Edit tour

Windows Analysis Report
https://courtscali.com/

Overview

General Information

Sample URL:	https://courtscali.com/
Analysis ID:	1577816
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3568 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2384,i,1323912080641651643,15447930956936917658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://courtscali.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ET PHISHING BULLSreCaptcha Credential Phish Landing Page M1 2024-10-17

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T19:25:53.530106+0100	2057273	1	Successful Credential Theft Detected	193.143.1.14	443	192.168.2.5	49714	TCP

ET PHISHING Suspected BULLSreCaptcha Credential Phish Landing Page M2 2024-10-17

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T19:25:53.530106+0100	2057274	1	Successful Credential Theft Detected	193.143.1.14	443	192.168.2.5	49714	TCP

HTTP traffic detected: POST /recaptcha/api2/reload?k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 9571sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-protobufferAccept: */*Origin: https://www.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 18 Dec 2024 18:26:11 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Source: chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_78.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_78.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_89.2.dr, chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr, chromecache_91.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__.
Source: chromecache_83.2.dr, chromecache_89.2.dr, chromecache_96.2.dr, chromecache_91.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: classification engine

Classification label: mal64.win@17/48@10/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2384,i,1323912080641651643,15447930956936917658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://courtscali.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2384,i,1323912080641651643,15447930956936917658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://courtscali.com/	100%	Avira URL Cloud	malware

Source	Detection	Scanner	Label	Link
https://courtscali.com/favicon.ico	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.181.132	true	false		high
courtscali.com	193.143.1.14	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://courtscali.com/favicon.ico	true	Avira URL Cloud: malware	unknown
https://www.google.com/js/bg/Xe7AbhhPfZcEikoNmhghBXAEhOusDIBKWKS_roS4Q7E.js	false		high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA4YFRzCJeJ7iEASfaybY4kTmVYn01WAd41JO-iACJK_XSTVni0zjqDPxkAQ28jYhIba4FYwlGJwjJNdYd1EzyW3hmMaCPN7Z5lm7WAFiixSJTpzx2XM4re58oquNlyltuelM1o_8cFtN4W5qrpanFT0BMotJc6UCxEFoUmctwPZXIJUDDhuoDN-9YZELODO6se-duYB&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7	false		high
https://www.google.com/recaptcha/api2/reload?k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7	false		high
https://www.google.com/recaptcha/api.js	false		high
https://courtscali.com/	true		unknown
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF	false		high
https://www.google.com/recaptcha/api2/bframe?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://play.google.com/log?format=json&hasfast=true	chromecache_78.2.dr	false	high
https://www.gstatic.c..?/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__.	chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	false	high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	false	high
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	false	high
https://support.google.com/recaptcha/#6175971	chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	false	high
https://support.google.com/recaptcha#6262736	chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	false	high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	false	high
https://www.google.com/recaptcha/api2/	chromecache_89.2.dr, chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr, chromecache_91.2.dr	false	high
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	false	high
https://cloud.google.com/contact	chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	false	high
https://support.google.com/recaptcha	chromecache_78.2.dr	false	high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_94.2.dr, chromecache_79.2.dr, chromecache_78.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
193.143.1.14	courtscali.com	unknown	57271	BITWEB-ASRU	true

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577816
Start date and time:	2024-12-18 19:24:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://courtscali.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.win@17/48@10/4

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.99, 64.233.162.84, 172.217.17.78, 142.250.181.142, 142.250.181.74, 172.217.17.67, 2.20.68.210, 192.229.221.95, 216.58.208.234, 172.217.19.234, 172.217.21.42, 142.250.181.10, 142.250.181.138, 172.217.19.202, 142.250.181.42, 172.217.17.74, 172.217.19.170, 142.250.181.106, 172.217.17.42, 142.250.181.67, 172.217.17.35, 23.50.252.137, 20.109.210.53, 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, ajax.googleapis.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://courtscali.com/

Input	Output
URL: https://courtscali.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://courtscali.com
URL: https://courtscali.com/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script exhibits moderate-risk behaviors, including external data transmission and potential redirects to unknown domains. However, the intent appears to be related to form validation and redirection, which are common web application behaviors. Further review may be needed to ensure the script is not being used for malicious purposes." }
var onReturnCallback = function (response) { var url = 'valider.php'; $.ajax({ url: url, type: 'post', dataType: 'json', data: { response: response }, success: function (data) { var res = data.success.toString(); var red = data.redirect.toString(); if (res == 'true') { window.location.reload(); }else{ window.location.replace(red); } }, }); };
URL: https://courtscali.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://courtscali.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://courtscali.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://courtscali.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://courtscali.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://courtscali.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 17:25:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978609633523568
Encrypted:	false
SSDEEP:	48:8DdnT/rdHuidAKZdA19ehwiZUklqehEJy+3:8FPq/y
MD5:	E83082C07197D236DECC56C399AE350A
SHA1:	5DB9707D9D3EBC8229BF4852FF596906B99587BA
SHA-256:	4CACAC3BBC7F320F70538A75AEEE6083890FF7542E9975E885A8EB40E221F47B
SHA-512:	C13A0A7C3B59221F2A04D5DF56846B8F63B092025D9292E0D7BB0AE64EECDD264BFCBB7AC3CE83F3572BC518B27B035367DF688FF64415A9A3C3235AE9FAAFF5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....6.AzQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y4.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y4.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y4.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y4............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y8............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i.L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 17:25:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994532251140341
Encrypted:	false
SSDEEP:	48:8adnT/rdHuidAKZdA1weh/iZUkAQkqeh1Jy+2:86Pg9QKy
MD5:	D48C7DE46CC6731E98156889B1F47118
SHA1:	28A69308BAB4C6081EAD0B119E39ABFB061F4F6B
SHA-256:	4162F859784FE07A227AB429108038560D7CDD12FE333B54AC1826B808E2D6E0
SHA-512:	9579C3854799E63BA70B2DA5B1818A0A90E73E2C40A9CB0CFE5AE6A4BC413A652F441D2AF5BAD8A5F6D1589F904C480D2A6A46CDF42EC0009BF52B2B96D22430
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....J.AzQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y4.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y4.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y4.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y4............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y8............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i.L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.00460138530879
Encrypted:	false
SSDEEP:	48:8xUdnT/rsHuidAKZdA14tseh7sFiZUkmgqeh7s/Jy+BX:8xcPPnDy
MD5:	F0B4AA61DEFA5683CABAFEB5F247D28E
SHA1:	27A9FE9AFB3BC33436669C25F2C3D773CBD5242D
SHA-256:	8883ADFDF346BAA1501D5A2A561D0BBED0F565571DB75FA625D1D2FD11C18F1B
SHA-512:	1AF015CBBE51C4AB0512A04BEFBFB05D39EA2F754EBBED27B828E609B2400145E30C4406BC3E2C766B029813E8EE63CE877201FC74B2FF8D7EF39BDE0D6578FF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y4.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y4.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y4.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y4............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i.L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 17:25:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.995105774567336
Encrypted:	false
SSDEEP:	48:8EodnT/rdHuidAKZdA1vehDiZUkwqeh5Jy+R:8fPrZy
MD5:	64BD6BFB2D629CD43B9DDEEA37972BAC
SHA1:	54B7115C82509C7498FB05132FF97A71557C1316
SHA-256:	B95F8AE44D61A3E77D3A357541584AD158C79FA6F1B83755EE26D56B9DB0E86E
SHA-512:	0B1F269CBEE1D29C8C1A56F475EFDD3BD0E49DD3947FF300A9030CD5E01EB5CAC6EEFFB4BAE6293CDE7C403F63251A1FC38DA39F6998688F2D2BB76A40676C7B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....#.AzQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y4.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y4.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y4.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y4............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y8............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i.L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 17:25:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.979149298285586
Encrypted:	false
SSDEEP:	48:8BdnT/rdHuidAKZdA1hehBiZUk1W1qehbJy+C:8jPr91y
MD5:	CBAB4A2BF0C06D913B6CB787CB08F7B0
SHA1:	71E45BDB46CCFF92E432AF13192FCE23F90EF4EE
SHA-256:	4CC8E85A734FB0D3FD27FDADCF3704BD188C23EDF19B3E1761800DAE18A5754D
SHA-512:	977F4BC57C905571B5A6CEE2BF91BF63F65B3ECAD56270E70581D05556829CA004D428F38B5050D153FDC2858F09EEE6635468E3B9FCF0953B924F89D4D4FBE5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....r.AzQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y4.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y4.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y4.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y4............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y8............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i.L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 17:25:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.991995386572998
Encrypted:	false
SSDEEP:	48:8nUdnT/rdHuidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbhJy+yT+:8ncPLT/TbxWOvTbDy7T
MD5:	432BF40FF7B6F46EC9C646AB1E0EDE93
SHA1:	43E77C7B8190349C256DD9311A6F9DE149D5CDA6
SHA-256:	FFA432CE0DE00AB0E70AFF81273EE99FD1ADAD6861393EC73E90F455A11FD8C2
SHA-512:	0D0AF022E93F9A76A98621EDEBFFF5300B8117308CC544CED96138875E171F464F3A3D488D7463FD3700FF98ED419C598AB53003B73F5F1D2CB09A33ED41C1CE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Y..AzQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y4.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y4.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y4.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y4............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y8............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i.L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/refresh_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0
Category:	downloaded
Size (bytes):	15340
Entropy (8bit):	7.983406336508752
Encrypted:	false
SSDEEP:	384:F2gPJde0V2iGrQyD8b3k/tigCdeNqOUd47SH0tsGm:4gPVV2NQE8b3ldeNWH0Wb
MD5:	19B7A0ADFDD4F808B53AF7E2CE2AD4E5
SHA1:	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA
SHA-256:	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
SHA-512:	49DA16000687AC81FC4CA9E9112BDCA850BB9F32E0AF2FE751ABC57A8E9C3382451B50998CEB9DE56FC4196F1DC7EF46BBA47933FC47EB4538124870B7630036
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Preview:	wOF2......;........d..;..........................d..z..J.`..L.Z..<.....\..`..^...x.6.$..6. ..\|. ..8..z%......Q.{..q...FF.kd .8.(..d..).!C...Y.JA...r. ..GH8F......nW...".2&....2<..+C...p...b..SC.......J......z.-..Q..#6&1zUe../\...l.....<.....9s...E~.]B-..B.wY..o......Q..A.F..1j.......-.`P% .. ,..@1.0..~.....WWW.d.u<c{..^.R.+..w....&.........A......+C....(.N.....0.~..0.J.;.Nu..7....]..m.H.....[h.GL3....?)....c.H...2.3.}y........SXI\|..iVN'%E.D.W....r..<`....i....6;E$.....U.$j.@...._.......R2....WS...k.vz.R.'a9!^...N....h.._.....c.%."..S.2.16B...o.2}.pmU[.\|.LI....2.....OWQLO1-....s..8.(...".\|6...6R.. ..M-.zO.}w)..v..mXxX...c..3#.+.v....F`.Z;.zQ.......r,....Yo.....g.h....+.....O.3Y..)Y.8.!....elX......._.3.}k~u.{ C..H.z..FP........@...d..)T.R...L.H.J.j.@..............$...E......y...3.b...I.h u.+%.HA.\..9..8..X.!....gx...].:..V..C...._..X..!....6..)...GM:E.....O.Z.}k.;.T.k..D.k.O..D5.r..."......?..T.Q.A...CF...3g.5.Dn<.QPy..G..1.9..Q..0..

