18.173301935 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 23, 2024 15:37:18.244009018 CEST	443	49714	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:18.285335064 CEST	49714	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:18.285358906 CEST	443	49714	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:18.286983013 CEST	49714	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:18.287203074 CEST	443	49714	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:18.287477970 CEST	49714	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:18.683427095 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:18.683918953 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:18.683948040 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:18.684813976 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:18.684926987 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:18.685297012 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:18.685353994 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:18.732362986 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:18.732378006 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:18.780334949 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:18.943764925 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:18.991332054 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:19.261203051 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:19.261260986 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:19.261338949 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:19.261373043 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:19.306379080 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:19.414855957 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:19.415117025 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:19.415184021 CEST	443	49715	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:19.415254116 CEST	49715	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:20.155802965 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:20.155900002 CEST	443	49720	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:20.156004906 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:20.156322956 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:20.156352997 CEST	443	49720	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:20.583398104 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 23, 2024 15:37:20.922271967 CEST	49721	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:20.922383070 CEST	443	49721	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:20.922503948 CEST	49721	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:20.922777891 CEST	49721	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:20.922816992 CEST	443	49721	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.032649040 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.032701015 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.032834053 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.033111095 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.033122063 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.091746092 CEST	443	49720	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.092215061 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.092250109 CEST	443	49720	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.093732119 CEST	443	49720	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.093832016 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.094185114 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.094264984 CEST	443	49720	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.094338894 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.094347954 CEST	443	49720	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.143402100 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.223414898 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 23, 2024 15:37:21.414693117 CEST	443	49720	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.463350058 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.463377953 CEST	443	49720	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.464443922 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.464541912 CEST	443	49720	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.464622021 CEST	49720	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.594640017 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.594693899 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.594786882 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.595098972 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.595114946 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.700599909 CEST	49724	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.700645924 CEST	443	49724	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.700751066 CEST	49724	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.700995922 CEST	49724	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.701014042 CEST	443	49724	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.814554930 CEST	443	49721	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.815192938 CEST	49721	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.815229893 CEST	443	49721	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.815653086 CEST	49725	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.815722942 CEST	443	49725	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.815810919 CEST	49725	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.816009998 CEST	49725	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.816029072 CEST	443	49725	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.816445112 CEST	443	49721	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.816826105 CEST	49721	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.816978931 CEST	49721	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.816983938 CEST	443	49721	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.817040920 CEST	443	49721	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.862370968 CEST	49721	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.896050930 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.896409035 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.896440029 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.897887945 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.897979021 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.898948908 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.899059057 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.942378044 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:21.942399979 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:21.990354061 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.109906912 CEST	443	49721	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.150408030 CEST	49721	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.150497913 CEST	443	49721	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.151493073 CEST	49721	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.151604891 CEST	443	49721	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.151683092 CEST	49721	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.297249079 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.339334965 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.477508068 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.477859974 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.477926970 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.479374886 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.479460001 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.481353045 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.481494904 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.532337904 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.532367945 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.559535027 CEST	443	49724	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.559870958 CEST	49724	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.559897900 CEST	443	49724	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.561028957 CEST	443	49724	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.561353922 CEST	49724	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.561528921 CEST	443	49724	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.576340914 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.580377102 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.611336946 CEST	49724	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.627351046 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.627382994 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.628654003 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.628762007 CEST	443	49722	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.628840923 CEST	49722	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.677525997 CEST	