Edit tour

Windows Analysis Report
https://mclimber%5B.%5Dorg/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20

Overview

General Information

Sample URL:	https://mclimber%5B.%5Dorg/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2
Analysis ID:	1546691
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1964,i,1547439328298854920,3861948928415475423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mclimber%5B.%5Dorg/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:36:14.420847+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.16	49723	TCP
2024-11-01T13:36:51.880219+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.16	49724	TCP

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_79.1.dr	String found in binary or memory: http:////www.epicgames.com/activate
Source: chromecache_71.1.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_83.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_83.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_83.1.dr, chromecache_71.1.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_85.1.dr	String found in binary or memory: https://cdn.hostinger.com/hostinger_welcome/v2/man1.png
Source: chromecache_83.1.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_83.1.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_83.1.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_85.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: chromecache_85.1.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=DM
Source: chromecache_90.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/dmsans/v15/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2)
Source: chromecache_90.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/dmsans/v15/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu6-K6h9Q.woff2)
Source: chromecache_72.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/dmsans/v15/rP2tp2ywxg089UriI5-g4vlH9VoD8CmcqZG40F9JadbnoEwAopxRR232VGM.w
Source: chromecache_72.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/dmsans/v15/rP2tp2ywxg089UriI5-g4vlH9VoD8CmcqZG40F9JadbnoEwAopxRSW32.woff
Source: chromecache_71.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_71.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_71.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_71.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_85.1.dr	String found in binary or memory: https://hpanel.hostinger.com
Source: chromecache_85.1.dr	String found in binary or memory: https://hpanel.hostinger.com/favicons/hostinger.png
Source: chromecache_71.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_83.1.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_83.1.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_85.1.dr	String found in binary or memory: https://support.hostinger.com/en/articles/3220304-how-to-install-wordpress-using-auto-installer
Source: chromecache_85.1.dr	String found in binary or memory: https://support.hostinger.com/en/articles/4455931-how-can-i-migrate-website-to-hostinger
Source: chromecache_83.1.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_71.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_83.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_83.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_71.1.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_71.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_71.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49724 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@22/57@12/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1964,i,1547439328298854920,3861948928415475423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mclimber%5B.%5Dorg/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1964,i,1547439328298854920,3861948928415475423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://www.broofa.com	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://domains.google.com/suggest/flow	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mclimber.org	195.35.38.103	true	false	unknown
plus.l.google.com	216.58.206.78	true	false	unknown
play.google.com	142.250.186.174	true	false	unknown
www.google.com	216.58.212.164	true	false	unknown
apis.google.com	unknown	unknown	false	unknown
hpanel.hostinger.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=m&oit=1&cp=1&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber&oit=1&cp=8&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/async/newtab_promos	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.o&oit=1&cp=10&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=%2F&oit=4&cp=1&pgcl=4&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.&oit=1&cp=9&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://play.google.com/log?format=json&hasfast=true	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.org&oit=3&cp=12&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mc&oit=1&cp=2&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown
https://mclimber.org/	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.or&oit=1&cp=11&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.broofa.com	chromecache_71.1.dr	false	URL Reputation: safe	unknown
https://cdn.hostinger.com/hostinger_welcome/v2/man1.png	chromecache_85.1.dr	false		unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_83.1.dr	false	URL Reputation: safe	unknown
https://plus.google.com	chromecache_83.1.dr	false		unknown
http:////www.epicgames.com/activate	chromecache_79.1.dr	false		unknown
https://www.google.com	chromecache_71.1.dr	false		unknown
https://hpanel.hostinger.com/favicons/hostinger.png	chromecache_85.1.dr	false		unknown
https://apis.google.com	chromecache_83.1.dr, chromecache_71.1.dr	false	URL Reputation: safe	unknown
https://support.hostinger.com/en/articles/4455931-how-can-i-migrate-website-to-hostinger	chromecache_85.1.dr	false		unknown
https://domains.google.com/suggest/flow	chromecache_83.1.dr	false	URL Reputation: safe	unknown
https://support.hostinger.com/en/articles/3220304-how-to-install-wordpress-using-auto-installer	chromecache_85.1.dr	false		unknown
https://clients6.google.com	chromecache_83.1.dr	false		unknown
https://hpanel.hostinger.com	chromecache_85.1.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.212.164	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.174	play.google.com	United States	15169	GOOGLEUS	false
216.58.206.78	plus.l.google.com	United States	15169	GOOGLEUS	false
195.35.38.103	mclimber.org	Germany	8359	MTSRU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546691
Start date and time:	2024-11-01 13:35:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://mclimber%5B.%5Dorg/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@22/57@12/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.185.78, 74.125.71.84, 34.104.35.123, 142.250.184.227, 142.250.186.170, 216.58.212.138, 172.217.18.106, 172.217.16.202, 142.250.181.234, 142.250.185.138, 142.250.186.138, 142.250.185.234, 142.250.184.234, 142.250.186.106, 142.250.185.202, 172.217.18.10, 142.250.186.42, 142.250.185.170, 172.217.16.138, 142.250.184.202, 142.250.186.110, 142.250.186.74, 172.217.16.195, 104.16.146.108, 104.16.147.108
Excluded domains from analysis (whitelisted): clients1.google.com, fonts.googleapis.com, fs.microsoft.com, cdn.hostinger.com, accounts.google.com, slscr.update.microsoft.com, encrypted-tbn0.gstatic.com, fonts.gstatic.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, update.googleapis.com, hpanel.hostinger.com.cdn.cloudflare.net, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://mclimber%5B.%5Dorg/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:36:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9836907298571784
Encrypted:	false
SSDEEP:	48:81dWTSCmHiUidAKZdA1FehwiZUklqehvy+3:8en76Yy
MD5:	B07710477324A1DFA69A7D74D2A11D1C
SHA1:	DE126C8C34D3B31E57612536D54E31250158B1BA
SHA-256:	3B6254A7248B7AC3AF3FCFB6520F3969472DF58A87FF7B85312BAAF7582FD0F0
SHA-512:	AEE5774CD32964C8469D0561862390C17DE4050BE4DDF2116DBCFD25E4DC2422C508013FD012DC6AC0370D55FF9384FB8E159A9B3BF7F883C417CB50E98B92E4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......Z,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYvd....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:36:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9993579224385716
Encrypted:	false
SSDEEP:	48:8ndWTSCmHiUidAKZdA1seh/iZUkAQkqehIy+2:8Yn709QNy
MD5:	C8900033BEA612E1751932F669294573
SHA1:	BF846129C9BF0B7E1B090035BB4E340C24CA3BFE
SHA-256:	4343BFB5E885F9F4878DAC5B4C5EAC06493D886C30595182C1B9ECD0EC609035
SHA-512:	4FB3862AA512C8D09F0A97674C964104AF84B5C6762860D2FE198711817B4E4EBDFD2246E639FE6F5CB1C6F5F1130AD878E9134EE79DD0DC55998C169D8BBB69
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....@k.Z,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYvd....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.006790085826413
Encrypted:	false
SSDEEP:	48:8wdWTSCAHiUidAKZdA14meh7sFiZUkmgqeh7sGy+BX:89nx4ncy
MD5:	6DC46FC197C28D2F4C388F7B601CC8F7
SHA1:	76084344B4F4A467EBBB20AF170B2BFC0E9156ED
SHA-256:	852039632E7C7E373CB0F310AA9543FD406AF4A3D9E8DF30316CF9AAC5E18CC6
SHA-512:	F35BA24D9D5AF2B7BC6153E187A9CDA4EDBE0F01BF26EBD593F027456B4FB61F579CD68D7E5046DD78F1CF9D31D5017B5F290AA31B61C8E25B2EC6165E1EF735
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYvd....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:36:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9978055052779977
Encrypted:	false
SSDEEP:	48:8CdWTSCmHiUidAKZdA1TehDiZUkwqehUy+R:8Hn7vey
MD5:	A104DBD12AE0B34D3AE0679EF721FD64
SHA1:	4099BB2EBC394FF15AF13503E1078BA52091EA4F
SHA-256:	B4C5203DB2C16E5856C9ED981052F1C3598FA789ADC43EF0CC0C99B69068EE1B
SHA-512:	217B6A4CBF827087DD593B42B04B2F8F33321A22DBC25925050C79C3328D90BBFF183761FDCB2D693BCB085A1F63C1B65E92FCC72E3639FFBBBEC9700C3909EE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.... ;.Z,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYvd....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:36:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.986276720183248
Encrypted:	false
SSDEEP:	48:81dWTSCmHiUidAKZdA1dehBiZUk1W1qehay+C:8en7v96y
MD5:	124F100E911F7E0E5620BD2E7BAC9836
SHA1:	F31319F1071A6FCC8CE25E3C09EA49B2DF2A0556
SHA-256:	7B05A288731F9822437870433B404C3CF623DD0B8394C01D2ED4468682F652AA
SHA-512:	116E24D7C89F5B542EFE3C05216D99B29E4F0E2FC342C758B866B6E2DED74DC680DF24DB73EF47EE831538B3C2103E11871C2303A79ACF11D3E569D39C6932AC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....7.Z,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYvd....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:36:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9963305807619527
Encrypted:	false
SSDEEP:	48:8bdWTSCmHiUidAKZdA1duTeehOuTbbiZUk5OjqehOuTbcy+yT+:8Un7TTfTbxWOvTbcy7T
MD5:	1CF30C70C2DB835300C2A1A27D406558
SHA1:	6B608B8E1A6782DD5BC6B4BDB68E97F392F0C416
SHA-256:	66225A3FEDD34EA08C6B7CCA95A7B5DB8AC49ACA2F6398C8B45706A903CF4EB5
SHA-512:	CFDDE16470EAD554084F8D67E8AB541971179499652CD4169B51818A94AB6D375FEB062EC8D615A97C439F0BD5763910B0CDBA074B4B90ED774476E12931EA67
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......Z,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYvd....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 325 x 308, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	61819
Entropy (8bit):	7.980709530598581
Encrypted:	false
SSDEEP:	1536:4AYLFBdVJ4+bDqH2Y4rUpTzIG1I3KUVfWvcFWTSbsy0c2:4tEeOGP3NpWEFOetq
MD5:	50E51FA3A82F11D13C6E6D785E00D783
SHA1:	49F3E56C1D133E7347C7F9A9706CDE3482FD782F
SHA-256:	110B4F2AEB89AA48823865BE9847A3D8190BF4D982C140508EF6FD1A4A5F2049
SHA-512:	0490FCBF195D5B01DAC3C50B9DFB289C9BA13829850A87218758EC3A7F563751BFAEB249DAB248CCC14023781187F8277CDA4DDA9F938D16DB4C55CE0D39934A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...E...4.......!9....sRGB.........gAMA......a....%IDATx....J.Q...)..o.B..A...W..+.....q...\.>@ =A.^ ....m.M.......~.8...u..1............i..V.k.u.:.....`0...F.Y...juh...#..Q.V..-..o.....2.;..y...T.d...o.....z:.....{.C..S&..J&..J.(.NK.s.....e..&.].f....c<.o.............&....M.eQ4..H$.P....I).;\|....o8....jQ..{.</h....dr.a{..b..1....)..%..>.D".Rv6..(.$.Zk.....f.+..`.p.j..W..G"....c(..=.J)y..2.[..v.Gv...pH...........f3.n....._.....f.....0.EaW0.......FlE..0...X..H..E.QAD1..$]....n.0.....@`...~p.y...7A.TB.R1E)Fb.m..PFe..0J..'..mt.]..}.F#8...l..t..p..`.;.L..b.;FEQ.K..x.!~GB,....r....B..j.W...3=J..j...a>.c..a...r..z..u].....1..!b.Z..o.EQ.8R..?..0.J...E.....f.L."C...N.C...n).........}..\.VX......J(...j.."...`6.E&..eYH..g...gR...3!JE.U(.f..Y..x<.q>.q..p...y..0D..F.L."N'.(..'Dj..r...1.LR.rM1..M)...m....3fM+.....9......$Y.R2...... ...Aq.:..E.I.....U.B;w..d-==.....p3..>.z...s.{>."........<...C.N.@......x8.d....xt.r.X.*@?.&...F

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	39280
Entropy (8bit):	7.9901502011845436
Encrypted:	true
SSDEEP:	768:HTYK/bPKSQm7kYwgj0efEEbdArB2j5UEMeUEUKS0IvgUwVhEXb2Aq7uFf:zYKDfQme0A86rAj5UQBIvIoL2fQf
MD5:	9B788B5D6AE44A72C269CD8430BB18E2
SHA1:	FEA63B342DFD59F8A8B8291D618683B4D36DDCCC
SHA-256:	8D636A70D374BBEE276481E513867085E1465FE6805665C7CC0697FC19511CE7
SHA-512:	763D0CBA6BFA2C188687411318229014F2F218C553EF539D909C76EE70BECFD61FDC91BAE2D2C7094B98D578FD59D6353AF1F06FD706D51C4D3993C7B88A3747
Malicious:	false
Reputation:	low
URL:	https://cdn.hostinger.com/hostinger_welcome/v2/man1.png
Preview:	RIFFh...WEBPVP8L\.../D.L.M8l#I..........r..D.........n...=.........+XU_.D...o...2..@.........X...:..a.'Sb.....d^.......+.. ........h.~g.....L.\|.}aO. .."6..P.V.. A.[..1&.&......8.L...H{..1.[^.t.&....}.RG...7..2#B.Z.%H...D..,..(....m{.U6II'.M..Zx..c .G...^H8.........V..MJ.......4.v.@>..^.0..._$b.........$.6.H\9.kia....S...yJ.B...R...9[.V. ...C 3..0.U...\|sA4m........6b.n.8.......x..5......m.....?u... "&...M.F~.....'U..?.>..U.>.....~d.S[...;...;..o.fP.?......?#...=...Z...=j..@...--..........r.`.ziR)..#.R[J....YV..-....[eE.J.F`....2.gP.d.]g.p...v7.."]Q%oi.25X..h(.QT).+..R..i.s..sx.Zjw...\.....W.n.k...!..........9.....d..xp.Z{-...E...V.;.....w3.N.......t..D.Q...u.C.3.2....i..@...D..OUp...G.... ....dp\G3..>......0..j.G..3.N.*$....\|TYv.....m.:......m..C>....m.0....-..m..:....m.m;...hF.m..u.......K...`awWWs....,.,33^ffffffffXf.....i.i..>U....9=;.....0..J...[.73..Lm....3..R....c...../(3...Cdi..}%..3.+}.1.'6..}t..Z..I...?....F......l.F......GVon...