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	78685
Entropy (8bit):	6.020282308187139
Encrypted:	false
SSDEEP:	1536:OfGNbFoZJSUYOOaLnAW8+IcTOIQbkhXwW5vxM:mGRFauOxLA/+IcTOuXK
MD5:	6AEC8CFD5D3A790339DC627F9F1229B5
SHA1:	B6C8CFFE38E1015DD8595F2DD1A92435E2795874
SHA-256:	80583FA3C83831A9E036EBA0500D1B9C0D30892D0701F1617E0FAFAF5AEAA2CA
SHA-512:	4279E479C860007D04CD6FF0B8C45131C18D87420CD5CEB5C727A7DDBFB4206D007069102D643DA97C3BF01D0B756A2EF4662C8E39B6969FC154DE3C763B1EFC
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGYktHRAD/AP8A/6C9p5MAAHq9SURBVHja7Z15fFTl9f/fd9ZM9n1PgCyEXSSRNYKCgAuiIipuVSuudavV1tq6W/WrtnWrrZbWDZUqUqUoCoIEQhBI2JesELKvM9mTWe7c3x83d5xAlkky8fv92ft5vfKC19znOWfuZ571POc5B1SoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKHifwGCRqsTNFrdj6VPq9XqtNofT9+wvutQyEyad8t9IaPPntFUd

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (654)
Category:	downloaded
Size (bytes):	560258
Entropy (8bit):	5.668859512958225
Encrypted:	false
SSDEEP:	6144:QStgGd8JmYx0sb6h8YfALjbBksK8ecdy7FdzZA96fcJ2fL2iJ5B7lXaqy2:Gn8hALjbispecknzXfIKhX7
MD5:	19DDAC3BE88EDA2C8263C5D52FA7F6BD
SHA1:	C81720778F57C56244C72CE6EF402BB4DE5F9619
SHA-256:	B261530F05E272E18B5B5C86D860C4979C82B5B6C538E1643B3C94FC9BA76DD6
SHA-512:	393015B8C7F14D5D4BDB9CCEED7CD1477A7DB07BC7C40BAE7D0A48A2ADFA7D56F9D1C3E4EC05C92FDE152E72FFA6B75D8BF724E1F63F9BC21421125667AFB05C
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var X=function(){return[function(N,a,U,y,A,l,z){if((l=["toString",6,"constructor"],N&71)==N)if(typeof U==="string")z={buffer:Z[11](17,1,a,U),qH:!1};else if(Array.isArray(U))z={buffer:new Uint8Array(U),qH:!1};else if(U[l[2]]===Uint8Array)z={buffer:U,qH:!1};else if(U[l[2]]===ArrayBuffer)z={buffer:new Uint8Array(U),qH:!1};else if(U[l[2]]===WC)z={buffer:r[9](25,a,null,U)\|\|new Uint8Array(0),qH:!0};else if(U instanceof Uint8Array)z={buffer:new Uint8Array(U.buffer,U.byteOffset,U.byteLength),qH:!1};else throw Error("Type not convertible to a Uint8Array, expected a Uint8Array, an ArrayBuffer, a base64 encoded string, a Byt

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (654)
Category:	downloaded
Size (bytes):	560258
Entropy (8bit):	5.668859512958225
Encrypted:	false
SSDEEP:	6144:QStgGd8JmYx0sb6h8YfALjbBksK8ecdy7FdzZA96fcJ2fL2iJ5B7lXaqy2:Gn8hALjbispecknzXfIKhX7
MD5:	19DDAC3BE88EDA2C8263C5D52FA7F6BD
SHA1:	C81720778F57C56244C72CE6EF402BB4DE5F9619
SHA-256:	B261530F05E272E18B5B5C86D860C4979C82B5B6C538E1643B3C94FC9BA76DD6
SHA-512:	393015B8C7F14D5D4BDB9CCEED7CD1477A7DB07BC7C40BAE7D0A48A2ADFA7D56F9D1C3E4EC05C92FDE152E72FFA6B75D8BF724E1F63F9BC21421125667AFB05C
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var X=function(){return[function(N,a,U,y,A,l,z){if((l=["toString",6,"constructor"],N&71)==N)if(typeof U==="string")z={buffer:Z[11](17,1,a,U),qH:!1};else if(Array.isArray(U))z={buffer:new Uint8Array(U),qH:!1};else if(U[l[2]]===Uint8Array)z={buffer:U,qH:!1};else if(U[l[2]]===ArrayBuffer)z={buffer:new Uint8Array(U),qH:!1};else if(U[l[2]]===WC)z={buffer:r[9](25,a,null,U)\|\|new Uint8Array(0),qH:!0};else if(U instanceof Uint8Array)z={buffer:new Uint8Array(U.buffer,U.byteOffset,U.byteLength),qH:!1};else throw Error("Type not convertible to a Uint8Array, expected a Uint8Array, an ArrayBuffer, a base64 encoded string, a Byt

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3
Category:	dropped
Size (bytes):	27744
Entropy (8bit):	7.969860940786497
Encrypted:	false
SSDEEP:	768:aOno/d0EEOhOQaxr0XNo8fQKo6led5VrnJ7u/:aOno+EfaxrUN/Qz6lc5VJ6
MD5:	42695C50457EF256F3144B1BCF2078D2
SHA1:	ECE098F7BE2C13A6892A2125DB967CAF69D287F6
SHA-256:	3BB6F2FD005A21F1DAB1D52096E2FCDD8A39346A53BF9FD2E8A836FA9B3B151D
SHA-512:	9ADE22E781FBE02B6B12372F0EEEF2D411594CC6BCC932B720ECEBE238BBB0D7C7A7A535B9F361889750C84EEA2B0B56C0AB9ABB609DFDB4CDC297EB94667397
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................,.,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..na.9.T...5~a...1.....:-)qf....V.U.,j...].q...:W..Tc.w.6.....[.P.,-.h.{..$R...`.YX2..9.#U.%M=.ueC..e\....q+.P.?w=*.F.[..<..1Kg=...."..`r.....K.....t.........8...l.^M.O..E&8.O.?d...#?....j.b+.d..'...O..^.E{...G....=.._/...H...].8...v.UmkZ.tX.mR..jo+,.63...y..wU.....$..Q:....mP.~9....xC.v......Y.Yz....N..ZZ...y.[.p.5.-...-V.K{..M....#27....1^k$..k.~I20<.W

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18288)
Category:	dropped
Size (bytes):	18908
Entropy (8bit):	5.6255223057698815
Encrypted:	false
SSDEEP:	384:dVtfxzksuna6B3+9A/CY3DCcdye4PCwEnaeXsLRKyuHX/5:VKRai5HPIeaeX1yM
MD5:	0240AA22895CF57CB91160E784542720
SHA1:	F50652CCC59E7556511178A2A6BF92407D2E0955
SHA-256:	5DEEC06E184F7D97048A4A0D9A182105700484EBAC0C804A58A4BFAE84B843B1
SHA-512:	C4CADEB4398EB472EEF4989627E74C8CC9A80A1045F2C01E3DCFA63D20B52901223F90AB0A0F6F13833F627A0A5C4BBDDEB86CA9F4A2972654F881B2DF4B1879
Malicious:	false
Reputation:	low
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var U=function(p){return p},G=function(p,b){if(!(p=(b=null,B).trustedTypes,p)\|\|!p.createPolicy)return b;try{b=p.createPolicy("bg",{createHTML:U,createScript:U,createScriptURL:U})}catch(e){B.console&&B.console.error(e.message)}return b},B=this\|\|self;(0,eval)(function(p,b){return(b=G())&&p.eval(b.createScript("1"))===1?function(e){return b.createScript(e)}:function(e){return""+e}}(B)(Array(Math.random()7824\|0).join("\n")+['(function(){/',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var H=function(p,b){for(b=[];p--;)b.push(Math.random()*255\|0);return b},C=function(p,b){b.J.splice(0,0,p)},e_=function(p,b,U,B,Y){function r(){}return B=(p=$q(p,function(v){r&&(b&&bb(b),Y=v,r(),r=void 0)},(Y=void 0,!!b)),p)[1],U=p[0],{invoke:function(v,W,E,e){function G(){Y(function(X){bb(function(){v(X)})},E)}if(!W)return W=U(E),v&&v(W),W;Y?G():(e=r,r=function(){bb((e(),G))})

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.8035671313969885
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKFcM6Qaxp3T2TjWaee:PLKdXNQKFtaxZT2TjL
MD5:	C206147C7CAE99642A4F8A2C640A0019
SHA1:	8C32B7B7E0807BBE85E5C8C94F87AFEA31EEDC40
SHA-256:	6F55ADBECCE78B9C566F8DC830177DC91782702FF35F213F009FC2B902E25603
SHA-512:	0D94AA53B801AC69A9BB4A7DF4FC0E00B6FFD1C5668A6FEE4EFC11986B7F516EB27A8A0197C0106A4295ACD5F63C222EA2F1BD9431BF2D689672AC91C5528EB6
Malicious:	false
Reputation:	low
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js');

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkle_qHL8VdnhIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18288)
Category:	downloaded
Size (bytes):	18908
Entropy (8bit):	5.6255223057698815
Encrypted:	false
SSDEEP:	384:dVtfxzksuna6B3+9A/CY3DCcdye4PCwEnaeXsLRKyuHX/5:VKRai5HPIeaeX1yM
MD5:	0240AA22895CF57CB91160E784542720
SHA1:	F50652CCC59E7556511178A2A6BF92407D2E0955
SHA-256:	5DEEC06E184F7D97048A4A0D9A182105700484EBAC0C804A58A4BFAE84B843B1
SHA-512:	C4CADEB4398EB472EEF4989627E74C8CC9A80A1045F2C01E3DCFA63D20B52901223F90AB0A0F6F13833F627A0A5C4BBDDEB86CA9F4A2972654F881B2DF4B1879
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/bg/Xe7AbhhPfZcEikoNmhghBXAEhOusDIBKWKS_roS4Q7E.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var U=function(p){return p},G=function(p,b){if(!(p=(b=null,B).trustedTypes,p)\|\|!p.createPolicy)return b;try{b=p.createPolicy("bg",{createHTML:U,createScript:U,createScriptURL:U})}catch(e){B.console&&B.console.error(e.message)}return b},B=this\|\|self;(0,eval)(function(p,b){return(b=G())&&p.eval(b.createScript("1"))===1?function(e){return b.createScript(e)}:function(e){return""+e}}(B)(Array(Math.random()7824\|0).join("\n")+['(function(){/',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var H=function(p,b){for(b=[];p--;)b.push(Math.random()*255\|0);return b},C=function(p,b){b.J.splice(0,0,p)},e_=function(p,b,U,B,Y){function r(){}return B=(p=$q(p,function(v){r&&(b&&bb(b),Y=v,r(),r=void 0)},(Y=void 0,!!b)),p)[1],U=p[0],{invoke:function(v,W,E,e){function G(){Y(function(X){bb(function(){v(X)})},E)}if(!W)return W=U(E),v&&v(W),W;Y?G():(e=r,r=function(){bb((e(),G))})

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3
Category:	downloaded
Size (bytes):	27744
Entropy (8bit):	7.969860940786497
Encrypted:	false
SSDEEP:	768:aOno/d0EEOhOQaxr0XNo8fQKo6led5VrnJ7u/:aOno+EfaxrUN/Qz6lc5VJ6
MD5:	42695C50457EF256F3144B1BCF2078D2
SHA1:	ECE098F7BE2C13A6892A2125DB967CAF69D287F6
SHA-256:	3BB6F2FD005A21F1DAB1D52096E2FCDD8A39346A53BF9FD2E8A836FA9B3B151D
SHA-512:	9ADE22E781FBE02B6B12372F0EEEF2D411594CC6BCC932B720ECEBE238BBB0D7C7A7A535B9F361889750C84EEA2B0B56C0AB9ABB609DFDB4CDC297EB94667397
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/payload?p=06AFcWeA4YFRzCJeJ7iEASfaybY4kTmVYn01WAd41JO-iACJK_XSTVni0zjqDPxkAQ28jYhIba4FYwlGJwjJNdYd1EzyW3hmMaCPN7Z5lm7WAFiixSJTpzx2XM4re58oquNlyltuelM1o_8cFtN4W5qrpanFT0BMotJc6UCxEFoUmctwPZXIJUDDhuoDN-9YZELODO6se-duYB&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................,.,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..na.9.T...5~a...1.....:-)qf....V.U.,j...].q...:W..Tc.w.6.....[.P.,-.h.{..$R...`.YX2..9.#U.%M=.ueC..e\....q+.P.?w=*.F.[..<..1Kg=...."..`r.....K.....t.........8...l.^M.O..E&8.O.?d...#?....j.b+.d..'...O..^.E{...G....=.._/...H...].8...v.UmkZ.tX.mR..jo+,.63...y..wU.....$..Q:....mP.~9....xC.v......Y.Yz....N..ZZ...y.[.p.5.-...-V.K{..M....#27....1^k$..k.~I20<.W

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1434), with no line terminators
Category:	dropped
Size (bytes):	1434
Entropy (8bit):	5.765556935416344
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCe2TLph9gFB5vtADjkrDQndcl/1t4glvllLtFtD1INxsLqJ:VKEctKo7LmvtUjPKtX7ftD1INOLrwUnG
MD5:	764EE6309BF4800054E4A2A67DEB3575
SHA1:	2FFD2FDA8E49AD861B75DE1E5ED583D8CE1D5B0A
SHA-256:	652E8677AEC33767D2A5F229384F79B4F526104BF7E94D7D258070F94743C3CC
SHA-512:	4333F5A85D3085C54ACF34632CFDD57CF7EEA2D539C5CEFC1DBD07A6486083CAC1C1DA6BADB9743FD01BCDEE63AEFB187074A6BF7AB945BC897E227E1C4F5C6D
Malicious:	false
Reputation:	low
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(m)

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1434), with no line terminators
Category:	downloaded
Size (bytes):	1434
Entropy (8bit):	5.765556935416344
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCe2TLph9gFB5vtADjkrDQndcl/1t4glvllLtFtD1INxsLqJ:VKEctKo7LmvtUjPKtX7ftD1INOLrwUnG
MD5:	764EE6309BF4800054E4A2A67DEB3575
SHA1:	2FFD2FDA8E49AD861B75DE1E5ED583D8CE1D5B0A
SHA-256:	652E8677AEC33767D2A5F229384F79B4F526104BF7E94D7D258070F94743C3CC
SHA-512:	4333F5A85D3085C54ACF34632CFDD57CF7EEA2D539C5CEFC1DBD07A6486083CAC1C1DA6BADB9743FD01BCDEE63AEFB187074A6BF7AB945BC897E227E1C4F5C6D
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(m)