443	49725	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.677826881 CEST	49725	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.677858114 CEST	443	49725	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.681395054 CEST	443	49725	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.681493998 CEST	49725	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.681786060 CEST	49725	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.681930065 CEST	443	49725	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.737330914 CEST	49725	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.737358093 CEST	443	49725	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:22.784426928 CEST	49725	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:22.898587942 CEST	49726	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:22.898641109 CEST	443	49726	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:22.898715973 CEST	49726	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:22.898833036 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:22.899091959 CEST	49726	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:22.899111986 CEST	443	49726	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:22.939356089 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.331027031 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.331094980 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.331192970 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:23.331666946 CEST	49702	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:23.331691027 CEST	443	49702	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.404095888 CEST	49727	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:37:23.404206991 CEST	49728	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:37:23.409497023 CEST	80	49727	13.248.192.114	192.168.2.17
Oct 23, 2024 15:37:23.409569025 CEST	80	49728	13.248.192.114	192.168.2.17
Oct 23, 2024 15:37:23.409578085 CEST	49727	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:37:23.409637928 CEST	49728	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:37:23.543988943 CEST	443	49726	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.544373035 CEST	49726	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:23.544394016 CEST	443	49726	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.544878960 CEST	443	49726	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.545197964 CEST	49726	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:23.545279026 CEST	443	49726	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.545378923 CEST	49726	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:23.591325045 CEST	443	49726	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.708957911 CEST	443	49726	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.709052086 CEST	443	49726	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.709121943 CEST	49726	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:23.709599972 CEST	49726	443	192.168.2.17	3.33.253.57
Oct 23, 2024 15:37:23.709618092 CEST	443	49726	3.33.253.57	192.168.2.17
Oct 23, 2024 15:37:23.737581015 CEST	49727	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:37:23.743010998 CEST	80	49727	13.248.192.114	192.168.2.17
Oct 23, 2024 15:37:24.032633066 CEST	80	49727	13.248.192.114	192.168.2.17
Oct 23, 2024 15:37:24.086399078 CEST	49727	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:37:24.502593994 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 23, 2024 15:37:24.805439949 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 23, 2024 15:37:25.395437002 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 23, 2024 15:37:25.411386967 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 23, 2024 15:37:26.620414972 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 23, 2024 15:37:29.029443979 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 23, 2024 15:37:30.827524900 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 23, 2024 15:37:31.029952049 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:31.075346947 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:31.308577061 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:31.308634996 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:31.308670044 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:31.308686972 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:31.308715105 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:31.308763981 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:31.536729097 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:31.536976099 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:31.537087917 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:31.537348032 CEST	49723	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:31.537379026 CEST	443	49723	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:33.266752005 CEST	443	49724	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:33.266834974 CEST	443	49724	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:33.266864061 CEST	443	49725	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:33.266925097 CEST	49724	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:33.266938925 CEST	443	49725	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:33.267007113 CEST	49725	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:33.843415022 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 23, 2024 15:37:34.212564945 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:37:34.218733072 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 23, 2024 15:37:34.290029049 CEST	49724	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:34.290075064 CEST	443	49724	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:34.290081978 CEST	49725	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:37:34.290134907 CEST	443	49725	142.250.186.100	192.168.2.17
Oct 23, 2024 15:37:34.338066101 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 23, 2024 15:37:34.338363886 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:37:34.339694023 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:37:34.339694023 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:37:34.339778900 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:37:34.340020895 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:37:34.340085983 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:37:34.345216990 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 23, 2024 15:37:34.345274925 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 23, 2024 15:37:34.345434904 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 23, 2024 15:37:34.345491886 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 23, 2024 15:37:34.345525026 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 23, 2024 15:37:34.345698118 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 23, 2024 15:37:34.463357925 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 23, 2024 15:37:34.463470936 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:37:34.489057064 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 23, 2024 15:37:34.489202976 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 23, 2024 15:37:35.007383108 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 23, 2024 15:37:36.056344032 CEST	49729	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:36.062289953 CEST	53	49729	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:36.062467098 CEST	49729	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:36.062486887 CEST	49729	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:36.062486887 CEST	49729	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:36.068576097 CEST	53	49729	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:36.068711996 CEST	53	49729	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:36.662962914 CEST	53	49729	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:36.667537928 CEST	49729	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:36.673995018 CEST	53	49729	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:36.674062967 CEST	49729	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:41.968921900 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:41.969011068 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:41.969116926 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:41.969505072 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:41.969536066 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.105149984 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.105262995 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:43.109225035 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:43.109253883 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.109667063 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.117165089 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:43.159336090 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.447510958 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 23, 2024 15:37:43.495834112 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.495873928 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.495898008 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.495991945 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:43.496037960 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.496104956 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:43.614835024 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.614901066 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.615137100 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:43.615138054 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:43.615206957 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.615387917 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:43.615432024 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.615463018 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:43.615809917 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.615906000 CEST	443	49731	4.175.87.197	192.168.2.17