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (338)
Category:	downloaded
Size (bytes):	343
Entropy (8bit):	4.90134335349137
Encrypted:	false
SSDEEP:	6:VweI0aVYjIgVrTIgVc2BHsL2YriFGHLNjQ9kwGRVzSSNrwGd/ff0wWeXFELH/V:uX0aG0gNTIg62BHslriFuZs9kwuzSSN8
MD5:	7D4968A85A9C4301FFE34409A9BD223D
SHA1:	600D50282120FDBC04B75167D3F3355A96B45218
SHA-256:	98E996765F8C68EE629E28924401B941B177EEC6D8983EC61EDD1FD929F26275
SHA-512:	3491BA58C0608EBEE6E85120EFF032EC786BDB3DA3D01B67EB02A387D868CA03C7C0184EB007D1D07F9F316B822DC6288AEA5DB0D64AD6D4D670F991AE9E8FBF
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber&oit=1&cp=8&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["mclimber",["climber machine","climber marc","myclimb","climber library"],["","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,551,550],"google:suggestsubtypes":[[512,546],[512,546],[512,546],[512,546]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":1300}]

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	905
Entropy (8bit):	5.409806131668522
Encrypted:	false
SSDEEP:	24:3TOY7ayKntJc+u/rTOY7ayVwy96cGSSf7:jOEayKtJc+ufOEayVN0xD
MD5:	59B5554FC4C6DF165C42F4234A314C03
SHA1:	AC7E8EAB86483682FA8B6EA59BE561B0AD396D31
SHA-256:	9DD5E3656C0A0622E7EEE8B077F2F20376E75314924AF32E612092DD9B91A4D4
SHA-512:	F349558D9DB327E02E932A3491730D50835EAE909ACE9D62F6DCCDF5C45A9EE472FB2C4D95E4764A5AF0781E38EBAE3CF43CD5EBF7C4616DF62B22A5B25A0996
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css2?family=DM+Sans&display=swap
Preview:	/* latin-ext /.@font-face {. font-family: 'DM Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/dmsans/v15/rP2tp2ywxg089UriI5-g4vlH9VoD8CmcqZG40F9JadbnoEwAopxRR232VGM.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font-family: 'DM Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/dmsans/v15/rP2tp2ywxg089UriI5-g4vlH9VoD8CmcqZG40F9JadbnoEwAopxRSW32.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}.

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (784)
Category:	downloaded
Size (bytes):	789
Entropy (8bit):	5.151114530876921
Encrypted:	false
SSDEEP:	24:RtMRNUwDL4CBHslgT9lCuABuoB7HHHHHHHYqmffffffo:OXnKlgZ01BuSEqmffffffo
MD5:	9C7D74A6C26F6D8AD43D78B9A75093DC
SHA1:	246676E417618412B1BE46931DEEB4A475A13D20
SHA-256:	69849628E7BE1FE0A924D59E94A2D990BDCBFD0EBD0AA7465AA18B8B86CBFB82
SHA-512:	1CF3899542BB2DFE2A6760CDFC20A0AE18B892939942DE7C868A0D8B00240651F1AD1A418DE893A5A51F6E392B0C149C17192A7634A58F6B12E3CCB35259E1BE
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["intel earnings report","fortnite remix live event","winter forecast","dragon age the veilguard reviews reddit","geary oklahoma police department","new york jets houston texans","cod zombies best guns","hawaii mauna kea snowfall"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.629832159819566
Encrypted:	false
SSDEEP:	3:VweI4KXCHJHJHwwBHsLpHbGWjLwWkzXFETH1u4:VweI4KX05BHsLRGAwWeXFEL13
MD5:	D8C8D5411081076D7CAB0F9BF9178F2B
SHA1:	350A70260F2A9C0C9D09D00B8B03D3473B397315
SHA-256:	CBF9814E795AA6A523AC00D502D7CDA8D3F5A388158376073D2FA143CCF073A2
SHA-512:	D932CEC18E1207EFB4476EB0F78619C190F6E41468B4BBE7C70D51D1BB4ADE3B369B23FD69D3387DF7870BB53A086B5D2785962B7B01502CCF662F33D08C93A3
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.org&oit=3&cp=12&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["mclimber.org",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2099)
Category:	downloaded
Size (bytes):	2104
Entropy (8bit):	5.900818750530413
Encrypted:	false
SSDEEP:	48:rQF6IfKlgNf9qE9FQQqp55gFHQxh1ZbcruIFeFiHZ9kmMuZsEFxXVmfQffZ+:rQF6IilkFd2Htx3muIX59bs8XEfQffc
MD5:	26BFAB57E90F6B3A9220105C8EAA2155
SHA1:	B61F563729662DFB4CBA8D46685D61B1D0E731F1
SHA-256:	D6CA12755A6C7D2F68BB4AE064CEABBA240AB238482595F2F4779F17D5002749
SHA-512:	5E9428460D8A5297EA139C0A9D5ADF3701609288660D6D8BDBE1B40F89D018378E236F3AB655CF0E2105211268C50C1A1816650D816D60223F2F8110069EB42A
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=m&oit=1&cp=1&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["m",["maps","msn","microsoft","math playground","microsoft 365","max","minecraft","mlb","minesweeper","macys"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{},{"google:entityinfo":"CggvbS8wNHN2NBIOSVQgY29ycG9yYXRpb24yZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1MxYlVSeDdFM0trUUtHa3VnM0xoQXhmMHFmNVN4TThUV1FlVnBreG9ZJnM9MTA6CU1pY3Jvc29mdEoHIzliNmYwMVI2Z3Nfc3NwPWVKemo0dERQMVRjd0tTNHpVV0EwWUhSZzhPTE16VXd1eWlfT1R5c0JBRkdqQnhvcBc\u003d"},{},{},{},{"google:entityinfo":"CgovbS8wOXY2a3BnEgpWaWRlbyBnYW1lMmRodHRwczovL2VuY3J5cHRlZC10Ym4wLmdzdGF0aWMuY29tL2ltYWdlcz9xPXRibjpBTmQ5R2NTaGNIUWhMQnk3RGNUc2NxOTAxdHBRd3B6c05jSkROZzhNaGJqenZMOCZzPTEwOglNaW5lY3JhZnRKByM0MjQyNDJSM2dzX3NzcD1lSnpqNHRMUDFUZXdMRFBMTGtnM1lQVGl6TTNNUzAwdVNrd3JBUUJTendkMHAE"},{"google:entityinfo":"CggvbS8wOXAxNBIPQmFzZWJhbGwgbGVhZ3VlMnVodHRwczovL2VuY3J5cHRlZC10Ym4wLmdzdGF0aWMuY29tL2ltYWdlcz9xPXRibjpBTmQ5R2NRVzY5V05wRVhCZWxCR0ZWY09rbU9xY

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x37, components 3
Category:	downloaded
Size (bytes):	847
Entropy (8bit):	7.128765884379991
Encrypted:	false
SSDEEP:	12:7PBpAYjZZHIgeTP7GioyrLwvgcFbrMQcvGzMb9VXx+DlRkohPZNuVR:rQV7Gi3cBFMQADbU5yTX
MD5:	F9D67D4279F29685241EBCEAE798880C
SHA1:	93256AC303CE673453DD5EA97AC689B4DCF01AD4
SHA-256:	8874DA156D2FE4E341AC944F38561E664E27464176B2D0D97A6B1FED8763D1EF
SHA-512:	542B5E8B7A477AE01F4874F6D9BD20FFB7596D86B07E038DCA9A42B4DB319D46A4E437E2C8611EF6B2C632B326FDDCB393E2042277F59D7E59BC718C68888B18
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRLtE0z4XSfvolYokZ0CYZDDQK6NPYCyvRBtnuS-2Q&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......%.@..".......................................0.........................!..1"Aq...3QRr...%2Ba..........................................................?....q..\|.(!X7..Y....k..W.Q.ZK;Ek.3.C.....\.............v.;F.1..;...#.P=QI.s...3.P..Z./...3(%.<..n1..8...o....k.7.6..h.&..J..G....TT......W.kZu....p.dY$.q.n....c.\..R.^...-...m!.i.2..yl...m*..i..:Ez..:.^#....... .8..[.!..O.mi.+....w.^p......K.....[....[f.};.0 ......'.Kv.X.~..a~.r.}..#...`...$q.....\|}.y.g.Q..G.=....q.Z{X.o..>-...`.y^..rN......U.@@-.5.U....,..y.G..s..p..?w..y.To..;q.w.. ..]\|.vV..."3...L$...r..R.6.b.e.....W%T....;.~S..}.MR.M.[@.Cr...#vA.g....Mx.L........,..^......>.8.......(.(....(...

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (793)
Category:	downloaded
Size (bytes):	798
Entropy (8bit):	5.142560993072772
Encrypted:	false
SSDEEP:	24:IWQAyvClw7fBHslgT9lCuABuoB7HHHHHHHYqmffffffo:I+yvCubKlgZ01BuSEqmffffffo
MD5:	C442B6CC14D85AD9824F01D870BDFAD9
SHA1:	A62B412BF97872BB06FF012A49373DFA5401BEBC
SHA-256:	0E245A14F0F60C318F915DB668071C1B6736B890EDAC90972214F7FDCE0003DF
SHA-512:	87EB0F6ADD263BE7D6945DA1F340C4732A2459A9BB8B488638751236C3A38396FAFD6476D4B1197017D8C9F7536D8AFFC55DEC52D45520062C45C2F36923C03E
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["warner bros game of thrones movie","dragon age the veilguard reviews reddit","geary oklahoma police department","nyc marathon 2024 runners","chilis","apple macbook pro m4 pro","buffalo bills rumors trade","halloween trick or treat times"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (939)
Category:	downloaded
Size (bytes):	944
Entropy (8bit):	5.613315542213893
Encrypted:	false
SSDEEP:	24:4WW6Qvd2BHslgbXP7zrExeAeMkd+fVk32GxlHufPF/59ggZcmffffQff18+:W7wKlgbX3QxeARB9kmGfuf554mffffQj
MD5:	CA93C9A031BBAE9F164FE06182BDE07E
SHA1:	23B8560AAF56C2245E5FDFA146DD43A36394D7ED
SHA-256:	01AA0795865B0FDF7F3F10874D50FE222E65E6442CD2BF37C643042FD9DBFAE4
SHA-512:	2131CC40935FEF98DB20DA14205CD54101F27AE93E1980309185AF0D9146129597040986FCF64714DF7E1254324E552B1B6FAD167F171C34BAEF06B54E70BE52
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=%2F&oit=4&cp=1&pgcl=4&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["/",["/","// in python","/s meaning","/pos meaning","/j meaning","//dino","/24 subnet","/29 subnet","/p meaning","http:////www.epicgames.com/activate"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{},{},{},{},{"google:entityinfo":"Cg0vZy8xMWo0eThmY2tkEgpWaWRlbyBnYW1lMmRodHRwczovL2VuY3J5cHRlZC10Ym4wLmdzdGF0aWMuY29tL2ltYWdlcz9xPXRibjpBTmQ5R2NSTHRFMHo0WFNmdm9sWW9rWjBDWVpERFFLNk5QWUN5dlJCdG51Uy0yUSZzPTEwOg1EaW5vc2F1ciBHYW1lSgcjNDI0MjQyUjNnc19zc3A9ZUp6ajR0VlAxemMwekRLcHRFaEx6azR4WVBSaTA5ZFB5Y3pMQndCTzJRYXZwBA\u003d\u003d"},{},{},{},{}],"google:suggestrelevance":[1118,601,600,555,554,553,552,551,550,400],"google:suggestsubtypes":[[512,433],[512,433,131],[512,433],[512],[512,433,131],[512],[512,433],[512,433,131],[512,433],[44]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","ENTITY","QUERY","QUERY","QUERY","NAVIGATION"],"google:verbatimrelevance":1118}]