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32038)
Category:	dropped
Size (bytes):	95992
Entropy (8bit):	5.391333957965341
Encrypted:	false
SSDEEP:	1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRmm:R+41ZqLTW8xRrqSb8qGH77da98Hr3
MD5:	F03E5A3BF534F4A738BC350631FD05BD
SHA1:	37B1DB88B57438F1072A8EBC7559C909C9D3A682
SHA-256:	AEC3D419D50F05781A96F223E18289AEB52598B5DB39BE82A7B71DC67D6A7947
SHA-512:	8EEEAEFB86CF5F9D09426814F7B60E1805E644CAC3F5AB382C4D393DD0B7AB272C1909A31A57E6D38D5ACF207555F097A64A6DD62F60A97093E97BB184126D2A
Malicious:	false
Reputation:	low
Preview:	/! jQuery v1.11.3 \| (c) 2005, 2015 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.3",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (654)
Category:	dropped
Size (bytes):	560258
Entropy (8bit):	5.668859512958225
Encrypted:	false
SSDEEP:	6144:QStgGd8JmYx0sb6h8YfALjbBksK8ecdy7FdzZA96fcJ2fL2iJ5B7lXaqy2:Gn8hALjbispecknzXfIKhX7
MD5:	19DDAC3BE88EDA2C8263C5D52FA7F6BD
SHA1:	C81720778F57C56244C72CE6EF402BB4DE5F9619
SHA-256:	B261530F05E272E18B5B5C86D860C4979C82B5B6C538E1643B3C94FC9BA76DD6
SHA-512:	393015B8C7F14D5D4BDB9CCEED7CD1477A7DB07BC7C40BAE7D0A48A2ADFA7D56F9D1C3E4EC05C92FDE152E72FFA6B75D8BF724E1F63F9BC21421125667AFB05C
Malicious:	false
Reputation:	low
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var X=function(){return[function(N,a,U,y,A,l,z){if((l=["toString",6,"constructor"],N&71)==N)if(typeof U==="string")z={buffer:Z[11](17,1,a,U),qH:!1};else if(Array.isArray(U))z={buffer:new Uint8Array(U),qH:!1};else if(U[l[2]]===Uint8Array)z={buffer:U,qH:!1};else if(U[l[2]]===ArrayBuffer)z={buffer:new Uint8Array(U),qH:!1};else if(U[l[2]]===WC)z={buffer:r[9](25,a,null,U)\|\|new Uint8Array(0),qH:!0};else if(U instanceof Uint8Array)z={buffer:new Uint8Array(U.buffer,U.byteOffset,U.byteLength),qH:!1};else throw Error("Type not convertible to a Uint8Array, expected a Uint8Array, an ArrayBuffer, a base64 encoded string, a Byt

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32038)
Category:	downloaded
Size (bytes):	95992
Entropy (8bit):	5.391333957965341
Encrypted:	false
SSDEEP:	1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRmm:R+41ZqLTW8xRrqSb8qGH77da98Hr3
MD5:	F03E5A3BF534F4A738BC350631FD05BD
SHA1:	37B1DB88B57438F1072A8EBC7559C909C9D3A682
SHA-256:	AEC3D419D50F05781A96F223E18289AEB52598B5DB39BE82A7B71DC67D6A7947
SHA-512:	8EEEAEFB86CF5F9D09426814F7B60E1805E644CAC3F5AB382C4D393DD0B7AB272C1909A31A57E6D38D5ACF207555F097A64A6DD62F60A97093E97BB184126D2A
Malicious:	false
Reputation:	low
URL:	https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Preview:	/! jQuery v1.11.3 \| (c) 2005, 2015 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.3",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.8035671313969885
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKFcM6Qaxp3T2TjWaee:PLKdXNQKFtaxZT2TjL
MD5:	C206147C7CAE99642A4F8A2C640A0019
SHA1:	8C32B7B7E0807BBE85E5C8C94F87AFEA31EEDC40
SHA-256:	6F55ADBECCE78B9C566F8DC830177DC91782702FF35F213F009FC2B902E25603
SHA-512:	0D94AA53B801AC69A9BB4A7DF4FC0E00B6FFD1C5668A6FEE4EFC11986B7F516EB27A8A0197C0106A4295ACD5F63C222EA2F1BD9431BF2D689672AC91C5528EB6
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js');