Oct 23, 2024 15:37:43.615972996 CEST	49731	443	192.168.2.17	4.175.87.197
Oct 23, 2024 15:37:45.442667961 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:45.442766905 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:45.442866087 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:45.443947077 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:45.443981886 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:45.607983112 CEST	49733	443	192.168.2.17	13.107.5.88
Oct 23, 2024 15:37:45.608084917 CEST	443	49733	13.107.5.88	192.168.2.17
Oct 23, 2024 15:37:45.608186007 CEST	49733	443	192.168.2.17	13.107.5.88
Oct 23, 2024 15:37:45.636735916 CEST	49733	443	192.168.2.17	13.107.5.88
Oct 23, 2024 15:37:45.636810064 CEST	443	49733	13.107.5.88	192.168.2.17
Oct 23, 2024 15:37:46.385735035 CEST	443	49733	13.107.5.88	192.168.2.17
Oct 23, 2024 15:37:46.385827065 CEST	49733	443	192.168.2.17	13.107.5.88
Oct 23, 2024 15:37:46.390233994 CEST	49733	443	192.168.2.17	13.107.5.88
Oct 23, 2024 15:37:46.390245914 CEST	443	49733	13.107.5.88	192.168.2.17
Oct 23, 2024 15:37:46.390644073 CEST	443	49733	13.107.5.88	192.168.2.17
Oct 23, 2024 15:37:46.432022095 CEST	49733	443	192.168.2.17	13.107.5.88
Oct 23, 2024 15:37:46.475337982 CEST	443	49733	13.107.5.88	192.168.2.17
Oct 23, 2024 15:37:46.559642076 CEST	443	49733	13.107.5.88	192.168.2.17
Oct 23, 2024 15:37:46.561254025 CEST	443	49733	13.107.5.88	192.168.2.17
Oct 23, 2024 15:37:46.561357021 CEST	49733	443	192.168.2.17	13.107.5.88
Oct 23, 2024 15:37:46.564196110 CEST	49733	443	192.168.2.17	13.107.5.88
Oct 23, 2024 15:37:46.569359064 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:46.569499016 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:46.613890886 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:46.613943100 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:46.614427090 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:46.615756035 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:46.615797997 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:46.615864038 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:46.983206034 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:46.983292103 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:46.983380079 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:46.983397007 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:46.983443975 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:46.983475924 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:46.983917952 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:46.983937979 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:46.984283924 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:46.984369993 CEST	443	49732	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:46.984505892 CEST	49732	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:47.093251944 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:47.093316078 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:47.093405962 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:47.093621969 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:47.093636036 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.200484991 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.201180935 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.201263905 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.202011108 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.202025890 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.202100992 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.202117920 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.591576099 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.591644049 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.591681004 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.591715097 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.591747046 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.591761112 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.592330933 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.592346907 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.592355013 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.592679977 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.592771053 CEST	443	49734	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.592830896 CEST	49734	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.670895100 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.670955896 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:48.671036959 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.671323061 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:48.671339989 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:49.798707008 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:49.799491882 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:49.799540043 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:49.800326109 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:49.800340891 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:49.800378084 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:49.800388098 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:50.216814041 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:50.216844082 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:50.216883898 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:50.217041969 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:50.217041969 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:50.217082024 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:50.217495918 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:50.217540979 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:50.217567921 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:50.217730999 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:50.217772961 CEST	443	49735	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:50.217847109 CEST	49735	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:50.284280062 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:50.284326077 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:50.284404039 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:50.284718990 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:50.284733057 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.476665974 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.477415085 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:51.477436066 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.478543997 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:51.478549004 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.478593111 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:51.478599072 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.886672020 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.886745930 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.886835098 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.886912107 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:51.886946917 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.886960983 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:51.887351990 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:51.887368917 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.887396097 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:51.887703896 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.887789965 CEST	443	49736	40.126.32.76	192.168.2.17
Oct 23, 2024 15:37:51.887835026 CEST	49736	443	192.168.2.17	40.126.32.76