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 37, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	481
Entropy (8bit):	7.231016810717436
Encrypted:	false
SSDEEP:	12:6v/7+7vfRWjHKz/cX/QwCtLqhrhSsQOHvUB:DfR4HKjcXo7Lu5Qv
MD5:	08E48A0436B9777060B9FAE5F919F7D8
SHA1:	9A02A089C11F24E72EBF6E13ADA75473574DDD03
SHA-256:	5D3217DEEC15CA85A98BCC385A9C79FA33677C4DEA18314518400BD06D848604
SHA-512:	1026D467EB963B5861890902721BD3F648CB765DD4655580C8AC6BB2862659A2D4C78A7A43E56CE2B90C6182424386C84A4B8E91D95988B4AB1855A245F2503B
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcS1bURx7E3KkQKGkug3LhAxf0qf5SxM8TWQeVpkxoY&s=10
Preview:	.PNG........IHDR...@...%............PLTE..............P"......fff...........................>.u......D............F........................,.l..RRR^^^...qqq...........yyy.........]r.....IDATH...R.0.F7.@R........6.P.._..../2.S...d&.'.-......"....w.....4....z6..4.yC.n.v.Ra...(.._Y.Ba.:.#l..W..s...!..VF.:;..3J.....#.v...E.....T.;.}...;.0.[../m{9\...D.......E....=..<Wt/E..E{..........)..B.9i.a..&..\|.....i.B".g...Y).$..?E...3.~!>..&&&..'y..e..L....IEND.B`.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	1306
Entropy (8bit):	7.532135963792392
Encrypted:	false
SSDEEP:	24:rQSB9nedf/j1xmtJzTFpo6bnhtEjI6Mvp/8WlrOOPE+PPVL:rpnOvQpFp5bnQjI6wyOqEPPVL
MD5:	2FAEF937A191B1C8C5E9FB161EE5FB22
SHA1:	DA63CEF75F52E0CFBAA64034EAD568187F70E81A
SHA-256:	1926E7135715938E2A80C6F40151A9A7E1EB3219E2E4F6DE770979899F210B2E
SHA-512:	022270ECDCB2AE8C21AD50E431B4C1E2D55E2F37ECCC17F99DC917006A34F81855ABAFBB28E2334130EB48F2B8808F1B3AAD199403069D9D4A6C899F738433D4
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQW69WNpEXBelBGFVcOkmOqaGELHb8b-TlFSq4T_G543vvXks-OsPQfvXzC&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@.."........................................5..........................!.1Qa."A..#q...$23BRU..........................................................A.1Q!............?.N}A.X.k.`._..+e..[i]O^.2.'..J..8C.l...-..R.L{A.i....R\|.P.P..rn'.R..KDd.+.H....=.c.,8..Iq.%I....,." .,.11...&..fli...j.=7ZmE.2.&.{m.9.#....(.\....N\......U4.S...O=2......Db.....}.t..z{L9/2..s.y.YP. n.2"...O.=-rY..^.b.g5.:O.c=A..S0...e..O.v]I@<...@.i3.I&~f.?-&...}M+..E...F.....P5.M...RJF...........>N....>..9Je..\ AM.E....}..E.....^;...)....(.W.n.==....2.~..8.@mE.#"l.Qq.7..i.4D.....J7..2...l.\.&....=...k.]q......".m.....RG..U.)$.U.BB.L~.0...NS.qAHna.&........JBb}...2...l..\s..H..0........h....._...h.x`...Pz](Yu.d...Vy{.'p..he.I.}.LI...ihZC.:....@.U..Z...4B.m.....^.zVj.r..O....j?r..s<rn.l.V.v..k3...T.......C....U....:..7N..FM.....9*

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133746
Entropy (8bit):	5.436532243405332
Encrypted:	false
SSDEEP:	3072:2PPvjxd0QniyZ+qQf4VBNQ0pq5vx7U+OUaKszQ:EPvv0yTVBNQ0p2vxI+ORQ
MD5:	AD5797D76F190959A5DD9945C306254F
SHA1:	B567DEF60003C944D7E292835AC7D9EC52DB8404
SHA-256:	3D0CE7E52AFD83532B6C7576DC947938F803F7606CF9050A8A8F7C26A692980E
SHA-512:	23E9ED4D745B70F7A0C75EF98330D78EE424AF1EDEAA4C511A493F94E1E55A3DC327314EC47F0944EC7F865EFB971B16FC6DF5874A24228D8D706133D487D3FB
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
Reputation:	low
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	845
Entropy (8bit):	7.527052791842433
Encrypted:	false
SSDEEP:	24:qs/0cUSIh4QPlqMZFfneZL6L/v+oY3x0ncUeoISiv/wB:qs/WRVfWM/WoYh0FLId4B
MD5:	1954D9690819C001392940BAE66A92DC
SHA1:	AC07A817519F12D3AFD170D9EC06C4E746603F05
SHA-256:	CA958C2DD33036F65F3A84BF41F5DC3C78EDC5EF24B019A773082E6E1D4AAFCC
SHA-512:	676B299FE30858198D4374B674495FE464ECDC873E3C61463D5201F03D3A1CBD33A0C70A5C30C7661A1A9CD80BB0F05F0DF76AE3BE3AB8FD5EA94FE210668A02
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSfkTCSJTbAlZijymjGtjC2-8xAROHGNGUI0WV9ohQ&s=10
Preview:	.PNG........IHDR...@...@............$PLTE...............888...lll\\\............&....IDATX.... .E..........(.v....B..\.m+.-/...7..bf.a....n..!......H..n...f.....@....=.y...l....@n.a ....a.s..O.-.t..w.d.).D..Wb<.D../.e....d.~...b..Hy....K...7@....]......!....{.6.T@\.g....h....=e..h......\|.u..76..........c :x...i..........M.,.G....QY.B!]A1.%.{.@.6L.s.>G...v. >...`.P..%....1..^...D..m.+@.........u.D...".........t.7..$...K.B..1p........~..D..L..@. oC......1 ..V.......k..e'..+:..........&.k1.. ..y.C.`......8/Y.q..L...A. .$....(FZAp...yR.y....$V_+.5..F.q=@....B.RfD.....:.o...P..`)+...B.....Yx.d..y.^...p.....~z.Q.TBK.K9..yO%m....M.....0......&M9.,.....;.5.....j1X..4R-....bAm..#...eW..................E..'..1<..l(....V>Z.+j!....@...f7>.@...].P.3`.X.....+.>\|..'..S./..~......=@.iK=.....\|......~.a55....IEND.B`.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (6339)
Category:	downloaded
Size (bytes):	16358
Entropy (8bit):	4.5482763665152035
Encrypted:	false
SSDEEP:	192:JVtYmMXdjFvf+D2Aeo/XjgCj4wCZpenhKQU6pIGLgkrJ0NDOkWLiNOXLQoD80pfC:L7dIIUkgkKykWLMoLF80pfJl/4nt
MD5:	22E1B0E981AA0A5ADD2E7009AA205D42
SHA1:	311936B2CEEB7D0CDFEE59D11E073D70B4DE362B
SHA-256:	8A3F02337CE956D636B5C3A1FF46D59B96C8AACAF254B3476B65B935F0BC97C4
SHA-512:	AE613904F2B4644999CEB2F70B015AEE55374CE2B00415B32E1DF45E8BA2E1CE66C61D6354A6FD33807730EF1F6BC345BB6CCA78901392BB9ED0BD1596E1EF92
Malicious:	false
Reputation:	low
URL:	https://mclimber.org/
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <title>Default page</title>. <link rel="icon" type="image/x-icon" href="https://hpanel.hostinger.com/favicons/hostinger.png">. <meta charset="utf-8">. <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible">. <meta content="Default page" name="description">. <meta content="width=device-width, initial-scale=1" name="viewport">. <link rel="preconnect" href="https://fonts.googleapis.com">. <link href="https://fonts.googleapis.com/css2?family=DM+Sans&display=swap" rel="stylesheet">. <link href="https://fonts.googleapis.com/css2?family=DM+Sans:wght@400;700&display=swap" rel="stylesheet">. <style>. body {. margin: 0px;. display: flex;. flex-direction: column;. align-items: center;. justify-content: center;. width: 100vw;. height: 100vh;. min-he

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 36848, version 1.0
Category:	downloaded
Size (bytes):	36848
Entropy (8bit):	7.995112872818791
Encrypted:	true
SSDEEP:	768:57Wc/aUQVBlB85eA5/ULxb14Nv3zyMfD9zriUE2knMVQu:57WYWVBlBj2/UVRchr62kMVQu
MD5:	3CCD9AB2050B2F26898B77AF9148B8E2
SHA1:	7F9F46B2FB3F121F3C0600E1182D725B1BE6C176
SHA-256:	258F9F1B553BB57419619F41D3B1445226C7BC63D2A3409EFEF4A68426709E94
SHA-512:	6F9F764D77A563A132E952BD49790F22AA80A88F885BB9AA82F1C25BBC9FBA1451F3E4FADD1EABDF86DC77F7FCDC13C5B183AEE617077F3061E04D54E7246AFE
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/dmsans/v15/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2
Preview:	wOF2..................~.................................J?HVAR.".`?STAT.\'2.../l.....,.A....0..4.6.$..8. .....8..[..Q#.....m..A......N.2Y......6.....e..iIe.m.KZ......=...,.....-+..6"..s.j..23.+.Y.vY....YX'.w^N..@...-mu....!...9.i....DS.=....>.a.t.Q,\t..G.2!.....[../S........D..A&.8...!.A.7K+2Q.c....D..._..i......J(f=7...C.[..n6.B....B.t.z4C.T+...b...!.B..x..r>D....q.C......9.Z....?....{./.......D#..N..O]+..5.5.......{".l.XD...,."a.l0bD..FcD].W..^.qzQ.^.uMA...>h.0.K=.4..h.....T..mG.+.........n+_DG..I.GT..B..igd.X.!u.n&U.;.C.~S.........d....h..{.... .. ..KL...!N.$..5.a.SN......6.=}j.HJ:J.pG.n.~b.AOS..'.T....G.........E.]..O\...\|.p/...l..-.i4?....J0..y.........N.O....3.4&ql...t.T.......I..q..$..........i.n..m..O...v....P.m!...........K...M....r.6Q......:E..$.D>.it...h..>B...R..~.NmF.....x{1`.c..[brR..T....%..\.wz.^..V...?..YG^...eok....b.uu.V.ZqP`.04,.^..L.K.l....i......%Vj..'.0...o..g.....w7z..i`8R.Cj........V.HV.;..w.Qg......pY...b.3$

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 36, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	749
Entropy (8bit):	7.5993095768372
Encrypted:	false
SSDEEP:	12:6v/7Q7QfX9sZqzndfsL0NTTd9FIjnPJMSdX1pBAX217xdx+Bmu5LVluWY0FZYd+:u9s0z6L0N/dsj1HsXY5s5ZlQ0fA+
MD5:	0A558652BBAF2E5377A6CEE20BDAB316
SHA1:	B3A6394DD1472F3724511BDD42E1D8CC178FFEE9
SHA-256:	AB53C916F837DA431B0641D2E4B161BA62B7B8A3F62146D09DBFD82D5F4251FC
SHA-512:	63948406A250BE22FF1B81D9BA6018028EA40FD4E51CFDAEE00E818B61FC9BC854A3EFAEC98D9831A6CCC7CFC439B81A44194046A2049B211D76A86A43425627
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcShcHQhLBy7DcTscq901tpQwpzsNcJDNg8MhbjzvL8&s=10
Preview:	.PNG........IHDR...@...$............PLTER.5S.5...A.$L.0.........~{732(.'.........P.4T.6qki(&%..."."]XV...LHF{ur.....JNB......W.88...qzoch.{~K?F.<.YLS.!,g[`;/8...ymq+^./&- Q.... d./e.IZ@...1q.9s$(o.B?=.4.@Z4...@.'M.....7.....%.....!.:....IDATH..ms.0..@..;`....{.$...u...j2\....m/..dI...._\.9.~....'..Q.. ..~4....I....I .w.....j.]...._..k..i.Yy{.L=..6../.`....+r...).T(r..."....[k.".6..+.K..........T........hsD`.....!mH.u[p.g.A......(<.i/.s.{.3d&........39.D....k.=...miGX..e.......wknG"U-zmC........9d.Z,r2..G.G.........-.{...o.j.....o!{....jGEC.]];$..N..U......hn.X{..9.Q`..a..@..R.8........B.j.s.l...`..{..r.c.}....8.=.1..F{.z/Y...X>M.....h.L I^.d....x`..a..9.>...E.....W.. .EG...^..\........w._..*.Y.......IEND.B`.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 33, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	559
Entropy (8bit):	7.365677034897683
Encrypted:	false
SSDEEP:	12:6v/7Kx3fg+vRRvxoXDi4cvDUrxEg98TFy64L/bpX4ENu:zx3fgARvq5c4rxEg9aFna/bpX4Eo
MD5:	7E7F23968E64EE8BE344118E2CD812AD
SHA1:	A80F55E56FACB8B929DBCA415F7014B38F2942B1
SHA-256:	775C80A0F64122596CC702BBB8F41D8AA57E981CC982057DEFF7DBAE920C881F
SHA-512:	0A6073E6F883DC28798D91F5611FD1689DFAFBB536DE3E742D8A6D867A76606BC33DCDDC4C7AC5364318BF0CB5544D19B651F1FA662D21A192486F7A168BB444
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTKDLxLXSLadkl4JnxDhvyKQhXWxw-tlLiWPY41Nbw&s=10
Preview:	.PNG........IHDR...@...!.....^.].....PLTE........,........................$$$................@@@.4A.......NXfff___......---www............#3.BN.Xb...nnnPPP.....$.x.............d`....ZIDATH..S.r.0....!.G.s.9..II...C..Z.%.W.A..z.c.X.`....`..>.~.v...6[.#...h.l.g..m.=3..vQ.$.UK..q4..:vme...Xi...3,...rv..U...G.vEh.3.C.I$#..=q..........+3C.GE\|...B."..../.).s.P}....z.FB%.[..&..z.d...k..c.!. Sp0...G.=...[......7..(3.T,.j$p.......A@....+.P.(...`$...,......... es.#..2P:.k..^..j:LW...%K.F...A..e#.b....~.......n.(.`.......ocY......IEND.B`.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1742
Entropy (8bit):	5.3663219666758994
Encrypted:	false
SSDEEP:	48:jOEadcJc+ufOEad5N0xXOpadcJc+ufOpad5N0xD:jOEadcJc+ufOEad5NkOpadcJc+ufOpaO
MD5:	EB20B252B805A5B2BAB2CE958FBA1DA2
SHA1:	FD9257857F31339BBA712AFE927A90CFB994F374
SHA-256:	9E373BA82547C73A9E047B95E891FD9E298F6530986778BDA967DF14EB286AD6
SHA-512:	DFFBB8B8682C13A9DAA3AB2EB9F2AA52CB8846C2567A30B8883361728EC4A81F18D7A845902AEE2CD59F1EA1DBDDA29EB74796C2768EFF94049AEAF164936251
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css2?family=DM+Sans:wght@400;700&display=swap
Preview:	/* latin-ext /.@font-face {. font-family: 'DM Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/dmsans/v15/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu6-K6h9Q.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin /.@font-face {. font-family: 'DM Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/dmsans/v15/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ latin-ext */.@font-face {. font-family: 'DM Sans';. font-style: normal;. font-weight: 700;. font-display: swap;. src: url