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/info_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/audio_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T19:25:53.530106+0100	2057273	ET PHISHING BULLSreCaptcha Credential Phish Landing Page M1 2024-10-17	1	193.143.1.14	443	192.168.2.5	49714	TCP
2024-12-18T19:25:53.530106+0100	2057274	ET PHISHING Suspected BULLSreCaptcha Credential Phish Landing Page M2 2024-10-17	1	193.143.1.14	443	192.168.2.5	49714	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 19:25:36.136938095 CET	49675	443	192.168.2.5	23.1.237.91
Dec 18, 2024 19:25:36.136948109 CET	49674	443	192.168.2.5	23.1.237.91
Dec 18, 2024 19:25:36.261929989 CET	49673	443	192.168.2.5	23.1.237.91
Dec 18, 2024 19:25:45.882622957 CET	49674	443	192.168.2.5	23.1.237.91
Dec 18, 2024 19:25:45.898252964 CET	49675	443	192.168.2.5	23.1.237.91
Dec 18, 2024 19:25:45.898252964 CET	49673	443	192.168.2.5	23.1.237.91
Dec 18, 2024 19:25:48.270183086 CET	443	49703	23.1.237.91	192.168.2.5
Dec 18, 2024 19:25:48.270414114 CET	49703	443	192.168.2.5	23.1.237.91
Dec 18, 2024 19:25:49.883357048 CET	49711	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:49.883469105 CET	443	49711	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:49.883615971 CET	49711	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:49.883790016 CET	49711	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:49.883809090 CET	443	49711	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:51.281214952 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:51.281308889 CET	443	49713	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:51.281404972 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:51.282418966 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:51.282485008 CET	443	49714	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:51.282548904 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:51.283348083 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:51.283363104 CET	443	49714	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:51.283804893 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:51.283840895 CET	443	49713	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:51.583564043 CET	443	49711	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:51.583914042 CET	49711	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:51.583961964 CET	443	49711	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:51.585375071 CET	443	49711	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:51.585453033 CET	49711	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:51.597424984 CET	49711	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:51.597686052 CET	443	49711	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:51.651119947 CET	49711	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:51.651160002 CET	443	49711	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:51.694075108 CET	49711	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:52.775850058 CET	443	49714	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:52.816714048 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:52.937211990 CET	443	49713	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:52.983802080 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.018202066 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.018234968 CET	443	49714	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.018372059 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.018405914 CET	443	49713	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.022114038 CET	443	49714	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.022197008 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.022334099 CET	443	49713	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.022413015 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.030133009 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.030263901 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.030337095 CET	443	49714	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.030488968 CET	443	49713	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.030572891 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.030580044 CET	443	49714	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.084677935 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.084678888 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.084703922 CET	443	49713	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.131540060 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.529325962 CET	443	49714	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.529824018 CET	443	49714	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.529892921 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.530594110 CET	49714	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:25:53.530616045 CET	443	49714	193.143.1.14	192.168.2.5
Dec 18, 2024 19:25:53.696814060 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:53.696835995 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:53.696937084 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:53.698488951 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:53.698503017 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:55.403608084 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:55.429594040 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:55.429610968 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:55.431118011 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:55.431224108 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:55.431863070 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:55.432039022 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:55.433388948 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:55.433397055 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:55.478051901 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:56.330254078 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:56.330384016 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:56.330528975 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:56.330545902 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:56.331537008 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:56.331594944 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:56.331696033 CET	49717	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:56.331713915 CET	443	49717	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:56.481564999 CET	49718	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:56.481645107 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:56.481729031 CET	49718	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:56.482211113 CET	49718	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:56.482242107 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:58.182476997 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:58.187983990 CET	49718	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:58.188045979 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:58.189027071 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:58.189100027 CET	49718	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:58.190570116 CET	49718	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:58.190635920 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:58.190717936 CET	49718	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:58.190733910 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:58.240037918 CET	49718	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:58.988737106 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:58.988791943 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:58.989116907 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:25:58.989367008 CET	49718	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:58.991350889 CET	49718	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:25:58.991389990 CET	443	49718	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:00.365334988 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:00.365441084 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:00.365519047 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:00.365720987 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:00.365752935 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:01.276513100 CET	443	49711	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:01.276695013 CET	443	49711	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:01.276899099 CET	49711	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:01.619210958 CET	49711	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:01.619240999 CET	443	49711	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:02.130825996 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:02.131541967 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:02.131606102 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:02.133044004 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:02.133138895 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:02.135766029 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:02.135858059 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:02.135932922 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:02.183329105 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:02.184833050 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:02.184875965 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:02.230941057 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.003540039 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.003674984 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.003773928 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.003827095 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.005004883 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.005079031 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.005095005 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.011445045 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.011617899 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.011632919 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.025396109 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.025504112 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.025521040 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.069658041 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.069680929 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.118993998 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.136214018 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.141130924 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.141257048 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.141277075 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.195553064 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.195579052 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.202789068 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.202864885 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.202879906 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.210207939 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.210273981 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.210288048 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.224275112 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.224356890 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.224370956 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.238717079 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.238882065 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.238897085 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.252093077 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.252536058 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.252551079 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.265117884 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.265192986 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.265221119 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.292896032 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.292968035 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.292982101 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.293011904 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.293091059 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.295459986 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.303366899 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.303426027 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.303441048 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.316026926 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.316103935 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.316132069 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.329375982 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.329710960 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.329725981 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.332631111 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.332706928 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.332720995 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.332918882 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.332972050 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.333108902 CET	443	49729	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:03.333177090 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:03.333216906 CET	49729	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:04.489674091 CET	443	49713	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:04.489833117 CET	443	49713	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:04.489905119 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:05.086777925 CET	49713	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:05.086807013 CET	443	49713	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:07.059465885 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:07.059570074 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:07.059716940 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:07.059988976 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:07.060024977 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:07.098793983 CET	49747	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:07.098829985 CET	443	49747	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:07.098936081 CET	49747	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:07.099205971 CET	49747	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:07.099225998 CET	443	49747	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:08.799972057 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:08.845310926 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:08.884202957 CET	443	49747	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:08.926422119 CET	49747	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.080626011 CET	49747	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.080636024 CET	443	49747	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.081132889 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.081212997 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.081239939 CET	443	49747	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.082585096 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.084140062 CET	49747	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.084276915 CET	443	49747	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.084633112 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.084837914 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.085364103 CET	49747	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.085438013 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.127331972 CET	443	49747	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.127360106 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.587754965 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.587878942 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.587956905 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.587992907 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.589081049 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.589149952 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.589178085 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.600857973 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.600929022 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.600959063 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.608791113 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.608872890 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.608906031 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.649265051 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.649296045 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.695287943 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.704924107 CET	443	49747	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.706846952 CET	443	49747	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.706902981 CET	49747	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.707353115 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.709913015 CET	49747	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.709927082 CET	443	49747	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.711458921 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.711525917 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.711559057 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.722151041 CET	49755	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.722222090 CET	443	49755	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.722312927 CET	49755	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.722641945 CET	49755	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.722676039 CET	443	49755	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.760770082 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.779922962 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.784768105 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.784883022 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.784921885 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.784976006 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.785057068 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.786643028 CET	49746	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.786676884 CET	443	49746	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.823771954 CET	49756	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:09.823846102 CET	443	49756	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:09.823936939 CET	49756	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:09.824331045 CET	49756	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:09.824353933 CET	443	49756	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:09.851553917 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.851613998 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:09.851696968 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.852107048 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:09.852137089 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:10.200387955 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:10.200408936 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:10.200480938 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:10.200805902 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:10.200819016 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.298299074 CET	443	49756	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:11.301500082 CET	49756	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:11.301542044 CET	443	49756	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:11.302248001 CET	443	49756	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:11.305543900 CET	49756	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:11.305619001 CET	443	49756	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:11.305640936 CET	49756	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:11.347357035 CET	443	49756	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:11.351959944 CET	49756	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:11.419859886 CET	443	49755	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.421906948 CET	49755	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:11.421967030 CET	443	49755	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.422493935 CET	443	49755	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.429657936 CET	49755	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:11.429760933 CET	443	49755	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.432394981 CET	49755	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:11.475330114 CET	443	49755	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.556015015 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.556410074 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:11.556443930 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.557557106 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.557873011 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:11.558012962 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:11.558057070 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.602035999 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:11.894551039 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.896214008 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:11.896234035 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.897330999 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.897856951 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:11.897995949 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:11.898003101 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.898030043 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:11.913981915 CET	443	49756	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:11.914421082 CET	443	49756	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:11.914509058 CET	49756	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:11.915189028 CET	49756	443	192.168.2.5	193.143.1.14
Dec 18, 2024 19:26:11.915220976 CET	443	49756	193.143.1.14	192.168.2.5
Dec 18, 2024 19:26:11.945653915 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.229912043 CET	443	49755	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.231462955 CET	443	49755	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.231575966 CET	49755	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.239727020 CET	49755	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.239778042 CET	443	49755	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.242249966 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.242319107 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.242383003 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.242424011 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.244695902 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.244775057 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.244793892 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.254870892 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.254955053 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.254971981 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.261955976 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.262053967 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.262070894 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.274699926 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.274785995 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.274801016 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.320645094 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.363251925 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.414223909 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.414247990 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.437587023 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.437668085 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.437684059 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.438920021 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.439002991 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.439141035 CET	49757	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.439172029 CET	443	49757	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.710114956 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.710160971 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.710216999 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.710236073 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.711570024 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.711594105 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.711626053 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.711642027 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.711683035 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.718221903 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.727092028 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:12.727159977 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.727390051 CET	49758	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:12.727404118 CET	443	49758	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:21.358108044 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:21.358134031 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:21.358218908 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:21.358592987 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:21.358604908 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.062556982 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.062853098 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:23.062905073 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.063441992 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.063776016 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:23.063868046 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.063941002 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:23.064033031 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:23.064073086 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.962960005 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.963113070 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.963195086 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:23.963217020 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.964807987 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.964884043 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:23.964895010 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.971282959 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.971348047 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:23.971359968 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.984719992 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.984833956 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:23.984859943 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.994307041 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:23.994381905 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:23.994419098 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:24.048418999 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.082371950 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:24.126710892 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.126753092 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:24.154356956 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:24.154448032 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.154459953 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:24.159714937 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:24.159786940 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.160029888 CET	49787	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.160044909 CET	443	49787	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:24.164937973 CET	49792	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.164983988 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:24.165093899 CET	49792	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.165472031 CET	49792	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.165492058 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:24.223402977 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.223433971 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:24.223510981 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.223799944 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:24.223813057 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:25.995414972 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:25.995711088 CET	49792	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:25.995722055 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:25.996226072 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:25.996614933 CET	49792	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:25.996730089 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:25.996871948 CET	49792	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.000344992 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.000629902 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.000638008 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.002096891 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.002507925 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.002641916 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.002646923 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.002677917 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.039355040 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.040851116 CET	49792	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.056365013 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.803534985 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.803584099 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.803698063 CET	49792	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.803710938 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.804013014 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.804878950 CET	49792	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.804970980 CET	49792	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.804984093 CET	443	49792	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.825014114 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.825306892 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.825373888 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.825387001 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.825993061 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.826061964 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.826069117 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.836582899 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.836709023 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.836715937 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.859437943 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.859503031 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.859510899 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.873549938 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.873622894 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.873631001 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.914216042 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.914222956 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:26.961077929 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:26.961083889 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.007951975 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:27.010092020 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.018884897 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.019026995 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:27.019033909 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.030823946 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.031030893 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:27.031039000 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.044611931 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.044682980 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:27.044692039 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.061136007 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.061207056 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:27.061213970 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.061654091 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:27.061698914 CET	443	49796	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.061763048 CET	49796	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:27.071427107 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:27.071487904 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:27.071614981 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:27.072231054 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:27.072261095 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:28.768177032 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:28.768760920 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:28.768810987 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:28.769917011 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:28.770226002 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:28.770370007 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:28.770381927 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:28.770411015 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:28.820044994 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.579250097 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.579440117 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.579602003 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.579651117 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.580528021 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.580614090 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.580634117 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.593779087 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.593871117 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.593878984 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.593909025 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.593996048 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.598624945 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.612082958 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.612154961 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.612174034 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.664236069 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.700609922 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.742415905 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.742449999 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.781359911 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.781455994 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.781485081 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.790537119 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.790626049 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.790644884 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.799745083 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.799829006 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.799845934 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.808960915 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.809072018 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.809087038 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.818425894 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:29.818523884 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.818747044 CET	49808	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:29.818779945 CET	443	49808	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:49.806044102 CET	49861	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:49.806075096 CET	443	49861	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:49.806165934 CET	49861	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:49.806433916 CET	49861	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:49.806447029 CET	443	49861	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:51.540627956 CET	443	49861	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:51.540960073 CET	49861	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:51.540982008 CET	443	49861	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:51.542067051 CET	443	49861	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:51.542416096 CET	49861	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:26:51.542581081 CET	443	49861	142.250.181.132	192.168.2.5
Dec 18, 2024 19:26:51.586004972 CET	49861	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:27:01.220345974 CET	443	49861	142.250.181.132	192.168.2.5
Dec 18, 2024 19:27:01.220412016 CET	443	49861	142.250.181.132	192.168.2.5
Dec 18, 2024 19:27:01.220527887 CET	49861	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:27:01.945297003 CET	49861	443	192.168.2.5	142.250.181.132
Dec 18, 2024 19:27:01.945307970 CET	443	49861	142.250.181.132	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 19:25:45.454164028 CET	53	52840	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:45.459086895 CET	53	60397	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:48.359215975 CET	53	57357	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:49.742993116 CET	58335	53	192.168.2.5	1.1.1.1
Dec 18, 2024 19:25:49.743129969 CET	55462	53	192.168.2.5	1.1.1.1
Dec 18, 2024 19:25:49.882117987 CET	53	58335	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:49.882133961 CET	53	55462	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:50.834105968 CET	53962	53	192.168.2.5	1.1.1.1
Dec 18, 2024 19:25:50.834374905 CET	61298	53	192.168.2.5	1.1.1.1
Dec 18, 2024 19:25:51.273957014 CET	53	53962	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:51.274432898 CET	53	61298	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:53.553055048 CET	51230	53	192.168.2.5	1.1.1.1
Dec 18, 2024 19:25:53.553517103 CET	57792	53	192.168.2.5	1.1.1.1
Dec 18, 2024 19:25:53.691760063 CET	53	51230	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:53.692744970 CET	53	57792	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:53.694308043 CET	53	62121	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:56.341950893 CET	61328	53	192.168.2.5	1.1.1.1
Dec 18, 2024 19:25:56.342170954 CET	63044	53	192.168.2.5	1.1.1.1
Dec 18, 2024 19:25:56.480654955 CET	53	61328	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:56.480696917 CET	53	63044	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:56.481513023 CET	53	61181	1.1.1.1	192.168.2.5
Dec 18, 2024 19:25:56.780236959 CET	53	53249	1.1.1.1	192.168.2.5
Dec 18, 2024 19:26:00.226469040 CET	62601	53	192.168.2.5	1.1.1.1
Dec 18, 2024 19:26:00.228279114 CET	61857	53	192.168.2.5	1.1.1.1
Dec 18, 2024 19:26:00.325880051 CET	53	62806	1.1.1.1	192.168.2.5
Dec 18, 2024 19:26:00.364574909 CET	53	62601	1.1.1.1	192.168.2.5
Dec 18, 2024 19:26:00.364964962 CET	53	61857	1.1.1.1	192.168.2.5
Dec 18, 2024 19:26:00.448569059 CET	53	54884	1.1.1.1	192.168.2.5
Dec 18, 2024 19:26:03.162003994 CET	53	50575	1.1.1.1	192.168.2.5
Dec 18, 2024 19:26:05.225326061 CET	53	56909	1.1.1.1	192.168.2.5
Dec 18, 2024 19:26:24.187293053 CET	53	64335	1.1.1.1	192.168.2.5
Dec 18, 2024 19:26:45.276664019 CET	53	60501	1.1.1.1	192.168.2.5
Dec 18, 2024 19:26:47.069160938 CET	53	52216	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 18, 2024 19:25:45.559150934 CET	192.168.2.5	1.1.1.1	c234	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 19:25:49.742993116 CET	192.168.2.5	1.1.1.1	0x55b7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:25:49.743129969 CET	192.168.2.5	1.1.1.1	0xb30f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 18, 2024 19:25:50.834105968 CET	192.168.2.5	1.1.1.1	0x8b9c	Standard query (0)	courtscali.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:25:50.834374905 CET	192.168.2.5	1.1.1.1	0x783e	Standard query (0)	courtscali.com	65	IN (0x0001)	false
Dec 18, 2024 19:25:53.553055048 CET	192.168.2.5	1.1.1.1	0xeee8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:25:53.553517103 CET	192.168.2.5	1.1.1.1	0xeaed	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 18, 2024 19:25:56.341950893 CET	192.168.2.5	1.1.1.1	0xbf4e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:25:56.342170954 CET	192.168.2.5	1.1.1.1	0x7d35	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 18, 2024 19:26:00.226469040 CET	192.168.2.5	1.1.1.1	0x1378	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:26:00.228279114 CET	192.168.2.5	1.1.1.1	0x7e75	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 19:25:49.882117987 CET	1.1.1.1	192.168.2.5	0x55b7	No error (0)	www.google.com	142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:25:49.882133961 CET	1.1.1.1	192.168.2.5	0xb30f	No error (0)	www.google.com		65	IN (0x0001)	false
Dec 18, 2024 19:25:51.273957014 CET	1.1.1.1	192.168.2.5	0x8b9c	No error (0)	courtscali.com	193.143.1.14	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:25:53.691760063 CET	1.1.1.1	192.168.2.5	0xeee8	No error (0)	www.google.com	142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:25:53.692744970 CET	1.1.1.1	192.168.2.5	0xeaed	No error (0)	www.google.com		65	IN (0x0001)	false
Dec 18, 2024 19:25:56.480654955 CET	1.1.1.1	192.168.2.5	0xbf4e	No error (0)	www.google.com	142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:25:56.480696917 CET	1.1.1.1	192.168.2.5	0x7d35	No error (0)	www.google.com		65	IN (0x0001)	false
Dec 18, 2024 19:26:00.364574909 CET	1.1.1.1	192.168.2.5	0x1378	No error (0)	www.google.com	142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:26:00.364964962 CET	1.1.1.1	192.168.2.5	0x7e75	No error (0)	www.google.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

courtscali.com

https:

www.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	193.143.1.14	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:25:53 UTC	657	OUT	GET / HTTP/1.1 Host: courtscali.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 18:25:53 UTC	516	IN	HTTP/1.1 200 OK Connection: close set-cookie: PHPSESSID=284047251f4bef2673c2989d79659c5e; path=/; secure expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache content-type: text/html; charset=UTF-8 content-length: 1180 date: Wed, 18 Dec 2024 18:25:53 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-18 18:25:53 UTC	852	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 76 69 65 77 70 6f 72 74 27 20 63 6f 6e 74 65 6e 74 3d 27 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 27 20 2f 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 66 6f 72 6d 20 6d 65 74 68 6f 64 3d 27 70 6f 73 74 27 20 6e 61 6d 65 3d 27 6d 79 66 6f 72 6d 27 3e 0d 0a 20 20 20 20 3c 64 69 76 0d 0a 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 27 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 35 30 25 3b 20 6c 65 66 74 3a 20 35 30 25 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 33 37 70 Data Ascii: <meta name='viewport' content='width=device-width, initial-scale=1' /><script src='https://www.google.com/recaptcha/api.js'></script><form method='post' name='myform'> <div style='position: absolute; top: 50%; left: 50%; margin-top: -37p
2024-12-18 18:25:53 UTC	328	IN	Data Raw: 65 73 70 6f 6e 73 65 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 75 63 63 65 73 73 3a 20 66 75 6e 63 74 69 6f 6e 20 28 64 61 74 61 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 72 65 73 20 3d 20 64 61 74 61 2e 73 75 63 63 65 73 73 2e 74 6f 53 74 72 69 6e 67 28 29 3b 0d 0a 09 09 09 09 76 61 72 20 72 65 64 20 3d 20 64 61 74 61 2e 72 65 64 69 72 65 63 74 2e 74 6f 53 74 72 69 6e 67 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 72 65 73 20 3d 3d 20 27 74 72 75 65 27 29 20 7b 0d 0a 09 09 09 09 09 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 65 6c 73 65 7b 0d 0a 09 09 09 09 09 77 69 6e 64 6f 77 2e 6c 6f 63 61 Data Ascii: esponse }, success: function (data) { var res = data.success.toString();var red = data.redirect.toString(); if (res == 'true') {window.location.reload(); }else{window.loca