Oct 23, 2024 15:37:51.975457907 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:51.975506067 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:51.975589991 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:51.978147030 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:51.978161097 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:52.828999043 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:52.829207897 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:52.882534981 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:52.882572889 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:52.883600950 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:52.883682966 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:52.885040045 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:52.885094881 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:53.269670963 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:53.269869089 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:53.269937992 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:53.270009995 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:53.270145893 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:53.270205975 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:53.270219088 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:53.270245075 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:37:53.270360947 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:53.270361900 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:53.272852898 CEST	49737	443	192.168.2.17	2.23.209.135
Oct 23, 2024 15:37:53.272871017 CEST	443	49737	2.23.209.135	192.168.2.17
Oct 23, 2024 15:38:02.434075117 CEST	49739	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:38:02.434178114 CEST	443	49739	142.250.186.100	192.168.2.17
Oct 23, 2024 15:38:02.434298038 CEST	49739	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:38:02.434732914 CEST	49739	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:38:02.434765100 CEST	443	49739	142.250.186.100	192.168.2.17
Oct 23, 2024 15:38:03.295751095 CEST	443	49739	142.250.186.100	192.168.2.17
Oct 23, 2024 15:38:03.296215057 CEST	49739	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:38:03.296240091 CEST	443	49739	142.250.186.100	192.168.2.17
Oct 23, 2024 15:38:03.298772097 CEST	443	49739	142.250.186.100	192.168.2.17
Oct 23, 2024 15:38:03.299248934 CEST	49739	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:38:03.299467087 CEST	443	49739	142.250.186.100	192.168.2.17
Oct 23, 2024 15:38:03.344681978 CEST	49739	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:38:08.420663118 CEST	49728	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:38:08.426186085 CEST	80	49728	13.248.192.114	192.168.2.17
Oct 23, 2024 15:38:09.044621944 CEST	49727	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:38:09.050441027 CEST	80	49727	13.248.192.114	192.168.2.17
Oct 23, 2024 15:38:13.287250042 CEST	443	49739	142.250.186.100	192.168.2.17
Oct 23, 2024 15:38:13.287345886 CEST	443	49739	142.250.186.100	192.168.2.17
Oct 23, 2024 15:38:13.287421942 CEST	49739	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:38:14.287925959 CEST	49739	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:38:14.287987947 CEST	443	49739	142.250.186.100	192.168.2.17
Oct 23, 2024 15:38:23.952070951 CEST	80	49728	13.248.192.114	192.168.2.17
Oct 23, 2024 15:38:23.952212095 CEST	49728	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:38:24.033005953 CEST	80	49727	13.248.192.114	192.168.2.17
Oct 23, 2024 15:38:24.033312082 CEST	49727	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:38:24.293721914 CEST	49727	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:38:24.293721914 CEST	49728	80	192.168.2.17	13.248.192.114
Oct 23, 2024 15:38:24.299227953 CEST	80	49727	13.248.192.114	192.168.2.17
Oct 23, 2024 15:38:24.299343109 CEST	80	49728	13.248.192.114	192.168.2.17
Oct 23, 2024 15:39:02.486495018 CEST	49742	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:39:02.486555099 CEST	443	49742	142.250.186.100	192.168.2.17
Oct 23, 2024 15:39:02.486891031 CEST	49742	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:39:02.487406969 CEST	49742	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:39:02.487428904 CEST	443	49742	142.250.186.100	192.168.2.17
Oct 23, 2024 15:39:03.359601021 CEST	443	49742	142.250.186.100	192.168.2.17
Oct 23, 2024 15:39:03.360157013 CEST	49742	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:39:03.360229969 CEST	443	49742	142.250.186.100	192.168.2.17
Oct 23, 2024 15:39:03.361360073 CEST	443	49742	142.250.186.100	192.168.2.17
Oct 23, 2024 15:39:03.361711025 CEST	49742	443	192.168.2.17	142.250.186.100
Oct 23, 2024 15:39:03.361908913 CEST	443	49742	142.250.186.100	192.168.2.17
Oct 23, 2024 15:39:03.408900023 CEST	49742	443	192.168.2.17	142.250.186.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 15:36:58.004961967 CEST	53	64778	1.1.1.1	192.168.2.17
Oct 23, 2024 15:36:58.019098997 CEST	53	60215	1.1.1.1	192.168.2.17
Oct 23, 2024 15:36:59.266630888 CEST	53	61940	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:00.050179005 CEST	60754	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:00.050453901 CEST	50721	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:00.063332081 CEST	53	60754	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:00.065757990 CEST	53	50721	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:01.029735088 CEST	53302	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:01.029902935 CEST	63755	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:01.039390087 CEST	53	63755	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:01.046096087 CEST	53	53302	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:01.050406933 CEST	50531	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:01.060173988 CEST	53	50531	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:01.082351923 CEST	59621	53	192.168.2.17	8.8.8.8
Oct 23, 2024 15:37:01.083003044 CEST	63571	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:01.091007948 CEST	53	59621	8.8.8.8	192.168.2.17
Oct 23, 2024 15:37:01.091392994 CEST	53	63571	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:02.132582903 CEST	54282	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:02.134212017 CEST	60186	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:02.185219049 CEST	53	60186	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:02.185993910 CEST	53	54282	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:02.368463039 CEST	56397	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:02.368618011 CEST	64127	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:02.376127958 CEST	53	56397	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:02.376147032 CEST	53	64127	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:07.203809977 CEST	59898	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:07.204021931 CEST	53319	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:07.213710070 CEST	53	59898	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:07.219516039 CEST	53	53319	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:07.220271111 CEST	49547	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:07.229962111 CEST	53	49547	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:16.268229008 CEST	53	51039	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:19.424952030 CEST	53	64095	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:23.333990097 CEST	59837	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:23.334148884 CEST	56990	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:23.343446016 CEST	53	56990	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:23.349726915 CEST	53	59837	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:23.350480080 CEST	49763	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:23.366106033 CEST	53	49763	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:23.381251097 CEST	59250	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:23.381422043 CEST	65029	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:23.395905972 CEST	53	65029	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:23.402662039 CEST	53	59250	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:23.712352991 CEST	61814	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:23.712533951 CEST	50636	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:23.722373962 CEST	53	50636	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:23.733324051 CEST	53	61814	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:24.035337925 CEST	60283	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:24.035564899 CEST	50348	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:24.045697927 CEST	53	50348	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:24.051498890 CEST	53	60283	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:24.065160990 CEST	49507	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:24.065462112 CEST	50641	53	192.168.2.17	8.8.8.8
Oct 23, 2024 15:37:24.073141098 CEST	53	49507	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:24.074232101 CEST	53	50641	8.8.8.8	192.168.2.17