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (797)
Category:	downloaded
Size (bytes):	802
Entropy (8bit):	5.154237265932066
Encrypted:	false
SSDEEP:	24:hLq+qYWQAkBHslgT9lCuABuoB7HHHHHHHYqmffffffo:lq+/+kKlgZ01BuSEqmffffffo
MD5:	0073BA76AC7609B6B27B76FA94179EFE
SHA1:	9B13D6B009FEAAFF78C6B1209CFA0F676816FE69
SHA-256:	D763FEF4E98D388A5322DB407C6777AAD6A45F028FDD7E4CEB08040F114F4A19
SHA-512:	0FEA773F1EC781F4EB26E3AD9257A8EB1F7837E3EB85BC79FD091804A28B66F403EFB32FACCEB08EFE98DFC8B51B29CC4B82F1EA735EC9ED32B94C4500D1648D
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["monster hunter wilds beta","nyt strands hints","benefits of cayenne pepper water","powerball jackpot lottery numbers","ufc 310 belal muhammad","warner bros game of thrones movie","pce inflation rate","dragon age the veilguard reviews reddit"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	129
Entropy (8bit):	4.635711722697367
Encrypted:	false
SSDEEP:	3:VweI4TwwBHsLpHbGWjLwWkzXFETH1u4:VweI4T5BHsLRGAwWeXFEL13
MD5:	2C83B5E9EDADEF46B0BC7EC85659EA55
SHA1:	72C368A92289A72990BC01965CF6617FE27123A1
SHA-256:	8C36AA4F2F8106106C650251D26F95C9642C8F02C2E31585B2B4942996512EF0
SHA-512:	5CBBF286D7D4556F3E0AF1008A36A0EB56CE752ECF91D6D05AF365EC288EA08D7B57C6D6D11732C08C39B67A1420F27FDD3C2A2B6D760FBC6FEC745E95CE033F
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.&oit=1&cp=9&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["mclimber.",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T13:36:14.420847+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.16	49723	TCP
2024-11-01T13:36:51.880219+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.16	49724	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 13:36:02.221007109 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 13:36:02.524738073 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 13:36:03.128704071 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 13:36:03.784713984 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:03.784759998 CET	443	49705	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:03.784832954 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:03.785343885 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:03.785360098 CET	443	49705	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.238765001 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.238831997 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.238926888 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.239103079 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.239120960 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.258225918 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.258260012 CET	443	49707	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.258331060 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.258523941 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.258538008 CET	443	49707	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.337707043 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 13:36:04.628077030 CET	443	49705	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.628695965 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.628715992 CET	443	49705	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.629801989 CET	443	49705	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.629870892 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.633981943 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.634044886 CET	443	49705	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.634147882 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.634155989 CET	443	49705	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.686723948 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.902437925 CET	443	49705	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.956705093 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.956722975 CET	443	49705	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.958826065 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:04.958882093 CET	443	49705	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:04.958941936 CET	49705	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.087254047 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.087646961 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.087682009 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.089209080 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.089279890 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.089618921 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.089719057 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.089736938 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.097235918 CET	443	49707	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.097496033 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.097507954 CET	443	49707	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.098576069 CET	443	49707	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.098649979 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.098942041 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.099050045 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.099065065 CET	443	49707	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.131730080 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.131758928 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.147711039 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.147718906 CET	443	49707	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.181490898 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.195728064 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.295233011 CET	49689	80	192.168.2.16	192.229.211.108
Nov 1, 2024 13:36:05.372252941 CET	443	49707	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.384479046 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.384542942 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.384584904 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.384617090 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.384624004 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.384649992 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.384712934 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.384717941 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.384723902 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.384785891 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.392769098 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.392826080 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.396914005 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.419713974 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.419727087 CET	443	49707	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.420514107 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.420581102 CET	443	49707	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.420655012 CET	49707	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.451718092 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.451731920 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.499718904 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.501329899 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.501413107 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.501473904 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.501487017 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.505106926 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.505233049 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.505245924 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.509324074 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.509427071 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.509438038 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.518254042 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.518361092 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.518374920 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.526993990 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.527074099 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.527086020 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.535751104 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.535830975 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.535839081 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.544673920 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.544755936 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.544761896 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.552902937 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.552969933 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.552979946 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.561387062 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.561449051 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.561454058 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.611859083 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.611875057 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.618266106 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.618320942 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.618371964 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.618412018 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.618442059 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.618448019 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.618601084 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.618607044 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.621783972 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.621822119 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.621845961 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.621850967 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.621901035 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.625726938 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.629214048 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.629264116 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.629309893 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.629316092 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.629417896 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.635904074 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.642040014 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.642074108 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.642142057 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.642146111 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.642227888 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.648050070 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.654198885 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.654236078 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.654278994 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.654288054 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.654346943 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.660192966 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.666251898 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.666330099 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.666332960 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.666347027 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.666399956 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.672276974 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.678359032 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.678457022 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.678461075 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.684648037 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.684684992 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.684766054 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.684792042 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.684997082 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.690577984 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.696736097 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.696779013 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.696835041 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.696844101 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.696960926 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.702980995 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.708970070 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.709014893 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.709029913 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.709036112 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.709084034 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.714956045 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.735099077 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.735146046 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.735157967 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.735165119 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.735207081 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.735210896 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.735327959 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.735373020 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.735378027 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.738291025 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.738326073 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.738351107 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.738358021 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.738415003 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.743567944 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.748811960 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.748898029 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.748903036 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.754173040 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.754224062 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.754240990 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.754245996 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.754285097 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.759833097 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.762929916 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.762979031 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.762986898 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.762993097 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.763037920 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.766201019 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.769447088 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.769504070 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.769506931 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.769516945 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.769568920 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.772622108 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.775788069 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.775851965 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.775856018 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.779155016 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.779191971 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.779210091 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.779216051 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.779261112 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.782104969 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.833693027 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.833702087 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.833995104 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:05.834081888 CET	443	49706	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:05.834148884 CET	49706	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:06.745774984 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 13:36:07.514265060 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:07.514301062 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:07.514384985 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:07.514535904 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:07.514548063 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:07.622895002 CET	49717	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:07.622951031 CET	443	49717	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:07.623060942 CET	49717	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:07.623285055 CET	49717	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:07.623298883 CET	443	49717	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:08.371340036 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.371596098 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.371618986 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.372581959 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.372678995 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.373466969 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.373523951 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.373598099 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.373605013 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.414731026 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.449965954 CET	49718	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:08.450023890 CET	443	49718	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:08.450131893 CET	49718	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:08.451639891 CET	49718	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:08.451673985 CET	443	49718	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:08.488219023 CET	443	49717	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:08.488493919 CET	49717	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:08.488514900 CET	443	49717	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:08.489378929 CET	443	49717	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:08.489458084 CET	49717	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:08.489726067 CET	49717	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:08.489775896 CET	443	49717	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:08.510255098 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:08.510291100 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:08.510370016 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:08.510560036 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:08.510575056 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:08.542836905 CET	49717	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:08.542843103 CET	443	49717	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:08.590692043 CET	49717	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:08.617702961 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.617762089 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.617794037 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.617820978 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.617822886 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.617839098 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.617868900 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.617877007 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.617925882 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.617932081 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.626210928 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.626352072 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.626377106 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.670698881 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.670711040 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.718723059 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.734994888 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.735034943 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.735275984 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.735281944 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.737359047 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.737412930 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.737418890 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.741813898 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.741871119 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.741878033 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.750309944 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.750370026 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.750375986 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.759134054 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.759183884 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.759188890 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.767887115 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.767951012 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.767956972 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.776627064 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.776694059 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.776704073 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.786356926 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.786420107 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.786427021 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.793456078 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.794107914 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.794115067 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.845716000 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.845722914 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.852206945 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.852268934 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.852273941 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.852323055 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.852387905 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.852392912 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.852876902 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.852932930 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.852938890 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.854468107 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.854521036 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.854526043 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.857079029 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.857209921 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.857218027 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.860410929 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.860440016 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.860465050 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.860470057 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.860517025 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.867098093 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.873111963 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.873142958 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.873208046 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.873214960 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.873569965 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.879376888 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.885212898 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.885250092 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.885267973 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.885273933 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.885334015 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.891339064 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.897351027 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.897377014 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.897428989 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.897434950 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.897473097 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.903333902 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.909282923 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.909310102 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.909328938 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.909334898 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.909384966 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.917470932 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.922866106 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.922933102 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.922939062 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.929058075 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.929099083 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.929115057 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.929121017 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.929160118 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.933402061 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.939409971 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.939460039 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.939466000 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.960071087 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.960123062 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.960129023 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.969458103 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.969507933 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.969517946 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.969610929 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.969635963 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.969670057 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.969680071 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.969685078 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.969722986 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.970412970 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.970518112 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.970581055 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.970587969 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.970834970 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.973948002 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.979176998 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.979216099 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.979228020 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.979233980 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.979351997 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.984615088 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.989928007 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.989962101 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.990001917 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.990008116 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:08.990050077 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:08.993165970 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:09.035716057 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:09.035721064 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:09.036096096 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:09.036133051 CET	443	49716	216.58.206.78	192.168.2.16
Nov 1, 2024 13:36:09.036225080 CET	49716	443	192.168.2.16	216.58.206.78
Nov 1, 2024 13:36:09.299043894 CET	443	49718	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:09.299164057 CET	49718	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:09.302679062 CET	49718	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:09.302699089 CET	443	49718	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:09.303256989 CET	443	49718	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:09.344702959 CET	49718	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:09.391323090 CET	443	49718	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:09.394359112 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.395700932 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:09.395720005 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.396034002 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.396131039 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:09.396632910 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.396692991 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:09.411227942 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:09.411298037 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.411751032 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:09.411767960 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.411895990 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:09.459336042 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.600418091 CET	443	49718	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:09.600478888 CET	443	49718	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:09.600549936 CET	49718	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:09.600711107 CET	49718	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:09.600769043 CET	443	49718	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:09.600805998 CET	49718	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:09.600821972 CET	443	49718	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:09.642388105 CET	49721	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:09.642479897 CET	443	49721	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:09.642601013 CET	49721	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:09.642889023 CET	49721	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:09.642923117 CET	443	49721	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:09.700535059 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.749820948 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:09.749845982 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.750912905 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:09.750967026 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.751084089 CET	443	49719	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:09.751085043 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:09.751133919 CET	49719	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:10.389087915 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 13:36:10.493196964 CET	443	49721	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:10.493308067 CET	49721	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:10.494529963 CET	49721	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:10.494551897 CET	443	49721	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:10.494777918 CET	443	49721	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:10.495881081 CET	49721	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:10.543327093 CET	443	49721	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:10.692706108 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 13:36:10.746011019 CET	443	49721	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:10.746062994 CET	443	49721	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:10.746110916 CET	49721	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:10.747008085 CET	49721	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:10.747030020 CET	443	49721	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:10.747044086 CET	49721	443	192.168.2.16	184.28.90.27
Nov 1, 2024 13:36:10.747051954 CET	443	49721	184.28.90.27	192.168.2.16
Nov 1, 2024 13:36:10.791214943 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:10.791244030 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:10.791309118 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:10.791718006 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:10.791728973 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:11.298722982 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 13:36:11.554712057 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 13:36:11.653891087 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:11.654253960 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:11.654272079 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:11.654786110 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:11.654855967 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:11.655831099 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:11.655893087 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:11.656085014 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:11.656157017 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:11.656196117 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:11.656223059 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:11.656232119 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:11.697771072 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:11.962233067 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:12.016699076 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:12.016711950 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:12.017829895 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:12.017906904 CET	443	49722	142.250.186.174	192.168.2.16
Nov 1, 2024 13:36:12.017976999 CET	49722	443	192.168.2.16	142.250.186.174