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49717	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:25:55 UTC	625	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://courtscali.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 18:25:56 UTC	749	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Wed, 18 Dec 2024 18:25:56 GMT Date: Wed, 18 Dec 2024 18:25:56 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 18:25:56 UTC	641	IN	Data Raw: 35 39 61 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 59a/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-12-18 18:25:56 UTC	800	IN	Data Raw: 41 41 43 51 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 7a 49 69 4c 43 4a 6c 65 48 42 70 63 6e 6b 69 4f 6a 45 33 4e 44 49 7a 4e 44 49 7a 4f 54 6b 73 49 6d 6c 7a 55 33 56 69 5a 47 39 74 59 57 6c 75 49 6a 70 30 63 6e 56 6c 4c 43 4a 70 63 31 52 6f 61 58 4a 6b 55 47 46 79 64 48 6b 69 4f 6e 52 79 64 57 56 39 27 3b 69 66 28 76 26 26 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 29 7b 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 2e Data Ascii: AACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.
2024-12-18 18:25:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49718	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:25:58 UTC	451	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 18:25:58 UTC	749	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Wed, 18 Dec 2024 18:25:58 GMT Date: Wed, 18 Dec 2024 18:25:58 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 18:25:58 UTC	641	IN	Data Raw: 35 39 61 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 59a/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-12-18 18:25:58 UTC	800	IN	Data Raw: 41 41 43 51 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 7a 49 69 4c 43 4a 6c 65 48 42 70 63 6e 6b 69 4f 6a 45 33 4e 44 49 7a 4e 44 49 7a 4f 54 6b 73 49 6d 6c 7a 55 33 56 69 5a 47 39 74 59 57 6c 75 49 6a 70 30 63 6e 56 6c 4c 43 4a 70 63 31 52 6f 61 58 4a 6b 55 47 46 79 64 48 6b 69 4f 6e 52 79 64 57 56 39 27 3b 69 66 28 76 26 26 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 29 7b 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 2e Data Ascii: AACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.
2024-12-18 18:25:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49729	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:02 UTC	954	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7&co=aHR0cHM6Ly9jb3VydHNjYWxpLmNvbTo0NDM.&hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&theme=light&size=normal&cb=e6205o3v2ehn HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://courtscali.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 18:26:03 UTC	1161	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 18 Dec 2024 18:26:02 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-WRVz8pE-Wly23iA0j_XJLw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 18:26:03 UTC	229	IN	Data Raw: 35 37 64 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 Data Ascii: 57d1<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cy
2024-12-18 18:26:03 UTC	1390	IN	Data Raw: 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 41 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 Data Ascii: rillic-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A64
2024-12-18 18:26:03 UTC	1390	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 42 41 2c 20 55 2b 30 32 42 44 2d 30 32 43 35 2c 20 55 2b 30 32 43 37 2d 30 32 43 43 2c 20 55 2b 30 32 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02
2024-12-18 18:26:03 UTC	1390	IN	Data Raw: 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 Data Ascii: font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2024-12-18 18:26:03 UTC	1390	IN	Data Raw: 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 Data Ascii: ormat('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}/* cyrillic-ext */@font-face { font-family: '
2024-12-18 18:26:03 UTC	1390	IN	Data Raw: 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d 30 31 36 39 2c 20 55 2b 30 31 41 30 2d 30 31 41 31 2c 20 55 2b 30 31 41 46 2d 30 31 42 30 2c 20 55 2b 30 33 30 30 2d 30 33 30 31 2c 20 55 2b 30 33 30 33 2d 30 33 30 34 2c 20 55 2b 30 33 30 38 2d 30 33 30 39 2c 20 55 2b 30 33 32 33 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 41 30 2d 31 45 46 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a Data Ascii: /s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}/* latin-ext */
2024-12-18 18:26:03 UTC	1390	IN	Data Raw: 33 75 6a 35 56 70 6b 6e 76 74 5f 4c 6e 66 4e 62 46 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 57 52 56 7a 38 70 45 2d 57 6c 79 32 33 69 41 30 6a 5f 58 4a 4c 77 22 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 72 63 2d 61 6e 63 68 6f 72 2d 61 6c 65 72 74 22 20 63 6c 61 73 73 3d 22 72 63 2d 61 6e 63 68 6f 72 2d 61 6c 65 72 74 22 3e 3c 2f 64 69 76 3e 0a 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 2d 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 30 33 41 46 63 57 65 41 34 47 58 6f 6a 51 45 6f 58 70 2d 48 52 39 79 72 5a 74 6a 34 50 42 43 5a 76 53 72 66 6c 77 6a 32 31 46 57 37 6a 78 57 Data Ascii: 3uj5Vpknvt_LnfNbF/recaptcha__en.js" nonce="WRVz8pE-Wly23iA0j_XJLw"> </script></head><body><div id="rc-anchor-alert" class="rc-anchor-alert"></div><input type="hidden" id="recaptcha-token" value="03AFcWeA4GXojQEoXp-HR9yrZtj4PBCZvSrflwj21FW7jxW
2024-12-18 18:26:03 UTC	1390	IN	Data Raw: 65 39 78 54 78 57 38 37 51 73 4b 64 32 4b 36 44 4e 4c 63 74 4f 33 5f 54 38 34 74 76 64 6b 6d 41 6a 55 36 47 4a 71 6a 32 66 62 77 49 65 7a 74 69 6c 4e 6f 55 31 53 79 4d 59 36 5a 35 45 6d 5a 32 59 4a 56 61 58 74 70 71 76 71 37 34 5f 76 7a 62 73 4b 5f 4d 43 72 34 75 52 4f 5f 69 38 74 45 51 64 43 46 77 34 69 49 6d 68 35 72 4c 6d 4c 50 50 46 78 6c 42 74 43 5a 64 5a 49 6a 32 71 52 4f 59 32 39 59 6c 39 72 74 4c 55 30 48 71 31 75 63 77 58 71 57 4c 6c 59 54 42 6d 2d 5f 4e 7a 35 57 45 6b 38 48 7a 62 75 47 70 4c 6f 7a 42 5f 51 48 32 4b 70 75 38 69 45 77 38 58 53 59 75 79 44 70 57 68 57 56 44 73 74 49 7a 5a 75 4b 53 4d 30 6c 71 4a 56 61 51 69 6a 71 77 6c 76 78 57 6e 6f 5f 79 70 68 73 6c 6f 39 52 70 4a 6c 78 55 59 68 38 57 34 39 58 6f 36 53 75 44 6e 67 52 33 32 51 36 Data Ascii: e9xTxW87QsKd2K6DNLctO3_T84tvdkmAjU6GJqj2fbwIeztilNoU1SyMY6Z5EmZ2YJVaXtpqvq74_vzbsK_MCr4uRO_i8tEQdCFw4iImh5rLmLPPFxlBtCZdZIj2qROY29Yl9rtLU0Hq1ucwXqWLlYTBm-_Nz5WEk8HzbuGpLozB_QH2Kpu8iEw8XSYuyDpWhWVDstIzZuKSM0lqJVaQijqwlvxWno_yphslo9RpJlxUYh8W49Xo6SuDngR32Q6
2024-12-18 18:26:03 UTC	1390	IN	Data Raw: 57 6a 51 34 55 6a 45 78 4e 6b 31 54 61 32 39 6f 56 6d 52 30 61 6e 46 53 57 47 49 34 65 58 5a 71 52 7a 59 35 56 30 78 36 61 6e 46 45 57 6a 5a 42 4e 44 6c 4a 57 48 4a 43 5a 45 78 46 52 54 42 72 65 47 5a 56 4d 45 64 73 62 46 70 6c 63 33 52 4b 5a 6c 68 6f 62 47 52 33 61 46 56 78 55 55 6c 78 51 6e 67 32 54 46 5a 49 63 57 68 77 54 6d 68 54 61 58 42 36 4f 57 52 46 64 55 64 72 59 6c 6b 32 64 48 42 6c 64 79 74 35 59 32 5a 78 4f 45 73 78 54 32 70 31 5a 6c 46 4e 54 6b 51 34 64 55 56 46 63 6b 4a 42 5a 32 74 69 62 48 70 61 65 47 70 4c 57 44 68 6d 55 47 39 70 59 6a 64 43 64 46 52 78 53 53 39 4a 53 32 78 57 61 33 64 4f 64 57 64 32 52 6d 56 48 63 45 49 35 5a 32 73 34 5a 6e 64 53 52 31 59 34 64 46 6f 34 53 6d 35 35 53 31 4e 75 5a 6a 67 31 52 6c 56 50 54 32 35 7a 65 45 74 Data Ascii: WjQ4UjExNk1Ta29oVmR0anFSWGI4eXZqRzY5V0x6anFEWjZBNDlJWHJCZExFRTBreGZVMEdsbFplc3RKZlhobGR3aFVxUUlxQng2TFZIcWhwTmhTaXB6OWRFdUdrYlk2dHBldyt5Y2ZxOEsxT2p1ZlFNTkQ4dUVFckJBZ2tibHpaeGpLWDhmUG9pYjdCdFRxSS9JS2xWa3dOdWd2RmVHcEI5Z2s4ZndSR1Y4dFo4Sm55S1NuZjg1RlVPT25zeEt
2024-12-18 18:26:03 UTC	1390	IN	Data Raw: 4e 4f 61 55 35 72 57 46 46 6a 55 55 31 6d 51 7a 68 61 5a 6e 56 57 55 56 6f 34 4f 44 6c 36 62 54 52 74 62 55 6c 76 54 6b 35 4a 56 32 78 4d 62 43 39 33 55 57 78 45 5a 6d 74 69 63 56 41 31 63 44 4a 74 53 48 5a 78 65 48 4a 6d 63 53 39 33 51 54 68 30 5a 44 6c 47 65 45 64 77 63 32 63 79 4e 46 70 6f 51 32 56 32 4d 33 55 30 52 48 64 33 64 45 74 70 55 54 52 56 56 44 42 46 59 32 74 35 61 6b 4a 70 4d 55 55 79 65 44 6c 43 52 54 63 33 59 57 52 61 4d 33 64 77 4b 33 5a 69 4e 6b 39 75 57 6e 70 4e 62 32 56 35 5a 32 39 58 62 6d 31 6c 52 6b 78 56 53 44 51 76 61 7a 4e 73 51 53 38 34 64 31 4a 6e 59 6b 51 31 53 55 49 33 62 48 52 30 53 48 5a 74 65 47 52 6e 64 6a 68 45 63 33 68 73 59 6e 4a 4d 56 48 45 35 54 46 64 36 4d 57 39 78 52 31 46 42 56 56 5a 57 55 6b 46 78 57 6d 4a 69 63 Data Ascii: NOaU5rWFFjUU1mQzhaZnVWUVo4ODl6bTRtbUlvTk5JV2xMbC93UWxEZmticVA1cDJtSHZxeHJmcS93QTh0ZDlGeEdwc2cyNFpoQ2V2M3U0RHd3dEtpUTRVVDBFY2t5akJpMUUyeDlCRTc3YWRaM3dwK3ZiNk9uWnpNb2V5Z29Xbm1lRkxVSDQvazNsQS84d1JnYkQ1SUI3bHR0SHZteGRndjhEc3hsYnJMVHE5TFd6MW9xR1FBVVZWUkFxWmJic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49747	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:09 UTC	856	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7&co=aHR0cHM6Ly9jb3VydHNjYWxpLmNvbTo0NDM.&hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&theme=light&size=normal&cb=e6205o3v2ehn Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 18:26:09 UTC	917	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Expires: Wed, 18 Dec 2024 18:26:09 GMT Date: Wed, 18 Dec 2024 18:26:09 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 18:26:09 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 7a 49 72 69 69 6a 6e 33 75 6a 35 56 70 6b 6e 76 74 5f 4c 6e 66 4e 62 46 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js');