Oct 23, 2024 15:37:25.077415943 CEST	59607	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:25.077699900 CEST	62906	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:25.091952085 CEST	53	62906	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:25.093713045 CEST	53	59607	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:30.117674112 CEST	55524	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:30.117878914 CEST	60849	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:30.127023935 CEST	53	60849	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:30.134136915 CEST	53	55524	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:30.135088921 CEST	53982	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:37:30.150687933 CEST	53	53982	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:35.034153938 CEST	53	56353	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:36.055826902 CEST	53	62327	1.1.1.1	192.168.2.17
Oct 23, 2024 15:37:58.009267092 CEST	53	57541	1.1.1.1	192.168.2.17
Oct 23, 2024 15:38:00.171335936 CEST	64531	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:38:00.171587944 CEST	60545	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:38:00.187158108 CEST	53	64531	1.1.1.1	192.168.2.17
Oct 23, 2024 15:38:00.187752008 CEST	53	60545	1.1.1.1	192.168.2.17
Oct 23, 2024 15:38:00.188486099 CEST	64684	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:38:00.208827019 CEST	53	64684	1.1.1.1	192.168.2.17
Oct 23, 2024 15:38:13.271843910 CEST	138	138	192.168.2.17	192.168.2.255
Oct 23, 2024 15:39:00.224082947 CEST	52928	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:39:00.224172115 CEST	49806	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:39:00.240859985 CEST	53	49806	1.1.1.1	192.168.2.17
Oct 23, 2024 15:39:00.240916967 CEST	53	52928	1.1.1.1	192.168.2.17
Oct 23, 2024 15:39:00.242041111 CEST	53971	53	192.168.2.17	1.1.1.1
Oct 23, 2024 15:39:00.253371954 CEST	53	53971	1.1.1.1	192.168.2.17

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 23, 2024 15:37:00.050179005 CEST	192.168.2.17	1.1.1.1	0x463c	Standard query (0)	gop-win.co	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:00.050453901 CEST	192.168.2.17	1.1.1.1	0xc5d7	Standard query (0)	gop-win.co	65	IN (0x0001)	false
Oct 23, 2024 15:37:01.029735088 CEST	192.168.2.17	1.1.1.1	0x2556	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:01.029902935 CEST	192.168.2.17	1.1.1.1	0xf96c	Standard query (0)	not-found.domain	65	IN (0x0001)	false
Oct 23, 2024 15:37:01.050406933 CEST	192.168.2.17	1.1.1.1	0xa462	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:01.082351923 CEST	192.168.2.17	8.8.8.8	0x77a1	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:01.083003044 CEST	192.168.2.17	1.1.1.1	0x49c7	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:02.132582903 CEST	192.168.2.17	1.1.1.1	0x30f5	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:02.134212017 CEST	192.168.2.17	1.1.1.1	0x3e43	Standard query (0)	not-found.domain	65	IN (0x0001)	false
Oct 23, 2024 15:37:02.368463039 CEST	192.168.2.17	1.1.1.1	0xd9e6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:02.368618011 CEST	192.168.2.17	1.1.1.1	0x1a37	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 23, 2024 15:37:07.203809977 CEST	192.168.2.17	1.1.1.1	0x62b4	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:07.204021931 CEST	192.168.2.17	1.1.1.1	0xf2ec	Standard query (0)	not-found.domain	65	IN (0x0001)	false
Oct 23, 2024 15:37:07.220271111 CEST	192.168.2.17	1.1.1.1	0x1967	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:23.333990097 CEST	192.168.2.17	1.1.1.1	0xb4fc	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:23.334148884 CEST	192.168.2.17	1.1.1.1	0x6d03	Standard query (0)	not-found.domain	65	IN (0x0001)	false
Oct 23, 2024 15:37:23.350480080 CEST	192.168.2.17	1.1.1.1	0x9af3	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:23.381251097 CEST	192.168.2.17	1.1.1.1	0xe7b9	Standard query (0)	gop-win.co	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:23.381422043 CEST	192.168.2.17	1.1.1.1	0xf362	Standard query (0)	gop-win.co	65	IN (0x0001)	false
Oct 23, 2024 15:37:23.712352991 CEST	192.168.2.17	1.1.1.1	0x6182	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:23.712533951 CEST	192.168.2.17	1.1.1.1	0xcb88	Standard query (0)	not-found.domain	65	IN (0x0001)	false
Oct 23, 2024 15:37:24.035337925 CEST	192.168.2.17	1.1.1.1	0x4f31	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:24.035564899 CEST	192.168.2.17	1.1.1.1	0x607b	Standard query (0)	not-found.domain	65	IN (0x0001)	false
Oct 23, 2024 15:37:24.065160990 CEST	192.168.2.17	1.1.1.1	0xdb52	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:24.065462112 CEST	192.168.2.17	8.8.8.8	0x8998	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:25.077415943 CEST	192.168.2.17	1.1.1.1	0x8a77	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:25.077699900 CEST	192.168.2.17	1.1.1.1	0x3258	Standard query (0)	not-found.domain	65	IN (0x0001)	false
Oct 23, 2024 15:37:30.117674112 CEST	192.168.2.17	1.1.1.1	0x28d7	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:30.117878914 CEST	192.168.2.17	1.1.1.1	0x40c0	Standard query (0)	not-found.domain	65	IN (0x0001)	false
Oct 23, 2024 15:37:30.135088921 CEST	192.168.2.17	1.1.1.1	0x69dd	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:38:00.171335936 CEST	192.168.2.17	1.1.1.1	0xcd0e	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:38:00.171587944 CEST	192.168.2.17	1.1.1.1	0xcd27	Standard query (0)	not-found.domain	65	IN (0x0001)	false
Oct 23, 2024 15:38:00.188486099 CEST	192.168.2.17	1.1.1.1	0x4821	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:39:00.224082947 CEST	192.168.2.17	1.1.1.1	0x19bd	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:39:00.224172115 CEST	192.168.2.17	1.1.1.1	0xa834	Standard query (0)	not-found.domain	65	IN (0x0001)	false
Oct 23, 2024 15:39:00.242041111 CEST	192.168.2.17	1.1.1.1	0xd38a	Standard query (0)	not-found.domain	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 23, 2024 15:37:00.063332081 CEST	1.1.1.1	192.168.2.17	0x463c	No error (0)	gop-win.co		3.33.253.57	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:00.063332081 CEST	1.1.1.1	192.168.2.17	0x463c	No error (0)	gop-win.co		13.248.192.114	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:01.039390087 CEST	1.1.1.1	192.168.2.17	0xf96c	Name error (3)	not-found.domain	none	none	65	IN (0x0001)	false
Oct 23, 2024 15:37:01.046096087 CEST	1.1.1.1	192.168.2.17	0x2556	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:01.060173988 CEST	1.1.1.1	192.168.2.17	0xa462	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:01.091007948 CEST	8.8.8.8	192.168.2.17	0x77a1	No error (0)	google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:01.091392994 CEST	1.1.1.1	192.168.2.17	0x49c7	No error (0)	google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:02.185219049 CEST	1.1.1.1	192.168.2.17	0x3e43	Name error (3)	not-found.domain	none	none	65	IN (0x0001)	false
Oct 23, 2024 15:37:02.185993910 CEST	1.1.1.1	192.168.2.17	0x30f5	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:02.376127958 CEST	1.1.1.1	192.168.2.17	0xd9e6	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:02.376147032 CEST	1.1.1.1	192.168.2.17	0x1a37	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 23, 2024 15:37:07.213710070 CEST	1.1.1.1	192.168.2.17	0x62b4	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:07.219516039 CEST	1.1.1.1	192.168.2.17	0xf2ec	Name error (3)	not-found.domain	none	none	65	IN (0x0001)	false
Oct 23, 2024 15:37:07.229962111 CEST	1.1.1.1	192.168.2.17	0x1967	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:23.343446016 CEST	1.1.1.1	192.168.2.17	0x6d03	Name error (3)	not-found.domain	none	none	65	IN (0x0001)	false
Oct 23, 2024 15:37:23.349726915 CEST	1.1.1.1	192.168.2.17	0xb4fc	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:23.366106033 CEST	1.1.1.1	192.168.2.17	0x9af3	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:23.402662039 CEST	1.1.1.1	192.168.2.17	0xe7b9	No error (0)	gop-win.co		13.248.192.114	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:23.402662039 CEST	1.1.1.1	192.168.2.17	0xe7b9	No error (0)	gop-win.co		3.33.253.57	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:23.722373962 CEST	1.1.1.1	192.168.2.17	0xcb88	Name error (3)	not-found.domain	none	none	65	IN (0x0001)	false
Oct 23, 2024 15:37:23.733324051 CEST	1.1.1.1	192.168.2.17	0x6182	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:24.045697927 CEST	1.1.1.1	192.168.2.17	0x607b	Name error (3)	not-found.domain	none	none	65	IN (0x0001)	false
Oct 23, 2024 15:37:24.051498890 CEST	1.1.1.1	192.168.2.17	0x4f31	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:24.073141098 CEST	1.1.1.1	192.168.2.17	0xdb52	No error (0)	google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:24.074232101 CEST	8.8.8.8	192.168.2.17	0x8998	No error (0)	google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:25.091952085 CEST	1.1.1.1	192.168.2.17	0x3258	Name error (3)	not-found.domain	none	none	65	IN (0x0001)	false