Nov 1, 2024 13:36:12.511713982 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 13:36:12.866718054 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:12.866755962 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:12.868015051 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:12.868015051 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:12.868046045 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:13.974230051 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:13.974317074 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:13.977164030 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:13.977173090 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:13.977384090 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.027713060 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:14.034837008 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:14.079358101 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.410067081 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.410092115 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.410100937 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.410119057 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.410131931 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.410140991 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.410197020 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:14.410218000 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.410239935 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:14.410265923 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:14.410677910 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.410746098 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:14.410751104 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.420598030 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:14.420610905 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.420640945 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:14.420773983 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.420813084 CET	443	49723	4.175.87.197	192.168.2.16
Nov 1, 2024 13:36:14.420860052 CET	49723	443	192.168.2.16	4.175.87.197
Nov 1, 2024 13:36:14.857903004 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 13:36:14.921705961 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 13:36:15.161711931 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 13:36:15.768734932 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 13:36:16.982731104 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 13:36:18.500725031 CET	443	49717	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:18.500861883 CET	443	49717	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:18.500931978 CET	49717	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:19.060610056 CET	49717	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:36:19.060632944 CET	443	49717	216.58.212.164	192.168.2.16
Nov 1, 2024 13:36:19.394768000 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 13:36:19.730732918 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 13:36:21.168735027 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 13:36:24.204739094 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 13:36:29.338747025 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 13:36:33.811825037 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 13:36:50.816406965 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:50.816462994 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:50.816559076 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:50.817182064 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:50.817198038 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.269073963 CET	49697	80	192.168.2.16	199.232.214.172
Nov 1, 2024 13:36:51.269171953 CET	49698	80	192.168.2.16	199.232.214.172
Nov 1, 2024 13:36:51.274899960 CET	80	49697	199.232.214.172	192.168.2.16
Nov 1, 2024 13:36:51.275047064 CET	49697	80	192.168.2.16	199.232.214.172
Nov 1, 2024 13:36:51.275793076 CET	80	49698	199.232.214.172	192.168.2.16
Nov 1, 2024 13:36:51.275890112 CET	49698	80	192.168.2.16	199.232.214.172
Nov 1, 2024 13:36:51.610435009 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.610553980 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.611928940 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.611957073 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.612174034 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.613712072 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.659332991 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.878118992 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.878144979 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.878195047 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.878267050 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.878309965 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.878344059 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.878386021 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.880073071 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.880105972 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.880139112 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.880148888 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.880177975 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.880203009 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.881652117 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.881684065 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:36:51.881715059 CET	49724	443	192.168.2.16	20.109.210.53
Nov 1, 2024 13:36:51.881730080 CET	443	49724	20.109.210.53	192.168.2.16
Nov 1, 2024 13:37:07.683285952 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:07.683343887 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:07.683528900 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:07.683744907 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:07.683763981 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:08.521085978 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:08.521398067 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:08.521414995 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:08.521702051 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:08.521995068 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:08.522053957 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:08.575803041 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:15.332248926 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:15.332673073 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:15.332719088 CET	443	49727	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:15.332818031 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:15.333082914 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:15.333095074 CET	443	49727	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:15.379340887 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:15.608752012 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:15.608793974 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:15.608863115 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:15.608884096 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:15.663826942 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:15.663845062 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:15.664022923 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:15.664103985 CET	443	49726	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:15.664163113 CET	49726	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:16.196683884 CET	443	49727	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:16.197087049 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:16.197124958 CET	443	49727	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:16.200520039 CET	443	49727	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:16.200606108 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:16.200959921 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:16.201035976 CET	443	49727	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:16.201141119 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:16.201148033 CET	443	49727	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:16.254847050 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:16.471438885 CET	443	49727	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:16.526840925 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:16.526865005 CET	443	49727	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:16.528363943 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:16.528460979 CET	443	49727	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:16.528533936 CET	49727	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:19.626873016 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:19.626903057 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:19.626997948 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:19.627211094 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:19.627223015 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.238400936 CET	49729	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.238447905 CET	443	49729	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.238523960 CET	49729	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.238756895 CET	49729	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.238770008 CET	443	49729	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.473568916 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.473908901 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.473936081 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.474879026 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.474945068 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.475209951 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.475260019 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.475353003 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.475358963 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.517978907 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.752370119 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.752408028 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.752464056 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.752482891 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.805844069 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.805855036 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.805995941 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:20.806034088 CET	443	49728	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:20.806094885 CET	49728	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.095531940 CET	443	49729	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:21.095782042 CET	49729	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.095802069 CET	443	49729	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:21.096890926 CET	443	49729	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:21.097176075 CET	49729	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.097354889 CET	443	49729	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:21.141844988 CET	49729	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.687503099 CET	49729	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.731339931 CET	443	49729	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:21.896692991 CET	49729	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.896820068 CET	443	49729	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:21.896938086 CET	49729	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.897934914 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.897977114 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:21.898140907 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.898332119 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.898345947 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:21.998410940 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.998475075 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:21.998647928 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.998852015 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:21.998882055 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.102031946 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.102093935 CET	443	49737	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.102214098 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.102413893 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.102444887 CET	443	49737	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.262173891 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.262221098 CET	443	49738	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.262322903 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.262533903 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.262577057 CET	443	49738	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.362540960 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.362617016 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.362720966 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.362934113 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.362970114 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.468008041 CET	49740	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.468029022 CET	443	49740	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.468142986 CET	49740	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.468394041 CET	49740	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.468400955 CET	443	49740	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.751343966 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.751687050 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.751719952 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.755502939 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.755589962 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.755902052 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.756057978 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.756063938 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.756081104 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.802869081 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.802881956 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.850867033 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.852782965 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.853077888 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.853110075 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.854588032 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.854666948 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.854913950 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.854995012 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.898855925 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.898909092 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.946846008 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.949903965 CET	443	49737	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.950154066 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.950234890 CET	443	49737	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.951124907 CET	443	49737	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.951205015 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.951426029 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.951487064 CET	443	49737	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:22.994960070 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:22.994986057 CET	443	49737	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.042963982 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.048371077 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.089982986 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.090013027 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.092519045 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.092601061 CET	443	49735	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.092663050 CET	49735	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.132718086 CET	443	49738	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.133004904 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.133044958 CET	443	49738	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.134470940 CET	443	49738	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.134634972 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.134812117 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.134896994 CET	443	49738	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.185961962 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.185985088 CET	443	49738	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.231400013 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.231724977 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.231755018 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.233205080 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.233292103 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.233571053 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.233655930 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.233856916 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.281862020 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.281879902 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.322904110 CET	443	49740	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.323081970 CET	49740	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.323103905 CET	443	49740	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.326626062 CET	443	49740	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.326699972 CET	49740	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.326909065 CET	49740	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.327080965 CET	443	49740	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.329854965 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.377835035 CET	49740	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:23.377845049 CET	443	49740	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:23.425858974 CET	49740	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:24.004182100 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:24.047329903 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:24.289473057 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:24.337898970 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:24.337934971 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:24.339102983 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:24.339169979 CET	443	49736	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:24.339272976 CET	49736	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:26.772921085 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:26.815361023 CET	443	49737	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:26.928848028 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:26.928920984 CET	443	49737	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:26.929014921 CET	49737	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:26.929610968 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:26.971368074 CET	443	49738	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:26.992522001 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:26.992583036 CET	443	49738	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:26.992728949 CET	443	49738	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:26.992772102 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:26.992805958 CET	49738	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:27.039710999 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:27.087335110 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:27.311364889 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:27.357865095 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:27.357892990 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:27.358726025 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:27.358781099 CET	443	49739	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:27.358850002 CET	49739	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:33.332983971 CET	443	49740	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:33.333161116 CET	443	49740	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:33.333242893 CET	49740	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:35.062853098 CET	49740	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:35.062874079 CET	443	49740	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:37.378480911 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:37.378547907 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:37.378659010 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:37.379064083 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:37.379121065 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:37.379178047 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:37.379355907 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:37.379388094 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:37.379489899 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:37.379506111 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.038187981 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.038547993 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.038585901 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.039501905 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.039585114 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.040653944 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.040716887 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.040864944 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.040882111 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.043622971 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.043839931 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.043865919 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.045629025 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.045701027 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.046506882 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.046648979 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.082061052 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.097965002 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.097980976 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.145863056 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.261812925 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.303898096 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.303939104 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.351902962 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.380450964 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.380460978 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.380501032 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.380516052 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.380527973 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.380611897 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:38.380650997 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.380650997 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.380700111 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.381052971 CET	49742	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:38.381081104 CET	443	49742	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:41.328063011 CET	49699	443	192.168.2.16	40.126.32.134
Nov 1, 2024 13:37:41.328063011 CET	49700	80	192.168.2.16	192.229.221.95
Nov 1, 2024 13:37:41.333415985 CET	443	49699	40.126.32.134	192.168.2.16
Nov 1, 2024 13:37:41.333580971 CET	49699	443	192.168.2.16	40.126.32.134
Nov 1, 2024 13:37:41.334141970 CET	80	49700	192.229.221.95	192.168.2.16
Nov 1, 2024 13:37:41.334194899 CET	49700	80	192.168.2.16	192.229.221.95
Nov 1, 2024 13:37:44.689110041 CET	49701	443	192.168.2.16	40.126.32.134
Nov 1, 2024 13:37:44.698836088 CET	443	49701	40.126.32.134	192.168.2.16
Nov 1, 2024 13:37:44.699023962 CET	49701	443	192.168.2.16	40.126.32.134
Nov 1, 2024 13:37:45.252528906 CET	49755	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:45.252562046 CET	443	49755	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:45.252631903 CET	49755	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:45.252882004 CET	49755	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:45.252893925 CET	443	49755	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:46.338646889 CET	443	49755	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:46.338975906 CET	49755	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:46.338993073 CET	443	49755	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:46.339458942 CET	443	49755	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:46.339736938 CET	49755	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:46.339822054 CET	443	49755	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:46.339880943 CET	49755	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:46.382128954 CET	49755	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:46.382138014 CET	443	49755	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:46.613563061 CET	443	49755	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:46.653939009 CET	49755	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:46.653949022 CET	443	49755	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:46.655133963 CET	49755	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:46.655184031 CET	443	49755	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:46.655253887 CET	49755	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:49.187155962 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.188560009 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.188610077 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.188695908 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.188920021 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.188936949 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.231337070 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.333980083 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.388981104 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.389005899 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.436991930 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.450664997 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.450695038 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.450712919 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.450757027 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.450757980 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.450776100 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.450928926 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.450928926 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.450939894 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.451219082 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.451273918 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.451497078 CET	49743	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.451508045 CET	443	49743	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.837129116 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.837548971 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.837579966 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.837888002 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.838191986 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:49.838310957 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:49.883913040 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:51.081958055 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:51.082026005 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:51.082140923 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:51.082515955 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:51.082545996 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:51.919739008 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:51.920150042 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:51.920212984 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:51.921087980 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:51.921190977 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:51.921473026 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:51.921533108 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:51.921612978 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:51.921629906 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:51.974904060 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:52.194648981 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:52.194689035 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:52.194714069 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:52.194751978 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:52.194816113 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:52.194899082 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:52.196502924 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:52.196620941 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:52.196667910 CET	443	49761	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:52.196738005 CET	49761	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:57.730850935 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:57.732168913 CET	49762	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:57.732215881 CET	443	49762	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:57.732309103 CET	49762	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:57.732810974 CET	49762	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:57.732826948 CET	443	49762	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:57.771330118 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.015665054 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.020636082 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.020644903 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.020684004 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.020859003 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:58.020859003 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:58.020885944 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.020953894 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:58.032242060 CET	49756	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:58.032254934 CET	443	49756	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.386640072 CET	443	49762	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.386971951 CET	49762	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:58.386995077 CET	443	49762	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.388384104 CET	443	49762	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.388704062 CET	49762	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:58.388890982 CET	443	49762	195.35.38.103	192.168.2.16
Nov 1, 2024 13:37:58.439953089 CET	49762	443	192.168.2.16	195.35.38.103
Nov 1, 2024 13:37:59.483388901 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:59.483436108 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:37:59.483529091 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:59.484096050 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:37:59.484110117 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.347179890 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.347654104 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.347693920 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.349684000 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.349802017 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.350064993 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.350164890 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.350215912 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.395337105 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.404966116 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.404995918 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.451996088 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.628370047 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.678970098 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.679011106 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.680329084 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.680516958 CET	443	49766	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.680625916 CET	49766	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.822524071 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.822590113 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:00.822683096 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.823007107 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:00.823019028 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:01.705038071 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:01.705636024 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:01.705662012 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:01.706698895 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:01.706810951 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:01.707190037 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:01.707257986 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:01.707381010 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:01.707387924 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:01.759947062 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:01.991837025 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:02.047082901 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:02.047112942 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:02.094934940 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:02.192354918 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:02.192562103 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:02.192612886 CET	443	49767	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:02.192667961 CET	49767	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:07.735009909 CET	49769	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:07.735047102 CET	443	49769	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:07.735238075 CET	49769	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:07.735481977 CET	49769	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:07.735493898 CET	443	49769	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:08.612086058 CET	443	49769	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:08.612396002 CET	49769	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:08.612418890 CET	443	49769	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:08.613276958 CET	443	49769	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:08.613346100 CET	49769	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:08.613622904 CET	49769	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:08.613675117 CET	443	49769	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:08.655925989 CET	49769	443	192.168.2.16	216.58.212.164
Nov 1, 2024 13:38:08.655932903 CET	443	49769	216.58.212.164	192.168.2.16
Nov 1, 2024 13:38:08.703926086 CET	49769	443	192.168.2.16	216.58.212.164