2024-12-18 18:26:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49746	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:09 UTC	844	OUT	GET /js/bg/Xe7AbhhPfZcEikoNmhghBXAEhOusDIBKWKS_roS4Q7E.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7&co=aHR0cHM6Ly9jb3VydHNjYWxpLmNvbTo0NDM.&hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&theme=light&size=normal&cb=e6205o3v2ehn Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 18:26:09 UTC	812	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18908 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 13 Dec 2024 09:14:19 GMT Expires: Sat, 13 Dec 2025 09:14:19 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 02 Dec 2024 19:00:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 465110 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-18 18:26:09 UTC	578	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 55 3d 66 75 6e 63 74 69 6f 6e 28 70 29 7b 72 65 74 75 72 6e 20 70 7d 2c 47 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 69 66 28 21 28 70 3d 28 62 3d 6e 75 6c 6c 2c 42 29 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 70 29 7c 7c 21 70 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 62 3b 74 72 79 7b 62 3d 70 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 55 2c 63 72 65 61 74 65 53 63 72 Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var U=function(p){return p},G=function(p,b){if(!(p=(b=null,B).trustedTypes,p)\|\|!p.createPolicy)return b;try{b=p.createPolicy("bg",{createHTML:U,createScr
2024-12-18 18:26:09 UTC	1390	IN	Data Raw: 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 48 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 66 6f 72 28 62 3d 5b 5d 3b 70 2d 2d 3b 29 62 2e 70 75 73 68 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 32 35 35 7c 30 29 3b 72 65 74 75 72 6e 20 62 7d 2c 43 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 62 2e 4a 2e 73 70 6c 69 63 65 28 30 2c 30 2c 70 29 7d 2c 65 5f 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 2c 55 2c 42 2c 59 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 7d 72 65 74 75 72 6e 20 42 3d 28 70 3d 24 71 28 70 2c 66 75 6e 63 74 69 6f 6e 28 76 29 7b 72 26 26 28 62 26 26 62 62 28 62 29 2c 59 3d 76 2c 72 28 29 2c 72 3d 76 6f 69 64 20 30 29 7d 2c 28 59 3d 76 6f 69 64 Data Ascii: DX-License-Identifier: Apache-2.0','/','var H=function(p,b){for(b=[];p--;)b.push(Math.random()255\|0);return b},C=function(p,b){b.J.splice(0,0,p)},e_=function(p,b,U,B,Y){function r(){}return B=(p=$q(p,function(v){r&&(b&&bb(b),Y=v,r(),r=void 0)},(Y=void
2024-12-18 18:26:09 UTC	1390	IN	Data Raw: 73 75 62 73 74 72 69 6e 67 28 33 29 2c 62 2c 55 2c 42 2c 59 2c 72 2c 76 29 3a 6f 65 28 62 2c 70 29 7d 2c 66 69 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 72 65 74 75 72 6e 20 62 3d 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 70 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 66 61 6c 73 65 2c 76 61 6c 75 65 3a 70 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 74 72 75 65 7d 7d 7d 2c 72 6a 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 72 65 74 75 72 6e 28 62 3d 64 28 70 29 2c 62 29 26 31 32 38 26 26 28 62 3d 62 26 31 32 37 7c 64 28 70 29 3c 3c 37 29 2c 62 7d 2c 76 41 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 72 65 74 75 72 6e 20 70 5b 62 5d 3c 3c 32 34 7c 70 5b 28 62 7c 30 29 2b 31 5d 3c 3c 31 36 7c 70 5b 28 62 7c 30 29 2b 32 5d 3c 3c 38 7c 70 Data Ascii: substring(3),b,U,B,Y,r,v):oe(b,p)},fi=function(p,b){return b=0,function(){return b<p.length?{done:false,value:p[b++]}:{done:true}}},rj=function(p,b){return(b=d(p),b)&128&&(b=b&127\|d(p)<<7),b},vA=function(p,b){return p[b]<<24\|p[(b\|0)+1]<<16\|p[(b\|0)+2]<<8\|p
2024-12-18 18:26:09 UTC	1390	IN	Data Raw: 29 29 2c 70 29 2e 42 2b 3d 70 2e 6a 28 29 2d 62 7d 65 6c 73 65 20 69 66 28 42 3d 3d 79 64 29 62 5b 33 5d 26 26 28 70 2e 6f 3d 74 72 75 65 29 2c 62 5b 34 5d 26 26 28 70 2e 44 3d 74 72 75 65 29 2c 70 2e 56 28 62 29 3b 65 6c 73 65 20 69 66 28 42 3d 3d 74 34 29 70 2e 6f 3d 74 72 75 65 2c 70 2e 56 28 62 29 3b 65 6c 73 65 20 69 66 28 42 3d 3d 78 71 29 7b 74 72 79 7b 66 6f 72 28 55 3d 30 3b 55 3c 70 2e 54 2e 6c 65 6e 67 74 68 3b 55 2b 2b 29 74 72 79 7b 59 3d 70 2e 54 5b 55 5d 2c 59 5b 30 5d 5b 59 5b 31 5d 5d 28 59 5b 32 5d 29 7d 63 61 74 63 68 28 72 29 7b 7d 7d 63 61 74 63 68 28 72 29 7b 7d 28 28 30 2c 62 5b 31 5d 29 28 66 75 6e 63 74 69 6f 6e 28 72 2c 76 29 7b 70 2e 6a 32 28 72 2c 74 72 75 65 2c 76 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 72 29 7b 28 43 28 28 72 3d Data Ascii: )),p).B+=p.j()-b}else if(B==yd)b[3]&&(p.o=true),b[4]&&(p.D=true),p.V(b);else if(B==t4)p.o=true,p.V(b);else if(B==xq){try{for(U=0;U<p.T.length;U++)try{Y=p.T[U],Y[0][Y[1]](Y[2])}catch(r){}}catch(r){}((0,b[1])(function(r,v){p.j2(r,true,v)},function(r){(C((r=
2024-12-18 18:26:09 UTC	1390	IN	Data Raw: 72 73 65 28 62 29 7d 63 61 74 63 68 28 65 29 7b 70 2e 67 3d 7b 7d 7d 46 28 28 28 50 28 28 50 28 28 4c 28 70 2c 33 31 30 2c 28 4c 28 70 2c 28 28 28 50 28 66 75 6e 63 74 69 6f 6e 28 65 2c 47 2c 58 2c 66 2c 54 2c 79 2c 68 2c 52 2c 61 2c 77 2c 49 2c 6d 29 7b 66 75 6e 63 74 69 6f 6e 20 4e 28 6e 2c 75 29 7b 66 6f 72 28 3b 52 3c 6e 3b 29 61 7c 3d 64 28 65 29 3c 3c 52 2c 52 2b 3d 38 3b 72 65 74 75 72 6e 20 75 3d 28 52 2d 3d 6e 2c 61 29 26 28 31 3c 3c 6e 29 2d 31 2c 61 3e 3e 3d 6e 2c 75 7d 66 6f 72 28 49 3d 28 79 3d 28 66 3d 28 47 3d 4a 28 65 29 2c 52 3d 61 3d 30 2c 4e 28 33 29 7c 30 29 2b 31 2c 6d 3d 4e 28 35 29 2c 30 29 2c 77 3d 5b 5d 2c 30 29 3b 79 3c 6d 3b 79 2b 2b 29 54 3d 4e 28 31 29 2c 77 2e 70 75 73 68 28 54 29 2c 49 2b 3d 54 3f 30 3a 31 3b 66 6f 72 28 79 Data Ascii: rse(b)}catch(e){p.g={}}F(((P((P((L(p,310,(L(p,(((P(function(e,G,X,f,T,y,h,R,a,w,I,m){function N(n,u){for(;R<n;)a\|=d(e)<<R,R+=8;return u=(R-=n,a)&(1<<n)-1,a>>=n,u}for(I=(y=(f=(G=J(e),R=a=0,N(3)\|0)+1,m=N(5),0),w=[],0);y<m;y++)T=N(1),w.push(T),I+=T?0:1;for(y
2024-12-18 18:26:09 UTC	1390	IN	Data Raw: 3d 28 47 5b 47 5b 33 35 33 5d 3d 65 2e 4f 5b 33 35 33 5d 2c 33 32 36 5d 3d 65 2e 4f 5b 33 32 36 5d 2c 47 29 7d 65 6c 73 65 20 4c 28 65 2c 32 31 32 2c 65 2e 4b 29 7d 2c 28 4c 28 28 4c 28 70 2c 28 50 28 66 75 6e 63 74 69 6f 6e 28 65 2c 47 2c 58 2c 66 29 7b 4c 28 65 2c 28 58 3d 28 47 3d 28 66 3d 4a 28 65 29 2c 4a 29 28 65 29 2c 4a 28 65 29 29 2c 47 3d 74 28 47 2c 65 29 2c 66 3d 74 28 66 2c 65 29 2c 58 29 2c 66 20 69 6e 20 47 7c 30 29 7d 2c 28 4c 28 70 2c 28 50 28 66 75 6e 63 74 69 6f 6e 28 65 2c 47 2c 58 2c 66 29 7b 4c 28 65 2c 28 66 3d 74 28 28 58 3d 28 47 3d 28 66 3d 28 58 3d 4a 28 65 29 2c 4a 28 65 29 29 2c 4a 28 65 29 29 2c 74 28 58 2c 65 29 29 2c 66 29 2c 65 29 2c 47 29 2c 58 5b 66 5d 29 7d 2c 28 4c 28 70 2c 28 50 28 28 50 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: =(G[G[353]=e.O[353],326]=e.O[326],G)}else L(e,212,e.K)},(L((L(p,(P(function(e,G,X,f){L(e,(X=(G=(f=J(e),J)(e),J(e)),G=t(G,e),f=t(f,e),X),f in G\|0)},(L(p,(P(function(e,G,X,f){L(e,(f=t((X=(G=(f=(X=J(e),J(e)),J(e)),t(X,e)),f),e),G),X[f])},(L(p,(P((P(function(
2024-12-18 18:26:09 UTC	1390	IN	Data Raw: 2c 79 2c 68 29 7b 66 6f 72 28 79 3d 28 58 3d 74 28 31 33 32 2c 28 68 3d 28 54 3d 4a 28 65 29 2c 72 6a 28 65 29 29 2c 47 3d 22 22 2c 65 29 29 2c 58 2e 6c 65 6e 67 74 68 29 2c 66 3d 30 3b 68 2d 2d 3b 29 66 3d 28 28 66 7c 30 29 2b 28 72 6a 28 65 29 7c 30 29 29 25 79 2c 47 2b 3d 57 5b 58 5b 66 5d 5d 3b 4c 28 65 2c 54 2c 47 29 7d 29 2c 70 2c 32 35 30 29 2c 34 33 36 29 2c 30 29 2c 70 29 2c 31 30 32 29 2c 33 32 36 29 2c 5b 32 30 34 38 5d 29 2c 70 29 2c 31 31 33 29 2c 32 34 35 29 2c 51 29 2c 70 29 2c 31 37 31 2c 5b 30 2c 30 2c 30 5d 29 2c 70 29 2c 31 33 37 29 2c 33 35 33 29 2c 5b 5d 29 2c 4c 28 70 2c 37 33 2c 30 29 2c 70 29 2c 36 31 29 2c 70 29 2c 33 37 33 29 2c 70 2e 69 39 3d 30 2c 34 32 31 29 2c 5b 5d 29 2c 70 29 2c 36 35 29 2c 31 31 31 29 29 2c 32 34 30 29 29 Data Ascii: ,y,h){for(y=(X=t(132,(h=(T=J(e),rj(e)),G="",e)),X.length),f=0;h--;)f=((f\|0)+(rj(e)\|0))%y,G+=W[X[f]];L(e,T,G)}),p,250),436),0),p),102),326),[2048]),p),113),245),Q),p),171,[0,0,0]),p),137),353),[]),L(p,73,0),p),61),p),373),p.i9=0,421),[]),p),65),111)),240))
2024-12-18 18:26:09 UTC	1390	IN	Data Raw: 31 36 7c 7c 62 3d 3d 32 30 34 7c 7c 62 3d 3d 33 35 33 7c 7c 62 3d 3d 34 32 31 7c 7c 62 3d 3d 37 36 7c 7c 62 3d 3d 31 37 31 7c 7c 62 3d 3d 32 36 38 7c 7c 62 3d 3d 33 32 36 3f 70 2e 4f 5b 62 5d 7c 7c 28 70 2e 4f 5b 62 5d 3d 59 71 28 70 2c 55 2c 62 2c 31 34 32 29 29 3a 70 2e 4f 5b 62 5d 3d 59 71 28 70 2c 55 2c 62 2c 31 31 33 29 7d 62 3d 3d 32 33 32 26 26 28 70 2e 4e 3d 44 28 66 61 6c 73 65 2c 33 32 2c 70 29 2c 70 2e 46 3d 76 6f 69 64 20 30 29 7d 2c 56 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 70 2e 59 3d 28 28 70 2e 59 3f 70 2e 59 2b 22 7e 22 3a 22 45 3a 22 29 2b 62 2e 6d 65 73 73 61 67 65 2b 22 3a 22 2b 62 2e 73 74 61 63 6b 29 2e 73 6c 69 63 65 28 30 2c 32 30 34 38 29 7d 2c 49 65 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 2c 55 2c 42 2c 59 29 7b 71 28 28 28 Data Ascii: 16\|\|b==204\|\|b==353\|\|b==421\|\|b==76\|\|b==171\|\|b==268\|\|b==326?p.O[b]\|\|(p.O[b]=Yq(p,U,b,142)):p.O[b]=Yq(p,U,b,113)}b==232&&(p.N=D(false,32,p),p.F=void 0)},V=function(p,b){p.Y=((p.Y?p.Y+"~":"E:")+b.message+":"+b.stack).slice(0,2048)},Ie=function(p,b,U,B,Y){q(((