Oct 23, 2024 15:37:25.093713045 CEST	1.1.1.1	192.168.2.17	0x8a77	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:30.127023935 CEST	1.1.1.1	192.168.2.17	0x40c0	Name error (3)	not-found.domain	none	none	65	IN (0x0001)	false
Oct 23, 2024 15:37:30.134136915 CEST	1.1.1.1	192.168.2.17	0x28d7	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:37:30.150687933 CEST	1.1.1.1	192.168.2.17	0x69dd	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:38:00.187158108 CEST	1.1.1.1	192.168.2.17	0xcd0e	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:38:00.187752008 CEST	1.1.1.1	192.168.2.17	0xcd27	Name error (3)	not-found.domain	none	none	65	IN (0x0001)	false
Oct 23, 2024 15:38:00.208827019 CEST	1.1.1.1	192.168.2.17	0x4821	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:39:00.240859985 CEST	1.1.1.1	192.168.2.17	0xa834	Name error (3)	not-found.domain	none	none	65	IN (0x0001)	false
Oct 23, 2024 15:39:00.240916967 CEST	1.1.1.1	192.168.2.17	0x19bd	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 15:39:00.253371954 CEST	1.1.1.1	192.168.2.17	0xd38a	Name error (3)	not-found.domain	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gop-win.co

slscr.update.microsoft.com

www.google.com

fs.microsoft.com

evoke-windowsservices-tas.msedge.net

www.bing.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49727	13.248.192.114	80	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 15:37:23.737581015 CEST	425	OUT	GET / HTTP/1.1 Host: gop-win.co Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 23, 2024 15:37:24.032633066 CEST	180	IN	HTTP/1.1 302 Found Date: Wed, 23 Oct 2024 13:37:23 GMT Content-Length: 0 Connection: keep-alive Location: https://not-found.domain/ Engine: Rebrandly.redirect, version 2.1
Oct 23, 2024 15:38:09.044621944 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49728	13.248.192.114	80	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 15:38:08.420663118 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49701	3.33.253.57	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:00 UTC	659	OUT	GET /k3I0yr HTTP/1.1 Host: gop-win.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 13:37:01 UTC	220	IN	HTTP/1.1 302 Found Date: Wed, 23 Oct 2024 13:37:00 GMT Content-Length: 0 Connection: close Location: https://not-found.domain/ Engine: Rebrandly.redirect, version 2.1 Strict-Transport-Security: max-age=15552000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49704	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:04 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xrEGEK5HvhS+lcb&MD=BpA6rrL6 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-23 13:37:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ce068a69-c650-4ce3-a031-5054d6313d8b MS-RequestId: ea2b8ce6-6993-43e2-9f85-1dda5fb9467a MS-CV: 92WfYtcFmkiwu1Vs.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 23 Oct 2024 13:37:03 GMT Connection: close Content-Length: 24490
2024-10-23 13:37:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-23 13:37:05 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49710	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:14 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-23 13:37:15 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=97737 Date: Wed, 23 Oct 2024 13:37:15 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49711	142.250.186.100	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:15 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 13:37:16 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:37:15 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-hiPs0sk-sSE7_FF7YkvElQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-23 13:37:16 UTC	112	IN	Data Raw: 61 61 33 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 61 76 79 20 61 76 69 61 74 6f 72 73 20 63 72 61 73 68 22 2c 22 62 61 74 6d 61 6e 20 61 72 6b 68 61 6d 20 73 68 61 64 6f 77 22 2c 22 6c 75 6c 75 6c 65 6d 6f 6e 20 6e 68 6c 20 61 70 70 61 72 65 6c 22 2c 22 68 75 72 72 69 63 61 6e 65 20 73 65 61 73 6f 6e 20 66 6c 6f 72 69 64 61 22 2c 22 Data Ascii: aa3)]}'["",["navy aviators crash","batman arkham shadow","lululemon nhl apparel","hurricane season florida","
2024-10-23 13:37:16 UTC	1378	IN	Data Raw: 72 75 66 75 73 20 64 75 20 73 6f 6c 20 70 72 65 73 61 6c 65 20 63 6f 64 65 73 22 2c 22 70 65 6e 74 61 67 6f 6e 22 2c 22 74 72 61 69 6c 20 6f 66 20 74 72 65 61 74 73 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 72 65 77 61 72 64 73 22 2c 22 6c 6f 63 6b 68 65 65 64 20 6d 61 72 74 69 6e 20 73 74 6f 63 6b 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 Data Ascii: rufus du sol presale codes","pentagon","trail of treats monopoly go rewards","lockheed martin stock"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sugge
2024-10-23 13:37:16 UTC	1240	IN	Data Raw: 43 74 73 5a 46 42 51 55 57 34 33 51 7a 49 76 59 31 6b 32 63 47 6c 35 4e 55 56 54 4d 45 4e 77 53 57 4e 42 54 47 35 4b 56 55 46 46 52 6b 78 5a 55 6a 68 5a 4d 6c 42 6d 53 58 68 46 62 32 35 54 54 46 51 72 51 31 42 32 54 6e 4e 32 62 47 78 46 51 30 5a 6b 4d 6e 64 33 64 7a 64 6b 56 6e 52 43 59 56 6b 33 59 56 45 30 65 6e 4e 35 52 33 6c 72 4e 6d 35 43 4c 32 56 6d 55 47 35 50 53 32 77 78 5a 46 56 58 62 33 56 74 4e 30 38 30 63 31 5a 79 4c 31 63 30 4f 47 73 79 51 30 56 77 51 32 35 54 65 6b 6c 54 63 47 78 54 4f 56 6c 70 4d 48 4a 54 63 48 68 6e 52 57 35 44 52 6b 55 33 4f 58 4e 45 57 46 67 33 4e 48 70 51 57 54 46 33 55 33 70 69 53 30 68 77 61 6d 39 6c 5a 6d 56 4f 54 47 6f 78 51 31 68 76 56 58 52 76 54 6e 52 4d 59 56 56 35 61 30 74 6a 56 57 70 6b 53 6c 56 6a 52 57 64 76 Data Ascii: CtsZFBQUW43QzIvY1k2cGl5NUVTMENwSWNBTG5KVUFFRkxZUjhZMlBmSXhFb25TTFQrQ1B2TnN2bGxFQ0ZkMnd3dzdkVnRCYVk3YVE0enN5R3lrNm5CL2VmUG5PS2wxZFVXb3VtN080c1ZyL1c0OGsyQ0VwQ25TeklTcGxTOVlpMHJTcHhnRW5DRkU3OXNEWFg3NHpQWTF3U3piS0hwam9lZmVOTGoxQ1hvVXRvTnRMYVV5a0tjVWpkSlVjRWdv
2024-10-23 13:37:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49712	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-23 13:37:16 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=97705 Date: Wed, 23 Oct 2024 13:37:16 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-23 13:37:16 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49713	142.250.186.100	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:17 UTC	656	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=go&oit=1&cp=2&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49714	142.250.186.100	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:17 UTC	658	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop.&oit=1&cp=4&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 13:37:18 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:37:18 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-C8jnBCF2GfYiUedZG-304w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-23 13:37:18 UTC	112	IN	Data Raw: 32 34 32 0d 0a 29 5d 7d 27 0a 5b 22 67 6f 70 2e 22 2c 5b 22 67 6f 70 2e 70 6c 61 74 66 6f 72 6d 22 2c 22 67 6f 70 2e 63 6f 6d 20 70 6c 61 74 66 6f 72 6d 22 2c 22 67 6f 70 2e 64 61 74 61 20 63 65 6e 74 65 72 22 2c 22 67 6f 70 2e 63 6f 6d 20 70 68 6f 6e 65 20 6e 75 6d 62 65 72 22 2c 22 67 6f 70 2e 63 6f 6d 20 73 74 6f 72 65 22 2c 22 67 Data Ascii: 242)]}'["gop.",["gop.platform","gop.com platform","gop.data center","gop.com phone number","gop.com store","g
2024-10-23 13:37:18 UTC	473	IN	Data Raw: 6f 70 2e 6d 65 61 6e 69 6e 67 22 2c 22 67 6f 70 6c 2e 69 6f 22 2c 22 68 74 74 70 3a 2f 2f 67 6f 70 2e 63 6f 6d 22 2c 22 68 74 74 70 3a 2f 2f 67 6f 70 2e 67 6f 76 22 2c 22 68 74 74 70 3a 2f 2f 67 6f 70 2e 63 6f 6d 2f 32 30 32 34 67 6f 74 76 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 36 30 31 2c 36 30 30 2c 35 35 34 2c 35 35 33 2c 35 35 32 2c 35 35 31 2c 35 35 30 2c 34 30 32 2c 34 30 31 2c 34 30 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 Data Ascii: op.meaning","gopl.io","http://gop.com","http://gop.gov","http://gop.com/2024gotv"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,554,553,552,551,550,402,401,400],"google:suggestsubtype
2024-10-23 13:37:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49715	142.250.186.100	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:18 UTC	657	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop&oit=1&cp=3&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 13:37:19 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:37:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-DLzV42tNOmfRU0g80B7jkg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-23 13:37:19 UTC	112	IN	Data Raw: 37 36 64 0d 0a 29 5d 7d 27 0a 5b 22 67 6f 70 22 2c 5b 22 67 6f 70 22 2c 22 67 6f 70 72 6f 22 2c 22 67 6f 70 72 6f 22 2c 22 67 6f 70 68 65 72 22 2c 22 67 6f 70 75 66 66 22 2c 22 67 6f 70 68 65 72 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 67 6f 70 68 65 72 20 73 70 6f 72 74 73 22 2c 22 67 6f 70 20 6d 65 61 6e 69 6e 67 22 2c 22 67 6f 70 68 65 Data Ascii: 76d)]}'["gop",["gop","gopro","gopro","gopher","gopuff","gopher football","gopher sports","gop meaning","gophe