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 13:36:02.783795118 CET	53	56193	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:02.870655060 CET	53	60832	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:03.776815891 CET	59005	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:36:03.777163029 CET	64193	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:36:03.783787012 CET	53	64193	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:03.784262896 CET	53	59005	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:04.107770920 CET	53	60238	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:07.506949902 CET	50298	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:36:07.507075071 CET	61057	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:36:07.513103962 CET	53	62381	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:07.513770103 CET	53	61057	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:07.513967037 CET	53	50298	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:08.503005981 CET	60252	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:36:08.503151894 CET	64678	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:36:08.509757042 CET	53	60252	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:08.509768963 CET	53	64678	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:21.095205069 CET	53	55669	1.1.1.1	192.168.2.16
Nov 1, 2024 13:36:39.920125008 CET	53	62843	1.1.1.1	192.168.2.16
Nov 1, 2024 13:37:02.547436953 CET	53	54648	1.1.1.1	192.168.2.16
Nov 1, 2024 13:37:02.773138046 CET	53	54854	1.1.1.1	192.168.2.16
Nov 1, 2024 13:37:06.554002047 CET	138	138	192.168.2.16	192.168.2.255
Nov 1, 2024 13:37:20.815437078 CET	53	58015	1.1.1.1	192.168.2.16
Nov 1, 2024 13:37:31.361139059 CET	53	60039	1.1.1.1	192.168.2.16
Nov 1, 2024 13:37:37.308398962 CET	50747	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:37:37.308764935 CET	60461	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:37:37.364115000 CET	53	50747	1.1.1.1	192.168.2.16
Nov 1, 2024 13:37:37.458440065 CET	53	60461	1.1.1.1	192.168.2.16
Nov 1, 2024 13:37:38.312915087 CET	53	60829	1.1.1.1	192.168.2.16
Nov 1, 2024 13:37:39.524353981 CET	54596	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:37:39.524667978 CET	60958	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:37:39.556379080 CET	53	60958	1.1.1.1	192.168.2.16
Nov 1, 2024 13:37:40.839767933 CET	55190	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:37:40.839934111 CET	60851	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:37:40.847678900 CET	53	60851	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 1, 2024 13:37:37.458657026 CET	192.168.2.16	1.1.1.1	c233	(Port unreachable)	Destination Unreachable
Nov 1, 2024 13:37:39.556493044 CET	192.168.2.16	1.1.1.1	c262	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 13:36:03.776815891 CET	192.168.2.16	1.1.1.1	0xb4aa	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:36:03.777163029 CET	192.168.2.16	1.1.1.1	0xc4ae	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 1, 2024 13:36:07.506949902 CET	192.168.2.16	1.1.1.1	0xc335	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:36:07.507075071 CET	192.168.2.16	1.1.1.1	0x6d0e	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 1, 2024 13:36:08.503005981 CET	192.168.2.16	1.1.1.1	0x5dcf	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:36:08.503151894 CET	192.168.2.16	1.1.1.1	0xc094	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 1, 2024 13:37:37.308398962 CET	192.168.2.16	1.1.1.1	0xe038	Standard query (0)	mclimber.org	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:37:37.308764935 CET	192.168.2.16	1.1.1.1	0xbffd	Standard query (0)	mclimber.org	65	IN (0x0001)	false
Nov 1, 2024 13:37:39.524353981 CET	192.168.2.16	1.1.1.1	0x5db8	Standard query (0)	hpanel.hostinger.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:37:39.524667978 CET	192.168.2.16	1.1.1.1	0xe549	Standard query (0)	hpanel.hostinger.com	65	IN (0x0001)	false
Nov 1, 2024 13:37:40.839767933 CET	192.168.2.16	1.1.1.1	0xb4a2	Standard query (0)	hpanel.hostinger.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:37:40.839934111 CET	192.168.2.16	1.1.1.1	0x1e1c	Standard query (0)	hpanel.hostinger.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 13:36:03.783787012 CET	1.1.1.1	192.168.2.16	0xc4ae	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 1, 2024 13:36:03.784262896 CET	1.1.1.1	192.168.2.16	0xb4aa	No error (0)	www.google.com		216.58.212.164	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:36:07.513770103 CET	1.1.1.1	192.168.2.16	0x6d0e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:36:07.513967037 CET	1.1.1.1	192.168.2.16	0xc335	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:36:07.513967037 CET	1.1.1.1	192.168.2.16	0xc335	No error (0)	plus.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:36:08.509757042 CET	1.1.1.1	192.168.2.16	0x5dcf	No error (0)	play.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:37:37.364115000 CET	1.1.1.1	192.168.2.16	0xe038	No error (0)	mclimber.org		195.35.38.103	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:37:39.531589985 CET	1.1.1.1	192.168.2.16	0x5db8	No error (0)	hpanel.hostinger.com	hpanel.hostinger.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:37:39.556379080 CET	1.1.1.1	192.168.2.16	0xe549	No error (0)	hpanel.hostinger.com	hpanel.hostinger.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:37:40.847093105 CET	1.1.1.1	192.168.2.16	0xb4a2	No error (0)	hpanel.hostinger.com	hpanel.hostinger.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:37:40.847678900 CET	1.1.1.1	192.168.2.16	0x1e1c	No error (0)	hpanel.hostinger.com	hpanel.hostinger.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