2024-12-18 18:26:09 UTC	1390	IN	Data Raw: 31 32 38 29 3a 62 5b 59 2b 2b 5d 3d 42 3e 3e 31 32 7c 32 32 34 2c 62 5b 59 2b 2b 5d 3d 42 3e 3e 36 26 36 33 7c 31 32 38 29 2c 62 5b 59 2b 2b 5d 3d 42 26 36 33 7c 31 32 38 29 3b 72 65 74 75 72 6e 20 62 7d 2c 61 65 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 2c 55 2c 42 2c 59 2c 72 29 7b 69 66 28 21 62 2e 59 29 7b 62 2e 49 2b 2b 3b 74 72 79 7b 66 6f 72 28 72 3d 28 42 3d 28 59 3d 62 2e 4b 2c 76 6f 69 64 20 30 29 2c 30 29 3b 2d 2d 70 3b 29 74 72 79 7b 69 66 28 28 55 3d 76 6f 69 64 20 30 2c 62 29 2e 73 29 42 3d 7a 4e 28 62 2c 62 2e 73 29 3b 65 6c 73 65 7b 69 66 28 72 3d 74 28 32 31 32 2c 62 29 2c 72 3e 3d 59 29 62 72 65 61 6b 3b 42 3d 28 55 3d 4a 28 28 4c 28 62 2c 31 32 35 2c 72 29 2c 62 29 29 2c 74 28 55 2c 62 29 29 7d 42 26 26 42 5b 68 34 5d 26 32 30 34 38 3f 42 Data Ascii: 128):b[Y++]=B>>12\|224,b[Y++]=B>>6&63\|128),b[Y++]=B&63\|128);return b},ae=function(p,b,U,B,Y,r){if(!b.Y){b.I++;try{for(r=(B=(Y=b.K,void 0),0);--p;)try{if((U=void 0,b).s)B=zN(b,b.s);else{if(r=t(212,b),r>=Y)break;B=(U=J((L(b,125,r),b)),t(U,b))}B&&B[h4]&2048?B
2024-12-18 18:26:09 UTC	1390	IN	Data Raw: 62 2e 57 2c 70 28 66 75 6e 63 74 69 6f 6e 28 29 7b 46 28 74 72 75 65 2c 62 2c 74 72 75 65 29 7d 29 3b 62 72 65 61 6b 7d 7d 72 65 74 75 72 6e 20 55 7d 2c 4f 47 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 28 62 2e 70 75 73 68 28 70 5b 30 5d 3c 3c 32 34 7c 70 5b 31 5d 3c 3c 31 36 7c 70 5b 32 5d 3c 3c 38 7c 70 5b 33 5d 29 2c 62 2e 70 75 73 68 28 70 5b 34 5d 3c 3c 32 34 7c 70 5b 35 5d 3c 3c 31 36 7c 70 5b 36 5d 3c 3c 38 7c 70 5b 37 5d 29 2c 62 29 2e 70 75 73 68 28 70 5b 38 5d 3c 3c 32 34 7c 70 5b 39 5d 3c 3c 31 36 7c 70 5b 31 30 5d 3c 3c 38 7c 70 5b 31 31 5d 29 7d 2c 5a 3d 7b 70 61 73 73 69 76 65 3a 74 72 75 65 2c 63 61 70 74 75 72 65 3a 74 72 75 65 7d 2c 7a 4e 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 72 65 74 75 72 6e 28 62 3d 62 2e 63 72 65 61 74 65 28 Data Ascii: b.W,p(function(){F(true,b,true)});break}}return U},OG=function(p,b){(b.push(p[0]<<24\|p[1]<<16\|p[2]<<8\|p[3]),b.push(p[4]<<24\|p[5]<<16\|p[6]<<8\|p[7]),b).push(p[8]<<24\|p[9]<<16\|p[10]<<8\|p[11])},Z={passive:true,capture:true},zN=function(p,b){return(b=b.create(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49756	193.143.1.14	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:11 UTC	636	OUT	GET /favicon.ico HTTP/1.1 Host: courtscali.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://courtscali.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=284047251f4bef2673c2989d79659c5e
2024-12-18 18:26:11 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Wed, 18 Dec 2024 18:26:11 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-18 18:26:11 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-12-18 18:26:11 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49755	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:11 UTC	495	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 18:26:12 UTC	917	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Expires: Wed, 18 Dec 2024 18:26:11 GMT Date: Wed, 18 Dec 2024 18:26:11 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 18:26:12 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 7a 49 72 69 69 6a 6e 33 75 6a 35 56 70 6b 6e 76 74 5f 4c 6e 66 4e 62 46 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js');
2024-12-18 18:26:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49757	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:11 UTC	487	OUT	GET /js/bg/Xe7AbhhPfZcEikoNmhghBXAEhOusDIBKWKS_roS4Q7E.js HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 18:26:12 UTC	812	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18908 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 13 Dec 2024 09:14:19 GMT Expires: Sat, 13 Dec 2025 09:14:19 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 02 Dec 2024 19:00:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 465112 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-18 18:26:12 UTC	578	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 55 3d 66 75 6e 63 74 69 6f 6e 28 70 29 7b 72 65 74 75 72 6e 20 70 7d 2c 47 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 69 66 28 21 28 70 3d 28 62 3d 6e 75 6c 6c 2c 42 29 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 70 29 7c 7c 21 70 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 62 3b 74 72 79 7b 62 3d 70 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 55 2c 63 72 65 61 74 65 53 63 72 Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var U=function(p){return p},G=function(p,b){if(!(p=(b=null,B).trustedTypes,p)\|\|!p.createPolicy)return b;try{b=p.createPolicy("bg",{createHTML:U,createScr
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 48 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 66 6f 72 28 62 3d 5b 5d 3b 70 2d 2d 3b 29 62 2e 70 75 73 68 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 32 35 35 7c 30 29 3b 72 65 74 75 72 6e 20 62 7d 2c 43 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 62 2e 4a 2e 73 70 6c 69 63 65 28 30 2c 30 2c 70 29 7d 2c 65 5f 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 2c 55 2c 42 2c 59 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 7d 72 65 74 75 72 6e 20 42 3d 28 70 3d 24 71 28 70 2c 66 75 6e 63 74 69 6f 6e 28 76 29 7b 72 26 26 28 62 26 26 62 62 28 62 29 2c 59 3d 76 2c 72 28 29 2c 72 3d 76 6f 69 64 20 30 29 7d 2c 28 59 3d 76 6f 69 64 Data Ascii: DX-License-Identifier: Apache-2.0','/','var H=function(p,b){for(b=[];p--;)b.push(Math.random()255\|0);return b},C=function(p,b){b.J.splice(0,0,p)},e_=function(p,b,U,B,Y){function r(){}return B=(p=$q(p,function(v){r&&(b&&bb(b),Y=v,r(),r=void 0)},(Y=void
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 73 75 62 73 74 72 69 6e 67 28 33 29 2c 62 2c 55 2c 42 2c 59 2c 72 2c 76 29 3a 6f 65 28 62 2c 70 29 7d 2c 66 69 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 72 65 74 75 72 6e 20 62 3d 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 70 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 66 61 6c 73 65 2c 76 61 6c 75 65 3a 70 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 74 72 75 65 7d 7d 7d 2c 72 6a 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 72 65 74 75 72 6e 28 62 3d 64 28 70 29 2c 62 29 26 31 32 38 26 26 28 62 3d 62 26 31 32 37 7c 64 28 70 29 3c 3c 37 29 2c 62 7d 2c 76 41 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 72 65 74 75 72 6e 20 70 5b 62 5d 3c 3c 32 34 7c 70 5b 28 62 7c 30 29 2b 31 5d 3c 3c 31 36 7c 70 5b 28 62 7c 30 29 2b 32 5d 3c 3c 38 7c 70 Data Ascii: substring(3),b,U,B,Y,r,v):oe(b,p)},fi=function(p,b){return b=0,function(){return b<p.length?{done:false,value:p[b++]}:{done:true}}},rj=function(p,b){return(b=d(p),b)&128&&(b=b&127\|d(p)<<7),b},vA=function(p,b){return p[b]<<24\|p[(b\|0)+1]<<16\|p[(b\|0)+2]<<8\|p
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 29 29 2c 70 29 2e 42 2b 3d 70 2e 6a 28 29 2d 62 7d 65 6c 73 65 20 69 66 28 42 3d 3d 79 64 29 62 5b 33 5d 26 26 28 70 2e 6f 3d 74 72 75 65 29 2c 62 5b 34 5d 26 26 28 70 2e 44 3d 74 72 75 65 29 2c 70 2e 56 28 62 29 3b 65 6c 73 65 20 69 66 28 42 3d 3d 74 34 29 70 2e 6f 3d 74 72 75 65 2c 70 2e 56 28 62 29 3b 65 6c 73 65 20 69 66 28 42 3d 3d 78 71 29 7b 74 72 79 7b 66 6f 72 28 55 3d 30 3b 55 3c 70 2e 54 2e 6c 65 6e 67 74 68 3b 55 2b 2b 29 74 72 79 7b 59 3d 70 2e 54 5b 55 5d 2c 59 5b 30 5d 5b 59 5b 31 5d 5d 28 59 5b 32 5d 29 7d 63 61 74 63 68 28 72 29 7b 7d 7d 63 61 74 63 68 28 72 29 7b 7d 28 28 30 2c 62 5b 31 5d 29 28 66 75 6e 63 74 69 6f 6e 28 72 2c 76 29 7b 70 2e 6a 32 28 72 2c 74 72 75 65 2c 76 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 72 29 7b 28 43 28 28 72 3d Data Ascii: )),p).B+=p.j()-b}else if(B==yd)b[3]&&(p.o=true),b[4]&&(p.D=true),p.V(b);else if(B==t4)p.o=true,p.V(b);else if(B==xq){try{for(U=0;U<p.T.length;U++)try{Y=p.T[U],Y[0][Y[1]](Y[2])}catch(r){}}catch(r){}((0,b[1])(function(r,v){p.j2(r,true,v)},function(r){(C((r=
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 72 73 65 28 62 29 7d 63 61 74 63 68 28 65 29 7b 70 2e 67 3d 7b 7d 7d 46 28 28 28 50 28 28 50 28 28 4c 28 70 2c 33 31 30 2c 28 4c 28 70 2c 28 28 28 50 28 66 75 6e 63 74 69 6f 6e 28 65 2c 47 2c 58 2c 66 2c 54 2c 79 2c 68 2c 52 2c 61 2c 77 2c 49 2c 6d 29 7b 66 75 6e 63 74 69 6f 6e 20 4e 28 6e 2c 75 29 7b 66 6f 72 28 3b 52 3c 6e 3b 29 61 7c 3d 64 28 65 29 3c 3c 52 2c 52 2b 3d 38 3b 72 65 74 75 72 6e 20 75 3d 28 52 2d 3d 6e 2c 61 29 26 28 31 3c 3c 6e 29 2d 31 2c 61 3e 3e 3d 6e 2c 75 7d 66 6f 72 28 49 3d 28 79 3d 28 66 3d 28 47 3d 4a 28 65 29 2c 52 3d 61 3d 30 2c 4e 28 33 29 7c 30 29 2b 31 2c 6d 3d 4e 28 35 29 2c 30 29 2c 77 3d 5b 5d 2c 30 29 3b 79 3c 6d 3b 79 2b 2b 29 54 3d 4e 28 31 29 2c 77 2e 70 75 73 68 28 54 29 2c 49 2b 3d 54 3f 30 3a 31 3b 66 6f 72 28 79 Data Ascii: rse(b)}catch(e){p.g={}}F(((P((P((L(p,310,(L(p,(((P(function(e,G,X,f,T,y,h,R,a,w,I,m){function N(n,u){for(;R<n;)a\|=d(e)<<R,R+=8;return u=(R-=n,a)&(1<<n)-1,a>>=n,u}for(I=(y=(f=(G=J(e),R=a=0,N(3)\|0)+1,m=N(5),0),w=[],0);y<m;y++)T=N(1),w.push(T),I+=T?0:1;for(y
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 3d 28 47 5b 47 5b 33 35 33 5d 3d 65 2e 4f 5b 33 35 33 5d 2c 33 32 36 5d 3d 65 2e 4f 5b 33 32 36 5d 2c 47 29 7d 65 6c 73 65 20 4c 28 65 2c 32 31 32 2c 65 2e 4b 29 7d 2c 28 4c 28 28 4c 28 70 2c 28 50 28 66 75 6e 63 74 69 6f 6e 28 65 2c 47 2c 58 2c 66 29 7b 4c 28 65 2c 28 58 3d 28 47 3d 28 66 3d 4a 28 65 29 2c 4a 29 28 65 29 2c 4a 28 65 29 29 2c 47 3d 74 28 47 2c 65 29 2c 66 3d 74 28 66 2c 65 29 2c 58 29 2c 66 20 69 6e 20 47 7c 30 29 7d 2c 28 4c 28 70 2c 28 50 28 66 75 6e 63 74 69 6f 6e 28 65 2c 47 2c 58 2c 66 29 7b 4c 28 65 2c 28 66 3d 74 28 28 58 3d 28 47 3d 28 66 3d 28 58 3d 4a 28 65 29 2c 4a 28 65 29 29 2c 4a 28 65 29 29 2c 74 28 58 2c 65 29 29 2c 66 29 2c 65 29 2c 47 29 2c 58 5b 66 5d 29 7d 2c 28 4c 28 70 2c 28 50 28 28 50 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: =(G[G[353]=e.O[353],326]=e.O[326],G)}else L(e,212,e.K)},(L((L(p,(P(function(e,G,X,f){L(e,(X=(G=(f=J(e),J)(e),J(e)),G=t(G,e),f=t(f,e),X),f in G\|0)},(L(p,(P(function(e,G,X,f){L(e,(f=t((X=(G=(f=(X=J(e),J(e)),J(e)),t(X,e)),f),e),G),X[f])},(L(p,(P((P(function(