2024-10-23 13:37:19 UTC	1378	IN	Data Raw: 72 20 66 6f 6f 74 62 61 6c 6c 20 73 63 68 65 64 75 6c 65 22 2c 22 67 6f 70 6e 69 6b 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 7d 2c 7b 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 6f 76 62 53 38 77 61 44 46 6d 5a 44 4d 77 45 68 4a 55 5a 57 4e 6f 62 6d 39 73 62 32 64 35 49 47 4e 76 62 58 42 68 62 6e 6b 79 5a 47 68 30 64 48 42 7a 4f 69 38 76 5a 57 35 6a 63 6e 6c 77 64 47 56 6b 4c 58 52 69 62 6a 41 75 5a 33 4e 30 59 58 52 70 59 79 35 6a 62 32 Data Ascii: r football schedule","gopnik"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{},{"google:entityinfo":"CgovbS8waDFmZDMwEhJUZWNobm9sb2d5IGNvbXBhbnkyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb2
2024-10-23 13:37:19 UTC	418	IN	Data Raw: 55 48 70 35 58 30 6c 54 51 7a 46 54 55 30 31 32 55 45 77 77 62 45 74 36 54 57 74 43 51 55 6c 46 51 55 4e 5a 4d 48 41 48 22 7d 2c 7b 7d 2c 7b 7d 2c 7b 7d 2c 7b 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 33 30 30 2c 36 30 31 2c 36 30 30 2c 35 35 37 2c 35 35 35 2c 35 35 34 2c 35 35 33 2c 35 35 32 2c 35 35 31 2c 35 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 35 31 32 2c 34 33 33 2c 31 33 31 5d 2c 5b 35 31 32 2c 34 33 33 2c 33 35 35 5d 2c 5b 31 39 39 2c 34 33 33 2c 34 36 35 2c 35 31 32 5d 2c 5b 35 31 32 2c 34 33 33 5d 2c 5b 35 31 32 2c 34 33 33 2c 31 39 39 2c 34 36 35 5d 2c 5b 35 31 32 2c 34 33 33 5d 2c 5b 35 31 32 2c 34 33 33 5d 2c 5b 35 31 32 5d 2c 5b 35 31 32 Data Ascii: UHp5X0lTQzFTU012UEwwbEt6TWtCQUlFQUNZMHAH"},{},{},{},{}],"google:suggestrelevance":[1300,601,600,557,555,554,553,552,551,550],"google:suggestsubtypes":[[512,433,131],[512,433,355],[199,433,465,512],[512,433],[512,433,199,465],[512,433],[512,433],[512],[512
2024-10-23 13:37:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49720	142.250.186.100	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:21 UTC	661	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win&oit=1&cp=7&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 13:37:21 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:37:21 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-qVP4KShTL21O74iGkBXScA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-23 13:37:21 UTC	112	IN	Data Raw: 32 35 63 0d 0a 29 5d 7d 27 0a 5b 22 67 6f 70 2d 77 69 6e 22 2c 5b 22 67 6f 70 77 69 6e 22 2c 22 67 6f 70 20 77 69 6e 6e 65 72 22 2c 22 67 6f 70 20 77 69 6e 6e 65 72 73 20 61 6e 64 20 6c 6f 73 65 72 73 22 2c 22 77 69 6e 64 6f 77 73 20 67 70 6f 22 2c 22 67 6f 70 20 77 69 6e 6e 65 72 20 74 61 6b 65 20 61 6c 6c 20 70 72 69 6d 61 72 69 65 Data Ascii: 25c)]}'["gop-win",["gopwin","gop winner","gop winners and losers","windows gpo","gop winner take all primarie
2024-10-23 13:37:21 UTC	499	IN	Data Raw: 73 22 2c 22 67 6f 70 20 77 69 6e 72 65 64 22 2c 22 67 6f 70 20 77 69 6e 6e 65 72 20 74 6f 6e 69 67 68 74 22 2c 22 67 6f 70 20 77 69 6e 6e 65 72 20 64 65 62 61 74 65 22 2c 22 67 70 6f 20 77 69 6e 64 6f 77 73 20 73 65 72 76 65 72 22 2c 22 68 74 74 70 3a 2f 2f 67 6f 70 77 69 6e 2e 63 6f 6d 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 70 68 69 22 3a 30 2c 22 70 72 65 22 3a 30 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 32 2c 36 30 31 2c 36 30 30 2c 35 35 35 2c 35 35 34 2c 35 35 33 2c 35 35 32 2c 35 35 Data Ascii: s","gop winred","gop winner tonight","gop winner debate","gpo windows server","http://gopwin.com"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"phi":0,"pre":0,"tlw":false},"google:suggestrelevance":[1252,601,600,555,554,553,552,55
2024-10-23 13:37:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49721	142.250.186.100	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:21 UTC	666	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win.com&oit=3&cp=11&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 13:37:22 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:37:21 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-I8dM8axZIzZ4TFHCQm8_Pw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-23 13:37:22 UTC	112	IN	Data Raw: 65 64 0d 0a 29 5d 7d 27 0a 5b 22 67 6f 70 2d 77 69 6e 2e 63 6f 6d 22 2c 5b 22 68 74 74 70 3a 2f 2f 67 6f 70 77 69 6e 2e 63 6f 6d 22 5d 2c 5b 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 70 72 65 22 3a 30 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f Data Ascii: ed)]}'["gop-win.com",["http://gopwin.com"],[""],[],{"google:clientdata":{"bpc":false,"pre":0,"tlw":false},"go
2024-10-23 13:37:22 UTC	131	IN	Data Raw: 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 38 35 32 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 34 34 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 4e 41 56 49 47 41 54 49 4f 4e 22 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: ogle:suggestrelevance":[852],"google:suggestsubtypes":[[44]],"google:suggesttype":["NAVIGATION"],"google:verbatimrelevance":851}]
2024-10-23 13:37:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49722	142.250.186.100	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:22 UTC	665	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gop-win.co&oit=3&cp=10&pgcl=4&gs_rn=42&psi=ztUIwh7Jpc-ovUcW&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 13:37:22 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:37:22 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce---4fvPCYLN5IwubkNr6kDg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-23 13:37:22 UTC	112	IN	Data Raw: 65 66 0d 0a 29 5d 7d 27 0a 5b 22 67 6f 70 2d 77 69 6e 2e 63 6f 22 2c 5b 22 68 74 74 70 3a 2f 2f 67 6f 70 77 69 6e 2e 63 6f 6d 22 5d 2c 5b 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 70 72 65 22 3a 30 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f Data Ascii: ef)]}'["gop-win.co",["http://gopwin.com"],[""],[],{"google:clientdata":{"bpc":false,"pre":0,"tlw":false},"goo
2024-10-23 13:37:22 UTC	133	IN	Data Raw: 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 38 35 32 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 34 34 2c 31 30 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 4e 41 56 49 47 41 54 49 4f 4e 22 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: gle:suggestrelevance":[852],"google:suggestsubtypes":[[44,10]],"google:suggesttype":["NAVIGATION"],"google:verbatimrelevance":851}]
2024-10-23 13:37:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49702	3.33.253.57	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:22 UTC	653	OUT	GET / HTTP/1.1 Host: gop-win.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 13:37:23 UTC	220	IN	HTTP/1.1 302 Found Date: Wed, 23 Oct 2024 13:37:22 GMT Content-Length: 0 Connection: close Location: https://not-found.domain/ Engine: Rebrandly.redirect, version 2.1 Strict-Transport-Security: max-age=15552000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49726	3.33.253.57	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:23 UTC	653	OUT	GET / HTTP/1.1 Host: gop-win.co Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 13:37:23 UTC	220	IN	HTTP/1.1 302 Found Date: Wed, 23 Oct 2024 13:37:23 GMT Content-Length: 0 Connection: close Location: https://not-found.domain/ Engine: Rebrandly.redirect, version 2.1 Strict-Transport-Security: max-age=15552000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49723	142.250.186.100	443	7040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:31 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 13:37:31 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:37:31 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-IueR-lvitQ_TvJ8ZsL9Dxw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-23 13:37:31 UTC	112	IN	Data Raw: 62 64 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 74 72 61 69 6c 20 6f 66 20 74 72 65 61 74 73 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 72 65 77 61 72 64 73 22 2c 22 69 6e 74 65 72 65 73 74 20 72 61 74 65 73 20 6d 6f 72 74 67 61 67 65 73 22 2c 22 62 69 6c 74 6d 6f 72 65 20 68 6f 75 73 65 20 68 75 72 72 69 63 61 6e 65 20 68 65 6c 65 6e 65 Data Ascii: bd5)]}'["",["trail of treats monopoly go rewards","interest rates mortgages","biltmore house hurricane helene
2024-10-23 13:37:31 UTC	1378	IN	Data Raw: 22 2c 22 68 6f 77 20 6d 75 63 68 20 61 72 65 20 65 70 69 63 20 75 6e 69 76 65 72 73 65 20 74 69 63 6b 65 74 73 22 2c 22 6e 62 61 20 74 6e 74 22 2c 22 73 70 61 63 65 78 20 66 61 6c 63 6f 6e 20 39 20 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 22 2c 22 61 6d 62 65 73 73 61 20 6d 65 64 61 72 64 61 20 63 68 61 6d 70 69 6f 6e 20 61 62 69 6c 69 74 69 65 73 22 2c 22 73 68 61 72 69 20 72 65 73 74 61 75 72 61 6e 74 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 Data Ascii: ","how much are epic universe tickets","nba tnt","spacex falcon 9 rocket launch","ambessa medarda champion abilities","shari restaurants"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmR
2024-10-23 13:37:31 UTC	1378	IN	Data Raw: 57 78 68 56 7a 4e 45 63 6d 4e 42 51 54 52 61 53 31 4a 53 4e 6a 6c 43 61 55 64 6a 61 46 46 69 51 6b 5a 33 4d 6c 4a 6c 4e 44 68 6b 5a 6e 6b 78 64 33 6f 32 64 57 78 57 4e 55 56 35 5a 55 39 70 4e 6e 42 75 53 33 4a 32 4e 47 6c 4b 56 54 4a 47 54 6b 73 78 52 6e 4e 44 62 47 30 79 54 6b 4a 74 54 33 64 4c 4d 6e 42 55 52 54 6c 30 52 55 39 68 54 6b 39 68 61 6c 4a 30 57 47 31 50 62 6d 31 51 56 45 4e 6b 56 32 46 56 4c 31 52 77 53 32 31 59 4d 6e 6c 45 64 55 52 31 52 6b 52 76 55 57 56 76 65 48 4d 30 4e 55 52 72 63 7a 4a 77 5a 6b 49 30 54 6d 39 70 55 44 6c 5a 62 6e 42 70 54 57 31 73 4d 44 46 76 62 32 6c 30 63 44 6c 76 56 33 56 76 4f 56 5a 4c 4c 32 31 74 51 58 70 49 54 6d 74 6f 53 56 6c 45 62 48 6c 6c 4d 6d 78 4b 53 31 4e 77 53 54 46 30 59 32 56 58 53 6b 56 36 56 30 52 55 Data Ascii: WxhVzNEcmNBQTRaS1JSNjlCaUdjaFFiQkZ3MlJlNDhkZnkxd3o2dWxWNUV5ZU9pNnBuS3J2NGlKVTJGTksxRnNDbG0yTkJtT3dLMnBURTl0RU9hTk9halJ0WG1Pbm1QVENkV2FVL1RwS21YMnlEdUR1RkRvUWVveHM0NURrczJwZkI0Tm9pUDlZbnBpTW1sMDFvb2l0cDlvV3VvOVZLL21tQXpITmtoSVlEbHllMmxKS1NwSTF0Y2VXSkV6V0RU
2024-10-23 13:37:31 UTC	168	IN	Data Raw: 4b 56 32 77 30 5a 30 5a 4b 53 6a 4a 56 55 45 56 5a 56 54 5a 30 52 57 70 61 4e 57 70 76 62 6c 52 7a 4e 30 74 56 57 6c 56 32 55 32 78 72 51 6b 6c 54 54 44 4a 43 53 6b 5a 79 5a 79 74 32 5a 47 70 4f 61 44 4e 72 65 6d 78 54 64 58 4e 44 54 6b 6c 76 4d 46 70 31 55 6d 35 6b 59 57 4a 6b 54 46 4e 7a 65 46 56 53 63 57 73 79 64 6d 4e 49 64 54 68 4e 53 31 68 48 5a 6b 52 45 54 6b 39 52 61 57 5a 49 5a 46 64 77 64 47 4a 74 56 6c 4e 47 5a 45 52 78 5a 46 42 55 52 44 56 44 56 32 6c 61 52 57 70 35 62 58 6c 76 64 0d 0a Data Ascii: KV2w0Z0ZKSjJVUEVZVTZ0RWpaNWpvblRzN0tVWlV2U2xrQklTTDJCSkZyZyt2ZGpOaDNremxTdXNDTklvMFp1Um5kYWJkTFNzeFVScWsydmNIdThNS1hHZkRETk9RaWZIZFdwdGJtVlNGZERxZFBURDVDV2laRWp5bXlvd
2024-10-23 13:37:31 UTC	90	IN	Data Raw: 35 34 0d 0a 48 6c 76 63 55 68 42 55 32 52 54 51 32 74 69 4b 30 39 31 52 6d 5a 71 4d 6c 46 56 4d 47 31 59 53 46 68 69 4e 30 4a 54 53 45 56 44 4f 58 70 73 53 6e 52 79 4e 6b 74 33 4e 45 6c 4e 4e 56 56 69 5a 31 64 4b 53 55 74 72 4e 6d 6c 79 55 6b 39 47 62 55 39 58 4d 0d 0a Data Ascii: 54HlvcUhBU2RTQ2tiK091RmZqMlFVMG1YSFhiN0JTSEVDOXpsSnRyNkt3NElNNVViZ1dKSUtrNmlyUk9GbU9XM
2024-10-23 13:37:31 UTC	1052	IN	Data Raw: 34 31 35 0d 0a 43 39 4f 55 46 42 56 56 55 70 4c 52 55 73 35 62 45 6c 30 5a 6d 4a 78 5a 47 56 31 62 6d 67 78 64 33 70 34 62 55 4a 47 56 47 78 68 53 55 4e 50 61 55 56 77 51 55 45 34 61 47 64 68 65 6b 35 54 5a 32 68 42 54 6d 64 72 51 57 56 74 62 55 78 54 57 6d 39 4b 52 6d 70 77 59 31 6c 6b 64 30 6c 46 62 57 6b 77 52 58 63 76 65 45 52 55 4d 6a 55 78 56 6d 64 34 4d 56 49 79 62 6e 52 72 4f 48 52 4d 61 6d 70 53 54 47 56 31 59 6b 31 77 53 33 4a 46 52 46 45 79 63 32 52 55 59 6e 4a 6d 51 33 70 34 53 6c 45 79 57 6d 4e 76 64 56 4a 6a 63 6b 4e 48 56 57 68 78 54 6a 4a 6c 64 32 68 42 4d 6b 46 42 64 44 46 31 59 69 74 51 57 45 55 78 55 6e 46 55 64 6a 46 78 4d 30 31 54 4b 33 52 44 65 55 4e 46 53 31 4e 79 57 6b 74 79 61 6c 51 30 51 7a 4a 4a 65 58 5a 4e 52 57 64 79 53 6c 41 Data Ascii: 415C9OUFBVVUpLRUs5bEl0ZmJxZGV1bmgxd3p4bUJGVGxhSUNPaUVwQUE4aGdhek5TZ2hBTmdrQWVtbUxTWm9KRmpwY1lkd0lFbWkwRXcveERUMjUxVmd4MVIybnRrOHRMampSTGV1Yk1wS3JFRFEyc2RUYnJmQ3p4SlEyWmNvdVJjckNHVWhxTjJld2hBMkFBdDF1YitQWEUxUnFUdjFxM01TK3RDeUNFS1NyWktyalQ0QzJJeXZNRWdySlA
2024-10-23 13:37:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49731	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:43 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xrEGEK5HvhS+lcb&MD=BpA6rrL6 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-23 13:37:43 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 834a6330-fd6e-4246-888e-13a5339e17ec MS-RequestId: f647db53-af1e-43c3-ae68-cdd20b53cfdb MS-CV: v2meuHr6jUe8mTcP.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 23 Oct 2024 13:37:42 GMT Connection: close Content-Length: 30005
2024-10-23 13:37:43 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-23 13:37:43 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.17	49733	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:46 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-10-23 13:37:46 UTC	209	IN	HTTP/1.1 400 Bad Request X-MSEdge-Ref: Ref A: F28C8C52028E454D826707479AF42018 Ref B: DFW311000104019 Ref C: 2024-10-23T13:37:46Z Date: Wed, 23 Oct 2024 13:37:45 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49732	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-23 13:37:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-23 13:37:46 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 23 Oct 2024 13:36:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BL2 x-ms-request-id: 8a91c472-9da5-4c27-8875-baadeac8d54d PPServer: PPV: 30 H: BL02EPF0001D97D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 23 Oct 2024 13:37:46 GMT Connection: close Content-Length: 11392
2024-10-23 13:37:46 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49734	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-23 13:37:48 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-23 13:37:48 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 23 Oct 2024 13:36:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 6663dda0-1ce4-4683-9595-b47053ae56c0 PPServer: PPV: 30 H: SN1PEPF0003FB4B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 23 Oct 2024 13:37:48 GMT Connection: close Content-Length: 11392
2024-10-23 13:37:48 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49735	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-23 13:37:49 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-23 13:37:50 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 23 Oct 2024 13:36:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 7cf2a2a6-f1ae-4c54-8a84-3d39e6d3181c PPServer: PPV: 30 H: PH1PEPF00011CB4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 23 Oct 2024 13:37:49 GMT Connection: close Content-Length: 11392
2024-10-23 13:37:50 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49736	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4808 Host: login.live.com
2024-10-23 13:37:51 UTC	4808	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-23 13:37:51 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 23 Oct 2024 13:36:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 5a2bffac-4000-427e-b1ab-e9a6846c9d5b PPServer: PPV: 30 H: PH1PEPF00011E57 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 23 Oct 2024 13:37:51 GMT Connection: close Content-Length: 11197
2024-10-23 13:37:51 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49737	2.23.209.135	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 13:37:52 UTC	2593	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -240 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAb5G6NOO6clpDSRroKoZlJIHWd19ow0GV0DhcMtQSvsqXeExJtZ5JiwiI55yIDVq6WT1Zb8HnEtk99/LtfJHDbqZVgeBwx3Z1z6ch5c/4Fy2VCpewCQLKcViiqHxskR5Qq9NL9MkON2h0DORsC9Pe/H%2BRNfTSiqJDN9ncl%2B9RnIM2zIZHVcOy/mMUJJZ2ZGDLzek73F9ENxO6Rd794UhgTEV9P72mH%2BhzZ2IrfNmWBdNCf66M5YYhPZPZgtHyGErWTW5SrakD5/aO5%2BcPq2oZ2HX6eOMnWq4Un3qCEzq5nvxYrxmSh6j4C4BHc7IvInrA7%2Bxgu4KkjQYKIyO96Trvl8QZgAAELdrLep4nrTbUzNFC7dWScWwARWbv24pJH9dlPm2iiwtPnQHQ0iP7Wa4akZC6eCUePS0kYaP3LpeUYnk1f1YSJYX8T8nxQVrarEPBnjW%2BsDYWM0zf08q54MDcMICIpKRz%2Bvl/ZGs5%2BPJ%2BQjJKW/wn%2BuSk7%2B5TvD%2BAbzEwTrpcKIPCNB5Cd7bdp0hd%2B4NKOAvOrElyuw0X0volWP1SC6pIeYU3JTtQEhXJndyIK5Z4KrE6cUMMu69QyoNA1tAB9vg9TCcH%2B9f9iJyJ03A7QEdTO2g50MXjWy8jeoqMvbBNDfh4LFSGivxosMCvlavClVkXVmWGX48Q84nuDwvv2KoXQKDLAmYbSe0O10BpGqxWjpqa6pEMF4eL09JwEe/fsFO%2Buam6ZVi9jLeqivl4s95ZfU7%2Bsyp75lSw8fILFjTPkhWTemqdMibnaTAgB9wQOJtD3AHbIc0wSawT/T7NOtGaOLexkQKCYxxU17Cos6jItEs9eiZmAR13JBbzD7PE7IxLmE/CQcvTQtK07ui3IE%2B/5E7bsbB/xCdKjNYatIA0o7FzFGjKGuyu19kc9WQH3ZONcf [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1729690663 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 9CB8EE4BF29C4B00A5ECADD9B0898727 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-10-23 13:37:53 UTC	1148	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 6718fc31af2245539e5843eab302a83c X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Wed, 23 Oct 2024 13:37:53 GMT Connection: close Set-Cookie: _EDGE_S=SID=3B1383694B0161FC1EE896484A0860B8&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Mon, 17-Nov-2025 13:37:53 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=3B1383694B0161FC1EE896484A0860B8; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.1ed01702.1729690673.260ed288
2024-10-23 13:37:53 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Target ID:	0
Start time:	09:36:54
Start date:	23/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:36:56
Start date:	23/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,12194626097471155259,2016964568004695182,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:36:58
Start date:	23/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gop-win.co/k3I0yr"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gop-win.co to https://not-found.domain/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gop-win.co to https://not-found.domain/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gop-win.co to https://not-found.domain/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gop-win.co to https://not-found.domain/

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://gop-win.co/k3I0yr

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
https://gop-win.co/k3I0yr