play.google.com

fs.microsoft.com

slscr.update.microsoft.com

mclimber.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49705	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:36:04 UTC	627	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:36:04 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:36:04 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Ue1iwJ82gR73Zj01SZYT1g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:36:04 UTC	112	IN	Data Raw: 33 31 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 69 6e 74 65 6c 20 65 61 72 6e 69 6e 67 73 20 72 65 70 6f 72 74 22 2c 22 66 6f 72 74 6e 69 74 65 20 72 65 6d 69 78 20 6c 69 76 65 20 65 76 65 6e 74 22 2c 22 77 69 6e 74 65 72 20 66 6f 72 65 63 61 73 74 22 2c 22 64 72 61 67 6f 6e 20 61 67 65 20 74 68 65 20 76 65 69 6c 67 75 61 72 64 20 72 Data Ascii: 315)]}'["",["intel earnings report","fortnite remix live event","winter forecast","dragon age the veilguard r
2024-11-01 12:36:04 UTC	684	IN	Data Raw: 65 76 69 65 77 73 20 72 65 64 64 69 74 22 2c 22 67 65 61 72 79 20 6f 6b 6c 61 68 6f 6d 61 20 70 6f 6c 69 63 65 20 64 65 70 61 72 74 6d 65 6e 74 22 2c 22 6e 65 77 20 79 6f 72 6b 20 6a 65 74 73 20 68 6f 75 73 74 6f 6e 20 74 65 78 61 6e 73 22 2c 22 63 6f 64 20 7a 6f 6d 62 69 65 73 20 62 65 73 74 20 67 75 6e 73 22 2c 22 68 61 77 61 69 69 20 6d 61 75 6e 61 20 6b 65 61 20 73 6e 6f 77 66 61 6c 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 Data Ascii: eviews reddit","geary oklahoma police department","new york jets houston texans","cod zombies best guns","hawaii mauna kea snowfall"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcg
2024-11-01 12:36:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49706	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:36:05 UTC	530	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:36:05 UTC	1042	IN	HTTP/1.1 200 OK Version: 691307345 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 01 Nov 2024 12:36:05 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:36:05 UTC	336	IN	Data Raw: 32 31 36 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2162)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-01 12:36:05 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-01 12:36:05 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-11-01 12:36:05 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-11-01 12:36:05 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-11-01 12:36:05 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 31 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700301,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-11-01 12:36:05 UTC	1328	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"
2024-11-01 12:36:05 UTC	371	IN	Data Raw: 31 36 63 0d 0a 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 6d 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e Data Ascii: 16c;else throw Error(\"F\");else a\u003d_.me(a);return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.n
2024-11-01 12:36:05 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 64 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 63 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 Data Ascii: 8000\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.qe\u003dfunction(a,b,c){return _.Ab(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){return _.de(_.Yc(a,b))};_.S\u003dfunction(a,b){return _.ce(_.Yc(a,b))};_.T\u003dfunc
2024-11-01 12:36:05 UTC	1378	IN	Data Raw: 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e 3a 5c 22 72 6f 77 53 70 61 6e 5c 22 2c 74 79 70 65 3a 5c 22 74 79 70 65 5c 22 2c 75 73 65 6d 61 70 3a 5c 22 75 73 65 4d 61 70 5c 22 2c 76 61 6c 69 67 6e 3a 5c 22 76 41 6c 69 67 6e 5c 22 2c 77 69 64 74 68 3a 5c 22 77 69 64 74 68 5c 22 7d 3b 5c 6e 5f 2e 42 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 Data Ascii: \"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\",nonce:\"nonce\",role:\"role\",rowspan:\"rowSpan\",type:\"type\",usemap:\"useMap\",valign:\"vAlign\",width:\"width\"};\n_.Be\u003dfunction(a){return a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49707	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:36:05 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:36:05 UTC	957	IN	HTTP/1.1 200 OK Version: 691307345 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 01 Nov 2024 12:36:05 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:36:05 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-01 12:36:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49716	216.58.206.78	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:36:08 UTC	737	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:36:08 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 31 Oct 2024 14:25:53 GMT Expires: Fri, 31 Oct 2025 14:25:53 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 79815 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-01 12:36:08 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-01 12:36:08 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-01 12:36:08 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-01 12:36:08 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-01 12:36:08 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-01 12:36:08 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-01 12:36:08 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-01 12:36:08 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-01 12:36:08 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-01 12:36:08 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49718	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:36:09 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 12:36:09 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=101373 Date: Fri, 01 Nov 2024 12:36:09 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49719	142.250.186.174	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:36:09 UTC	722	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:36:09 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 34 36 34 35 36 36 39 35 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730464566956",null,null,null,
2024-11-01 12:36:09 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=zF8xtzTc0NcsPdSRW3P6dOoT4DsDFRChY_5Xy1ZYdUNZFQExonPfsVssZB_6pPiLxTfHoMrfkc1AuDpDnbYI0l6DHwlxz786PDeQCx8J5hFtjjHIJ4m4liTRX8d1Es26qkSm-gE_x2a99beJVwNjqCcGRNY4NV2rxopWY25OBcunvUnf1g; expires=Sat, 03-May-2025 12:36:09 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 01 Nov 2024 12:36:09 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 01 Nov 2024 12:36:09 GMT Connection: close Transfer-Encoding: chunked
2024-11-01 12:36:09 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-01 12:36:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49721	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:36:10 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 12:36:10 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=101429 Date: Fri, 01 Nov 2024 12:36:10 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-01 12:36:10 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49722	142.250.186.174	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:36:11 UTC	918	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 910 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=zF8xtzTc0NcsPdSRW3P6dOoT4DsDFRChY_5Xy1ZYdUNZFQExonPfsVssZB_6pPiLxTfHoMrfkc1AuDpDnbYI0l6DHwlxz786PDeQCx8J5hFtjjHIJ4m4liTRX8d1Es26qkSm-gE_x2a99beJVwNjqCcGRNY4NV2rxopWY25OBcunvUnf1g
2024-11-01 12:36:11 UTC	910	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 34 36 34 35 36 39 32 34 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730464569242",null,null,null,
2024-11-01 12:36:11 UTC	944	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg; expires=Sat, 03-May-2025 12:36:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 01 Nov 2024 12:36:11 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 01 Nov 2024 12:36:11 GMT Connection: close Transfer-Encoding: chunked
2024-11-01 12:36:11 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-01 12:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49723	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:36:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FLwRc7WtRWp4FN3&MD=ZcsGvDtX HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 12:36:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 8b8bc4a3-fd04-4c03-a9ad-328316abccc5 MS-RequestId: f37a90ec-2888-4c64-97c7-1220823892c8 MS-CV: xDf0U2NPV0qhzZKQ.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 12:36:14 GMT Connection: close Content-Length: 24490
2024-11-01 12:36:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-01 12:36:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49724	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:36:51 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FLwRc7WtRWp4FN3&MD=ZcsGvDtX HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 12:36:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ad16a154-59c2-4d7c-aea8-12cdebd17d89 MS-RequestId: 76c139cc-4e8a-4328-9fab-a87b755b3bbd MS-CV: xDtfgZkK4Uy/LJNb.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 12:36:50 GMT Connection: close Content-Length: 30005
2024-11-01 12:36:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-01 12:36:51 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49726	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:15 UTC	817	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
2024-11-01 12:37:15 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:37:15 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-32rEgkFFhGqEX4U908a3ww' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:37:15 UTC	112	IN	Data Raw: 39 35 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 61 79 6c 69 67 68 74 20 73 61 76 69 6e 67 20 74 69 6d 65 20 63 6c 6f 63 6b 73 22 2c 22 69 6f 73 20 31 38 2e 31 20 61 70 70 6c 65 20 69 6e 74 65 6c 6c 69 67 65 6e 63 65 20 66 65 61 74 75 72 65 73 22 2c 22 68 6f 6e 67 20 6b 6f 6e 67 20 63 72 69 63 6b 65 74 20 73 69 78 65 73 22 2c 22 63 Data Ascii: 955)]}'["",["daylight saving time clocks","ios 18.1 apple intelligence features","hong kong cricket sixes","c
2024-11-01 12:37:15 UTC	1378	IN	Data Raw: 68 69 6c 69 73 22 2c 22 68 61 6c 6c 6f 77 65 65 6e 20 74 72 69 63 6b 20 6f 72 20 74 72 65 61 74 69 6e 67 20 68 6f 75 72 73 22 2c 22 70 65 74 65 72 20 73 74 65 72 6e 20 70 65 6c 6f 74 6f 6e 20 63 65 6f 22 2c 22 73 75 72 76 69 76 6f 72 20 34 37 20 72 65 63 61 70 22 2c 22 6e 79 20 6a 65 74 73 20 6b 69 63 6b 65 72 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 Data Ascii: hilis","halloween trick or treating hours","peter stern peloton ceo","survivor 47 recap","ny jets kickers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google
2024-11-01 12:37:15 UTC	906	IN	Data Raw: 64 6c 4f 54 4d 79 4f 57 68 77 4e 47 39 56 61 53 74 78 62 6c 67 7a 57 54 56 42 62 43 38 34 51 56 70 6f 56 48 52 35 51 6a 52 72 65 55 31 48 4e 44 4a 6d 64 45 6c 76 51 6c 42 4b 55 6e 70 76 4e 6d 4e 31 4c 7a 46 45 57 47 68 74 4e 6d 4a 78 65 56 4e 48 56 6c 42 78 55 6e 46 54 5a 54 4e 5a 55 6d 77 31 52 31 46 75 64 33 4a 48 56 44 64 4a 53 6e 4e 78 53 30 35 42 56 6e 55 77 63 57 70 75 4e 6d 31 69 54 6e 64 50 4e 44 52 7a 52 48 56 4a 54 31 52 49 52 6d 64 6b 65 48 68 5a 51 56 5a 4d 5a 45 56 71 4d 6d 56 77 4e 32 55 31 4d 55 46 34 4e 30 4e 35 62 32 74 6a 51 30 4a 54 63 47 68 57 59 6c 42 36 5a 6e 6c 54 59 6e 4e 57 4e 48 70 78 4d 58 5a 55 63 30 64 71 4d 56 64 49 59 6a 42 50 53 31 4a 56 4d 33 5a 53 65 54 4e 4a 55 31 51 34 54 58 42 4b 63 30 35 6d 65 57 55 35 61 6e 67 31 52 Data Ascii: dlOTMyOWhwNG9VaStxblgzWTVBbC84QVpoVHR5QjRreU1HNDJmdElvQlBKUnpvNmN1LzFEWGhtNmJxeVNHVlBxUnFTZTNZUmw1R1Fud3JHVDdJSnNxS05BVnUwcWpuNm1iTndPNDRzRHVJT1RIRmdkeHhZQVZMZEVqMmVwN2U1MUF4N0N5b2tjQ0JTcGhWYlB6ZnlTYnNWNHpxMXZUc0dqMVdIYjBPS1JVM3ZSeTNJU1Q4TXBKc05meWU5ang1R
2024-11-01 12:37:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49727	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:16 UTC	830	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
2024-11-01 12:37:16 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:37:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-EOwA0GAZgqIYkmAKKRripA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:37:16 UTC	112	IN	Data Raw: 33 32 32 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 6f 6e 73 74 65 72 20 68 75 6e 74 65 72 20 77 69 6c 64 73 20 62 65 74 61 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 22 2c 22 62 65 6e 65 66 69 74 73 20 6f 66 20 63 61 79 65 6e 6e 65 20 70 65 70 70 65 72 20 77 61 74 65 72 22 2c 22 70 6f 77 65 72 62 61 6c 6c 20 6a 61 63 Data Ascii: 322)]}'["",["monster hunter wilds beta","nyt strands hints","benefits of cayenne pepper water","powerball jac
2024-11-01 12:37:16 UTC	697	IN	Data Raw: 6b 70 6f 74 20 6c 6f 74 74 65 72 79 20 6e 75 6d 62 65 72 73 22 2c 22 75 66 63 20 33 31 30 20 62 65 6c 61 6c 20 6d 75 68 61 6d 6d 61 64 22 2c 22 77 61 72 6e 65 72 20 62 72 6f 73 20 67 61 6d 65 20 6f 66 20 74 68 72 6f 6e 65 73 20 6d 6f 76 69 65 22 2c 22 70 63 65 20 69 6e 66 6c 61 74 69 6f 6e 20 72 61 74 65 22 2c 22 64 72 61 67 6f 6e 20 61 67 65 20 74 68 65 20 76 65 69 6c 67 75 61 72 64 20 72 65 76 69 65 77 73 20 72 65 64 64 69 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f Data Ascii: kpot lottery numbers","ufc 310 belal muhammad","warner bros game of thrones movie","pce inflation rate","dragon age the veilguard reviews reddit"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwo
2024-11-01 12:37:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49728	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:20 UTC	851	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=m&oit=1&cp=1&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
2024-11-01 12:37:20 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:37:20 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-HHPk4KiS7AbVNV2dBa4R2A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:37:20 UTC	112	IN	Data Raw: 38 33 38 0d 0a 29 5d 7d 27 0a 5b 22 6d 22 2c 5b 22 6d 61 70 73 22 2c 22 6d 73 6e 22 2c 22 6d 69 63 72 6f 73 6f 66 74 22 2c 22 6d 61 74 68 20 70 6c 61 79 67 72 6f 75 6e 64 22 2c 22 6d 69 63 72 6f 73 6f 66 74 20 33 36 35 22 2c 22 6d 61 78 22 2c 22 6d 69 6e 65 63 72 61 66 74 22 2c 22 6d 6c 62 22 2c 22 6d 69 6e 65 73 77 65 65 70 65 72 22 Data Ascii: 838)]}'["m",["maps","msn","microsoft","math playground","microsoft 365","max","minecraft","mlb","minesweeper"
2024-11-01 12:37:20 UTC	1378	IN	Data Raw: 2c 22 6d 61 63 79 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 7d 2c 7b 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 67 76 62 53 38 77 4e 48 4e 32 4e 42 49 4f 53 56 51 67 59 32 39 79 63 47 39 79 59 58 52 70 62 32 34 79 5a 47 68 30 64 48 42 7a 4f 69 38 76 5a 57 35 6a 63 6e 6c 77 64 47 56 6b 4c 58 52 69 62 6a 41 75 5a 33 4e 30 59 58 52 70 59 79 35 6a 62 32 30 76 61 57 31 68 5a 32 56 7a 50 33 45 39 64 47 4a 75 4f 6b 46 4f 5a 44 6c 48 59 31 4d Data Ascii: ,"macys"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{},{"google:entityinfo":"CggvbS8wNHN2NBIOSVQgY29ycG9yYXRpb24yZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1M
2024-11-01 12:37:20 UTC	621	IN	Data Raw: 63 33 52 76 63 6d 55 67 59 32 39 74 63 47 46 75 65 54 4a 6b 61 48 52 30 63 48 4d 36 4c 79 39 6c 62 6d 4e 79 65 58 42 30 5a 57 51 74 64 47 4a 75 4d 43 35 6e 63 33 52 68 64 47 6c 6a 4c 6d 4e 76 62 53 39 70 62 57 46 6e 5a 58 4d 2f 63 54 31 30 59 6d 34 36 51 55 35 6b 4f 55 64 6a 56 45 74 45 54 48 68 4d 57 46 4e 4d 59 57 52 72 62 44 52 4b 62 6e 68 45 61 48 5a 35 53 31 46 6f 57 46 64 34 64 79 31 30 62 45 78 70 56 31 42 5a 4e 44 46 4f 59 6e 63 6d 63 7a 30 78 4d 44 6f 47 54 57 46 6a 65 53 64 7a 53 67 63 6a 4e 44 49 30 4d 6a 51 79 55 6a 4a 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 46 41 78 56 47 4e 33 54 45 31 70 64 56 4e 47 52 6d 64 4f 52 30 49 77 57 56 42 43 61 58 70 56 4d 55 31 79 61 58 64 48 51 55 56 4b 4f 55 4a 6d 56 58 41 58 22 7d 5d 2c 22 67 6f Data Ascii: c3RvcmUgY29tcGFueTJkaHR0cHM6Ly9lbmNyeXB0ZWQtdGJuMC5nc3RhdGljLmNvbS9pbWFnZXM/cT10Ym46QU5kOUdjVEtETHhMWFNMYWRrbDRKbnhEaHZ5S1FoWFd4dy10bExpV1BZNDFOYncmcz0xMDoGTWFjeSdzSgcjNDI0MjQyUjJnc19zc3A9ZUp6ajR0VFAxVGN3TE1pdVNGRmdOR0IwWVBCaXpVMU1yaXdHQUVKOUJmVXAX"}],"go
2024-11-01 12:37:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49729	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:21 UTC	852	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mc&oit=1&cp=2&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49735	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:22 UTC	858	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber&oit=1&cp=8&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
2024-11-01 12:37:23 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:37:22 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-0T3jZFFwfQC-afGjTc10WA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:37:23 UTC	112	IN	Data Raw: 31 35 37 0d 0a 29 5d 7d 27 0a 5b 22 6d 63 6c 69 6d 62 65 72 22 2c 5b 22 63 6c 69 6d 62 65 72 20 6d 61 63 68 69 6e 65 22 2c 22 63 6c 69 6d 62 65 72 20 6d 61 72 63 22 2c 22 6d 79 63 6c 69 6d 62 22 2c 22 63 6c 69 6d 62 65 72 20 6c 69 62 72 61 72 79 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 Data Ascii: 157)]}'["mclimber",["climber machine","climber marc","myclimb","climber library"],["","","",""],[],{"google:c
2024-11-01 12:37:23 UTC	238	IN	Data Raw: 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 36 30 31 2c 36 30 30 2c 35 35 31 2c 35 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 35 31 32 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 31 33 30 30 7d 5d 0d 0a Data Ascii: lientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,551,550],"google:suggestsubtypes":[[512,546],[512,546],[512,546],[512,546]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":1300}]
2024-11-01 12:37:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49736	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:24 UTC	859	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.&oit=1&cp=9&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
2024-11-01 12:37:24 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:37:24 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-BozO28P-lncpH4IyrCGYlw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:37:24 UTC	112	IN	Data Raw: 38 31 0d 0a 29 5d 7d 27 0a 5b 22 6d 63 6c 69 6d 62 65 72 2e 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 74 72 75 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 Data Ascii: 81)]}'["mclimber.",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:ver
2024-11-01 12:37:24 UTC	23	IN	Data Raw: 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: batimrelevance":851}]
2024-11-01 12:37:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49737	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:26 UTC	861	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.o&oit=1&cp=10&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49738	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:26 UTC	862	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.or&oit=1&cp=11&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49739	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:27 UTC	863	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.org&oit=3&cp=12&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
2024-11-01 12:37:27 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:37:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-FHInMInwypndY5upYAnk3w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:37:27 UTC	112	IN	Data Raw: 38 34 0d 0a 29 5d 7d 27 0a 5b 22 6d 63 6c 69 6d 62 65 72 2e 6f 72 67 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 74 72 75 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a Data Ascii: 84)]}'["mclimber.org",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:
2024-11-01 12:37:27 UTC	26	IN	Data Raw: 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: verbatimrelevance":851}]
2024-11-01 12:37:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49742	195.35.38.103	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:38 UTC	655	OUT	GET / HTTP/1.1 Host: mclimber.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:37:38 UTC	454	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/8.2.15 content-type: text/html; charset=UTF-8 transfer-encoding: chunked date: Fri, 01 Nov 2024 12:37:38 GMT server: LiteSpeed platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-01 12:37:38 UTC	914	IN	Data Raw: 33 66 65 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 44 65 66 61 75 6c 74 20 70 61 67 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 70 61 6e 65 6c 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 73 2f 68 6f 73 74 69 6e 67 65 72 2e 70 6e 67 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 Data Ascii: 3fe6<!DOCTYPE html><html lang="en"> <head> <title>Default page</title> <link rel="icon" type="image/x-icon" href="https://hpanel.hostinger.com/favicons/hostinger.png"> <meta charset="utf-8"> <meta content="IE=edge,ch
2024-11-01 12:37:38 UTC	14994	IN	Data Raw: 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 76 77 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 37 35 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 34 46 35 46 46 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d Data Ascii: center; width: 100vw; height: 100vh; min-height: 675px; background-color: #F4F5FF; } p { width: 100%; left: 0px; font-
2024-11-01 12:37:38 UTC	458	IN	Data Raw: 35 2e 38 33 33 33 48 34 2e 36 36 36 36 37 56 34 2e 31 36 36 36 37 48 31 30 2e 35 56 32 2e 35 48 34 2e 36 36 36 36 37 43 33 2e 37 34 31 36 37 20 32 2e 35 20 33 20 33 2e 32 35 20 33 20 34 2e 31 36 36 36 37 56 31 35 2e 38 33 33 33 43 33 20 31 36 2e 37 35 20 33 2e 37 34 31 36 37 20 31 37 2e 35 20 34 2e 36 36 36 36 37 20 31 37 2e 35 48 31 36 2e 33 33 33 33 43 31 37 2e 32 35 20 31 37 2e 35 20 31 38 20 31 36 2e 37 35 20 31 38 20 31 35 2e 38 33 33 33 56 31 30 48 31 36 2e 33 33 33 33 56 31 35 2e 38 33 33 33 5a 4d 31 32 2e 31 36 36 37 20 32 2e 35 56 34 2e 31 36 36 36 37 48 31 35 2e 31 35 38 33 4c 36 2e 39 36 36 36 37 20 31 32 2e 33 35 38 33 4c 38 2e 31 34 31 36 37 20 31 33 2e 35 33 33 33 4c 31 36 2e 33 33 33 33 20 35 2e 33 34 31 36 37 56 38 2e 33 33 33 33 33 48 31 Data Ascii: 5.8333H4.66667V4.16667H10.5V2.5H4.66667C3.74167 2.5 3 3.25 3 4.16667V15.8333C3 16.75 3.74167 17.5 4.66667 17.5H16.3333C17.25 17.5 18 16.75 18 15.8333V10H16.3333V15.8333ZM12.1667 2.5V4.16667H15.1583L6.96667 12.3583L8.14167 13.5333L16.3333 5.34167V8.33333H1
2024-11-01 12:37:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49755	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:46 UTC	817	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
2024-11-01 12:37:46 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:37:46 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-hfA1YNXf1jcOKIXMxQVT3Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:37:46 UTC	112	IN	Data Raw: 33 33 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 63 61 72 79 20 68 61 6c 6c 6f 77 65 65 6e 20 6d 75 73 69 63 20 68 61 6c 6c 6f 77 65 65 6e 20 61 6d 62 69 65 6e 63 65 22 2c 22 6e 79 20 6a 65 74 73 20 6b 69 63 6b 65 72 73 22 2c 22 68 61 6c 6c 6f 77 65 65 6e 20 66 6f 6f 64 20 64 65 61 6c 73 20 63 68 69 70 6f 74 6c 65 22 2c 22 62 6c 61 Data Ascii: 335)]}'["",["scary halloween music halloween ambience","ny jets kickers","halloween food deals chipotle","bla
2024-11-01 12:37:46 UTC	716	IN	Data Raw: 63 6b 20 6f 70 73 20 6e 75 6b 65 74 6f 77 6e 20 72 65 6c 65 61 73 65 22 2c 22 74 65 72 6d 69 6e 75 73 20 65 61 73 74 65 72 20 65 67 67 20 62 6c 61 63 6b 20 6f 70 73 20 36 22 2c 22 61 69 72 20 69 6e 64 69 61 20 66 6c 69 67 68 74 73 20 63 61 6e 63 65 6c 6c 65 64 22 2c 22 72 75 62 65 6e 20 61 6d 6f 72 69 6d 20 6d 61 6e 63 68 65 73 74 65 72 20 75 6e 69 74 65 64 22 2c 22 67 72 6f 74 65 73 71 75 65 72 69 65 20 65 70 69 73 6f 64 65 20 31 30 20 65 6e 64 69 6e 67 20 65 78 70 6c 61 69 6e 65 64 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 Data Ascii: ck ops nuketown release","terminus easter egg black ops 6","air india flights cancelled","ruben amorim manchester united","grotesquerie episode 10 ending explained"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:group
2024-11-01 12:37:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49743	195.35.38.103	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:49 UTC	681	OUT	GET / HTTP/1.1 Host: mclimber.org Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:37:49 UTC	449	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/8.2.15 content-type: text/html; charset=UTF-8 content-length: 16358 date: Fri, 01 Nov 2024 12:37:49 GMT server: LiteSpeed platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-01 12:37:49 UTC	919	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 44 65 66 61 75 6c 74 20 70 61 67 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 70 61 6e 65 6c 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 73 2f 68 6f 73 74 69 6e 67 65 72 2e 70 6e 67 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <title>Default page</title> <link rel="icon" type="image/x-icon" href="https://hpanel.hostinger.com/favicons/hostinger.png"> <meta charset="utf-8"> <meta content="IE=edge,chrome=1
2024-11-01 12:37:49 UTC	14994	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 76 77 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 37 35 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 34 46 35 46 46 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b Data Ascii: width: 100vw; height: 100vh; min-height: 675px; background-color: #F4F5FF; } p { width: 100%; left: 0px; font-size: 16px;
2024-11-01 12:37:49 UTC	445	IN	Data Raw: 36 36 37 56 34 2e 31 36 36 36 37 48 31 30 2e 35 56 32 2e 35 48 34 2e 36 36 36 36 37 43 33 2e 37 34 31 36 37 20 32 2e 35 20 33 20 33 2e 32 35 20 33 20 34 2e 31 36 36 36 37 56 31 35 2e 38 33 33 33 43 33 20 31 36 2e 37 35 20 33 2e 37 34 31 36 37 20 31 37 2e 35 20 34 2e 36 36 36 36 37 20 31 37 2e 35 48 31 36 2e 33 33 33 33 43 31 37 2e 32 35 20 31 37 2e 35 20 31 38 20 31 36 2e 37 35 20 31 38 20 31 35 2e 38 33 33 33 56 31 30 48 31 36 2e 33 33 33 33 56 31 35 2e 38 33 33 33 5a 4d 31 32 2e 31 36 36 37 20 32 2e 35 56 34 2e 31 36 36 36 37 48 31 35 2e 31 35 38 33 4c 36 2e 39 36 36 36 37 20 31 32 2e 33 35 38 33 4c 38 2e 31 34 31 36 37 20 31 33 2e 35 33 33 33 4c 31 36 2e 33 33 33 33 20 35 2e 33 34 31 36 37 56 38 2e 33 33 33 33 33 48 31 38 56 32 2e 35 48 31 32 2e 31 36 Data Ascii: 667V4.16667H10.5V2.5H4.66667C3.74167 2.5 3 3.25 3 4.16667V15.8333C3 16.75 3.74167 17.5 4.66667 17.5H16.3333C17.25 17.5 18 16.75 18 15.8333V10H16.3333V15.8333ZM12.1667 2.5V4.16667H15.1583L6.96667 12.3583L8.14167 13.5333L16.3333 5.34167V8.33333H18V2.5H12.16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49761	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:51 UTC	817	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
2024-11-01 12:37:52 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:37:52 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ehUXiTEBRVCO0LOfFOm9vg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:37:52 UTC	112	IN	Data Raw: 61 66 36 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 69 63 72 6f 73 6f 66 74 20 65 61 72 6e 69 6e 67 73 20 72 65 70 6f 72 74 22 2c 22 77 69 6e 74 65 72 20 66 6f 72 65 63 61 73 74 22 2c 22 62 72 61 76 65 73 20 74 72 61 64 65 20 6a 6f 72 67 65 20 73 6f 6c 65 72 22 2c 22 64 61 79 6c 69 67 68 74 20 73 61 76 69 6e 67 20 74 69 6d 65 20 63 6c Data Ascii: af6)]}'["",["microsoft earnings report","winter forecast","braves trade jorge soler","daylight saving time cl
2024-11-01 12:37:52 UTC	1378	IN	Data Raw: 6f 63 6b 73 22 2c 22 69 6f 73 20 31 38 2e 31 20 61 70 70 6c 65 20 69 6e 74 65 6c 6c 69 67 65 6e 63 65 20 66 65 61 74 75 72 65 73 22 2c 22 68 61 6c 6c 6f 77 65 65 6e 20 74 72 69 63 6b 20 6f 72 20 74 72 65 61 74 69 6e 67 20 68 6f 75 72 73 22 2c 22 61 67 61 74 68 61 20 61 6c 6c 20 61 6c 6f 6e 67 20 6d 61 72 76 65 6c 22 2c 22 63 68 69 6c 69 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 Data Ascii: ocks","ios 18.1 apple intelligence features","halloween trick or treating hours","agatha all along marvel","chilis"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d
2024-11-01 12:37:52 UTC	1323	IN	Data Raw: 54 6c 32 4d 54 52 76 52 57 68 72 54 48 4e 31 55 55 31 5a 51 54 64 71 59 30 31 71 4d 69 39 33 51 31 5a 76 4f 55 78 53 65 48 51 32 62 31 6c 31 4e 53 74 73 61 48 56 58 59 56 68 77 63 57 4e 53 4f 57 46 47 56 48 55 35 65 55 46 48 55 6d 67 34 5a 46 46 6c 59 57 34 35 54 33 52 69 4e 58 42 6b 53 7a 46 35 4e 57 64 75 57 6a 64 54 4e 48 51 33 59 56 4e 54 55 6b 64 46 61 6b 74 35 54 30 68 69 59 6e 52 34 64 48 70 50 59 32 34 76 56 44 52 79 63 56 68 72 55 31 68 51 62 7a 4a 47 59 56 52 52 59 6c 4e 61 59 6c 49 33 55 30 73 30 59 55 38 32 55 69 74 72 65 6e 68 50 62 32 73 79 5a 48 70 35 55 47 4a 51 64 6c 56 47 63 55 5a 75 63 43 39 53 64 44 42 55 51 32 5a 57 65 45 64 54 52 6e 52 75 4f 58 64 42 65 6e 67 30 4e 45 6c 78 4d 47 4a 4c 65 47 78 72 64 46 42 55 52 56 56 70 57 45 31 49 Data Ascii: Tl2MTRvRWhrTHN1UU1ZQTdqY01qMi93Q1ZvOUxSeHQ2b1l1NStsaHVXYVhwcWNSOWFGVHU5eUFHUmg4ZFFlYW45T3RiNXBkSzF5NWduWjdTNHQ3YVNTUkdFakt5T0hiYnR4dHpPY24vVDRycVhrU1hQbzJGYVRRYlNaYlI3U0s0YU82UitrenhPb2syZHp5UGJQdlVGcUZucC9SdDBUQ2ZWeEdTRnRuOXdBeng0NElxMGJLeGxrdFBURVVpWE1I
2024-11-01 12:37:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49756	195.35.38.103	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:37:57 UTC	681	OUT	GET / HTTP/1.1 Host: mclimber.org Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:37:58 UTC	449	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/8.2.15 content-type: text/html; charset=UTF-8 content-length: 16358 date: Fri, 01 Nov 2024 12:37:57 GMT server: LiteSpeed platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-01 12:37:58 UTC	919	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 44 65 66 61 75 6c 74 20 70 61 67 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 70 61 6e 65 6c 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 73 2f 68 6f 73 74 69 6e 67 65 72 2e 70 6e 67 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <title>Default page</title> <link rel="icon" type="image/x-icon" href="https://hpanel.hostinger.com/favicons/hostinger.png"> <meta charset="utf-8"> <meta content="IE=edge,chrome=1
2024-11-01 12:37:58 UTC	14994	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 76 77 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 37 35 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 34 46 35 46 46 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b Data Ascii: width: 100vw; height: 100vh; min-height: 675px; background-color: #F4F5FF; } p { width: 100%; left: 0px; font-size: 16px;
2024-11-01 12:37:58 UTC	445	IN	Data Raw: 36 36 37 56 34 2e 31 36 36 36 37 48 31 30 2e 35 56 32 2e 35 48 34 2e 36 36 36 36 37 43 33 2e 37 34 31 36 37 20 32 2e 35 20 33 20 33 2e 32 35 20 33 20 34 2e 31 36 36 36 37 56 31 35 2e 38 33 33 33 43 33 20 31 36 2e 37 35 20 33 2e 37 34 31 36 37 20 31 37 2e 35 20 34 2e 36 36 36 36 37 20 31 37 2e 35 48 31 36 2e 33 33 33 33 43 31 37 2e 32 35 20 31 37 2e 35 20 31 38 20 31 36 2e 37 35 20 31 38 20 31 35 2e 38 33 33 33 56 31 30 48 31 36 2e 33 33 33 33 56 31 35 2e 38 33 33 33 5a 4d 31 32 2e 31 36 36 37 20 32 2e 35 56 34 2e 31 36 36 36 37 48 31 35 2e 31 35 38 33 4c 36 2e 39 36 36 36 37 20 31 32 2e 33 35 38 33 4c 38 2e 31 34 31 36 37 20 31 33 2e 35 33 33 33 4c 31 36 2e 33 33 33 33 20 35 2e 33 34 31 36 37 56 38 2e 33 33 33 33 33 48 31 38 56 32 2e 35 48 31 32 2e 31 36 Data Ascii: 667V4.16667H10.5V2.5H4.66667C3.74167 2.5 3 3.25 3 4.16667V15.8333C3 16.75 3.74167 17.5 4.66667 17.5H16.3333C17.25 17.5 18 16.75 18 15.8333V10H16.3333V15.8333ZM12.1667 2.5V4.16667H15.1583L6.96667 12.3583L8.14167 13.5333L16.3333 5.34167V8.33333H18V2.5H12.16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49766	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:38:00 UTC	817	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
2024-11-01 12:38:00 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:38:00 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-OCzmyy9U1iS5IRqHZ7NdVA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:38:00 UTC	112	IN	Data Raw: 33 31 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 61 72 6e 65 72 20 62 72 6f 73 20 67 61 6d 65 20 6f 66 20 74 68 72 6f 6e 65 73 20 6d 6f 76 69 65 22 2c 22 64 72 61 67 6f 6e 20 61 67 65 20 74 68 65 20 76 65 69 6c 67 75 61 72 64 20 72 65 76 69 65 77 73 20 72 65 64 64 69 74 22 2c 22 67 65 61 72 79 20 6f 6b 6c 61 68 6f 6d 61 20 70 6f 6c Data Ascii: 31e)]}'["",["warner bros game of thrones movie","dragon age the veilguard reviews reddit","geary oklahoma pol
2024-11-01 12:38:00 UTC	693	IN	Data Raw: 69 63 65 20 64 65 70 61 72 74 6d 65 6e 74 22 2c 22 6e 79 63 20 6d 61 72 61 74 68 6f 6e 20 32 30 32 34 20 72 75 6e 6e 65 72 73 22 2c 22 63 68 69 6c 69 73 22 2c 22 61 70 70 6c 65 20 6d 61 63 62 6f 6f 6b 20 70 72 6f 20 6d 34 20 70 72 6f 22 2c 22 62 75 66 66 61 6c 6f 20 62 69 6c 6c 73 20 72 75 6d 6f 72 73 20 74 72 61 64 65 22 2c 22 68 61 6c 6c 6f 77 65 65 6e 20 74 72 69 63 6b 20 6f 72 20 74 72 65 61 74 20 74 69 6d 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a Data Ascii: ice department","nyc marathon 2024 runners","chilis","apple macbook pro m4 pro","buffalo bills rumors trade","halloween trick or treat times"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJ
2024-11-01 12:38:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49767	216.58.212.164	443	6872	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:38:01 UTC	853	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=%2F&oit=4&cp=1&pgcl=4&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
2024-11-01 12:38:01 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:38:01 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-d_FNirbmA3SXi7IxGVtPhA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:38:01 UTC	112	IN	Data Raw: 33 62 30 0d 0a 29 5d 7d 27 0a 5b 22 2f 22 2c 5b 22 2f 22 2c 22 2f 2f 20 69 6e 20 70 79 74 68 6f 6e 22 2c 22 2f 73 20 6d 65 61 6e 69 6e 67 22 2c 22 2f 70 6f 73 20 6d 65 61 6e 69 6e 67 22 2c 22 2f 6a 20 6d 65 61 6e 69 6e 67 22 2c 22 2f 2f 64 69 6e 6f 22 2c 22 2f 32 34 20 73 75 62 6e 65 74 22 2c 22 2f 32 39 20 73 75 62 6e 65 74 22 2c 22 Data Ascii: 3b0)]}'["/",["/","// in python","/s meaning","/pos meaning","/j meaning","//dino","/24 subnet","/29 subnet","
2024-11-01 12:38:01 UTC	839	IN	Data Raw: 2f 70 20 6d 65 61 6e 69 6e 67 22 2c 22 68 74 74 70 3a 2f 2f 2f 2f 77 77 77 2e 65 70 69 63 67 61 6d 65 73 2e 63 6f 6d 2f 61 63 74 69 76 61 74 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 7d 2c 7b 7d 2c 7b 7d 2c 7b 7d 2c 7b 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 30 76 5a 79 38 78 4d 57 6f 30 65 54 68 6d 59 32 74 6b 45 67 70 57 61 57 52 6c 62 79 42 6e 59 57 31 6c 4d 6d 52 6f 64 48 52 77 63 7a 6f 76 4c 32 56 75 59 33 4a 35 63 48 52 6c 5a Data Ascii: /p meaning","http:////www.epicgames.com/activate"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{},{},{},{},{"google:entityinfo":"Cg0vZy8xMWo0eThmY2tkEgpWaWRlbyBnYW1lMmRodHRwczovL2VuY3J5cHRlZ
2024-11-01 12:38:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:36:01
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:36:02
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1964,i,1547439328298854920,3861948928415475423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:36:03
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mclimber%5B.%5Dorg/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.16:49723
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.16:49724

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FLwRc7WtRWp4FN3&MD=ZcsGvDtX HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FLwRc7WtRWp4FN3&MD=ZcsGvDtX HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=m&oit=1&cp=1&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mc&oit=1&cp=2&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber&oit=1&cp=8&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.&oit=1&cp=9&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.o&oit=1&cp=10&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.or&oit=1&cp=11&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=mclimber.org&oit=3&cp=12&pgcl=7&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: mclimber.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: mclimber.orgConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: mclimber.orgConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=%2F&oit=4&cp=1&pgcl=4&gs_rn=42&psi=sMsMOKFzqc78b70S&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=v1YR9QK0_Ggrj1KlYPXvmbqnf_eQP5ha-T8CC468bGez_HcDiDtBfUSGOS6MaWcz9LkqVOiyrzfHcyOG7LBrSKv9zHSPLraseKB4t-7WW28JD7Mx4vIDUE9FaLeyUhvTy_baPq4cjXDpJJ02uqkuTk2CUbR1Vtn8-SHAlEs0Qq2ch7-1zBJEsaB5hg

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: mclimber.org
Source: global traffic	DNS traffic detected: DNS query: hpanel.hostinger.com

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89