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 2c 79 2c 68 29 7b 66 6f 72 28 79 3d 28 58 3d 74 28 31 33 32 2c 28 68 3d 28 54 3d 4a 28 65 29 2c 72 6a 28 65 29 29 2c 47 3d 22 22 2c 65 29 29 2c 58 2e 6c 65 6e 67 74 68 29 2c 66 3d 30 3b 68 2d 2d 3b 29 66 3d 28 28 66 7c 30 29 2b 28 72 6a 28 65 29 7c 30 29 29 25 79 2c 47 2b 3d 57 5b 58 5b 66 5d 5d 3b 4c 28 65 2c 54 2c 47 29 7d 29 2c 70 2c 32 35 30 29 2c 34 33 36 29 2c 30 29 2c 70 29 2c 31 30 32 29 2c 33 32 36 29 2c 5b 32 30 34 38 5d 29 2c 70 29 2c 31 31 33 29 2c 32 34 35 29 2c 51 29 2c 70 29 2c 31 37 31 2c 5b 30 2c 30 2c 30 5d 29 2c 70 29 2c 31 33 37 29 2c 33 35 33 29 2c 5b 5d 29 2c 4c 28 70 2c 37 33 2c 30 29 2c 70 29 2c 36 31 29 2c 70 29 2c 33 37 33 29 2c 70 2e 69 39 3d 30 2c 34 32 31 29 2c 5b 5d 29 2c 70 29 2c 36 35 29 2c 31 31 31 29 29 2c 32 34 30 29 29 Data Ascii: ,y,h){for(y=(X=t(132,(h=(T=J(e),rj(e)),G="",e)),X.length),f=0;h--;)f=((f\|0)+(rj(e)\|0))%y,G+=W[X[f]];L(e,T,G)}),p,250),436),0),p),102),326),[2048]),p),113),245),Q),p),171,[0,0,0]),p),137),353),[]),L(p,73,0),p),61),p),373),p.i9=0,421),[]),p),65),111)),240))
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 31 36 7c 7c 62 3d 3d 32 30 34 7c 7c 62 3d 3d 33 35 33 7c 7c 62 3d 3d 34 32 31 7c 7c 62 3d 3d 37 36 7c 7c 62 3d 3d 31 37 31 7c 7c 62 3d 3d 32 36 38 7c 7c 62 3d 3d 33 32 36 3f 70 2e 4f 5b 62 5d 7c 7c 28 70 2e 4f 5b 62 5d 3d 59 71 28 70 2c 55 2c 62 2c 31 34 32 29 29 3a 70 2e 4f 5b 62 5d 3d 59 71 28 70 2c 55 2c 62 2c 31 31 33 29 7d 62 3d 3d 32 33 32 26 26 28 70 2e 4e 3d 44 28 66 61 6c 73 65 2c 33 32 2c 70 29 2c 70 2e 46 3d 76 6f 69 64 20 30 29 7d 2c 56 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 70 2e 59 3d 28 28 70 2e 59 3f 70 2e 59 2b 22 7e 22 3a 22 45 3a 22 29 2b 62 2e 6d 65 73 73 61 67 65 2b 22 3a 22 2b 62 2e 73 74 61 63 6b 29 2e 73 6c 69 63 65 28 30 2c 32 30 34 38 29 7d 2c 49 65 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 2c 55 2c 42 2c 59 29 7b 71 28 28 28 Data Ascii: 16\|\|b==204\|\|b==353\|\|b==421\|\|b==76\|\|b==171\|\|b==268\|\|b==326?p.O[b]\|\|(p.O[b]=Yq(p,U,b,142)):p.O[b]=Yq(p,U,b,113)}b==232&&(p.N=D(false,32,p),p.F=void 0)},V=function(p,b){p.Y=((p.Y?p.Y+"~":"E:")+b.message+":"+b.stack).slice(0,2048)},Ie=function(p,b,U,B,Y){q(((
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 31 32 38 29 3a 62 5b 59 2b 2b 5d 3d 42 3e 3e 31 32 7c 32 32 34 2c 62 5b 59 2b 2b 5d 3d 42 3e 3e 36 26 36 33 7c 31 32 38 29 2c 62 5b 59 2b 2b 5d 3d 42 26 36 33 7c 31 32 38 29 3b 72 65 74 75 72 6e 20 62 7d 2c 61 65 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 2c 55 2c 42 2c 59 2c 72 29 7b 69 66 28 21 62 2e 59 29 7b 62 2e 49 2b 2b 3b 74 72 79 7b 66 6f 72 28 72 3d 28 42 3d 28 59 3d 62 2e 4b 2c 76 6f 69 64 20 30 29 2c 30 29 3b 2d 2d 70 3b 29 74 72 79 7b 69 66 28 28 55 3d 76 6f 69 64 20 30 2c 62 29 2e 73 29 42 3d 7a 4e 28 62 2c 62 2e 73 29 3b 65 6c 73 65 7b 69 66 28 72 3d 74 28 32 31 32 2c 62 29 2c 72 3e 3d 59 29 62 72 65 61 6b 3b 42 3d 28 55 3d 4a 28 28 4c 28 62 2c 31 32 35 2c 72 29 2c 62 29 29 2c 74 28 55 2c 62 29 29 7d 42 26 26 42 5b 68 34 5d 26 32 30 34 38 3f 42 Data Ascii: 128):b[Y++]=B>>12\|224,b[Y++]=B>>6&63\|128),b[Y++]=B&63\|128);return b},ae=function(p,b,U,B,Y,r){if(!b.Y){b.I++;try{for(r=(B=(Y=b.K,void 0),0);--p;)try{if((U=void 0,b).s)B=zN(b,b.s);else{if(r=t(212,b),r>=Y)break;B=(U=J((L(b,125,r),b)),t(U,b))}B&&B[h4]&2048?B
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 62 2e 57 2c 70 28 66 75 6e 63 74 69 6f 6e 28 29 7b 46 28 74 72 75 65 2c 62 2c 74 72 75 65 29 7d 29 3b 62 72 65 61 6b 7d 7d 72 65 74 75 72 6e 20 55 7d 2c 4f 47 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 28 62 2e 70 75 73 68 28 70 5b 30 5d 3c 3c 32 34 7c 70 5b 31 5d 3c 3c 31 36 7c 70 5b 32 5d 3c 3c 38 7c 70 5b 33 5d 29 2c 62 2e 70 75 73 68 28 70 5b 34 5d 3c 3c 32 34 7c 70 5b 35 5d 3c 3c 31 36 7c 70 5b 36 5d 3c 3c 38 7c 70 5b 37 5d 29 2c 62 29 2e 70 75 73 68 28 70 5b 38 5d 3c 3c 32 34 7c 70 5b 39 5d 3c 3c 31 36 7c 70 5b 31 30 5d 3c 3c 38 7c 70 5b 31 31 5d 29 7d 2c 5a 3d 7b 70 61 73 73 69 76 65 3a 74 72 75 65 2c 63 61 70 74 75 72 65 3a 74 72 75 65 7d 2c 7a 4e 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 62 29 7b 72 65 74 75 72 6e 28 62 3d 62 2e 63 72 65 61 74 65 28 Data Ascii: b.W,p(function(){F(true,b,true)});break}}return U},OG=function(p,b){(b.push(p[0]<<24\|p[1]<<16\|p[2]<<8\|p[3]),b.push(p[4]<<24\|p[5]<<16\|p[6]<<8\|p[7]),b).push(p[8]<<24\|p[9]<<16\|p[10]<<8\|p[11])},Z={passive:true,capture:true},zN=function(p,b){return(b=b.create(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49758	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:11 UTC	869	OUT	GET /recaptcha/api2/bframe?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://courtscali.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 18:26:12 UTC	1161	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 18 Dec 2024 18:26:12 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-u4DfStjS09Bbi-8d08UXNg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 18:26:12 UTC	229	IN	Data Raw: 31 65 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 Data Ascii: 1e14<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* c
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 41 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 Data Ascii: yrillic-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A6
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 42 41 2c 20 55 2b 30 32 42 44 2d 30 32 43 35 2c 20 55 2b 30 32 43 37 2d 30 32 43 43 2c 20 55 2b 30 Data Ascii: 20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+0
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 Data Ascii: format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}/* cyrillic-ext */@font-face { font-family:
2024-12-18 18:26:12 UTC	1390	IN	Data Raw: 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d 30 31 36 39 2c 20 55 2b 30 31 41 30 2d 30 31 41 31 2c 20 55 2b 30 31 41 46 2d 30 31 42 30 2c 20 55 2b 30 33 30 30 2d 30 33 30 31 2c 20 55 2b 30 33 30 33 2d 30 33 30 34 2c 20 55 2b 30 33 30 38 2d 30 33 30 39 2c 20 55 2b 30 33 32 33 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 41 30 2d 31 45 46 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f Data Ascii: m/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}/* latin-ext */
2024-12-18 18:26:12 UTC	529	IN	Data Raw: 6e 33 75 6a 35 56 70 6b 6e 76 74 5f 4c 6e 66 4e 62 46 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 75 34 44 66 53 74 6a 53 30 39 42 62 69 2d 38 64 30 38 55 58 4e 67 22 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 2d 74 6f 6b 65 6e 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 75 34 44 66 53 74 6a 53 30 39 42 62 69 2d 38 64 30 38 55 58 4e 67 22 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 66 72 61 6d 65 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 Data Ascii: n3uj5Vpknvt_LnfNbF/recaptcha__en.js" nonce="u4DfStjS09Bbi-8d08UXNg"> </script></head><body><input type="hidden" id="recaptcha-token"><script type="text/javascript" nonce="u4DfStjS09Bbi-8d08UXNg"> recaptcha.frame.Main.init("[\x2
2024-12-18 18:26:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49787	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:23 UTC	863	OUT	POST /recaptcha/api2/reload?k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 9571 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 18:26:23 UTC	9571	OUT	Data Raw: 0a 18 7a 49 72 69 69 6a 6e 33 75 6a 35 56 70 6b 6e 76 74 5f 4c 6e 66 4e 62 46 12 ce 0f 30 33 41 46 63 57 65 41 34 47 58 6f 6a 51 45 6f 58 70 2d 48 52 39 79 72 5a 74 6a 34 50 42 43 5a 76 53 72 66 6c 77 6a 32 31 46 57 37 6a 78 57 30 64 6c 59 42 34 53 65 37 48 5a 57 33 47 77 5f 77 5f 72 32 31 38 2d 54 69 4a 32 6c 4d 39 69 54 45 31 50 37 4b 4b 6a 6f 6a 35 49 53 4c 51 6e 35 67 41 68 46 54 61 62 56 6b 55 44 53 6c 72 43 34 48 77 31 7a 54 63 6e 6e 4f 4b 6e 44 52 64 64 43 66 69 39 46 4a 61 55 4f 52 46 39 4f 67 4c 62 69 70 57 78 64 2d 64 4e 38 6c 43 4c 48 6a 2d 41 36 35 49 65 55 33 36 72 66 55 32 5f 4b 7a 67 6e 50 69 4a 72 71 68 45 56 6f 73 32 48 74 55 55 47 38 46 4e 4b 5f 5f 6b 6f 67 2d 32 52 6c 74 54 71 36 51 67 70 2d 5f 4b 66 36 42 6a 68 36 69 72 34 57 74 54 7a Data Ascii: zIriijn3uj5Vpknvt_LnfNbF03AFcWeA4GXojQEoXp-HR9yrZtj4PBCZvSrflwj21FW7jxW0dlYB4Se7HZW3Gw_w_r218-TiJ2lM9iTE1P7KKjoj5ISLQn5gAhFTabVkUDSlrC4Hw1zTcnnOKnDRddCfi9FJaUORF9OgLbipWxd-dN8lCLHj-A65IeU36rfU2_KzgnPiJrqhEVos2HtUUG8FNK__kog-2RltTq6Qgp-_Kf6Bjh6ir4WtTz
2024-12-18 18:26:23 UTC	1000	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Cross-Origin-Resource-Policy: same-site Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Date: Wed, 18 Dec 2024 18:26:23 GMT Server: ESF Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: _GRECAPTCHA=09AJNbFneg6JGPcvj59RepRC3nXXgdtwUkMy1vV5rGExz7mRxQ-MS4960akaoW7T5ysaYvOalq0S-4rgfYAjCvDTQ; Expires=Mon, 16-Jun-2025 18:26:23 GMT; Path=/recaptcha; Secure; HttpOnly; Priority=HIGH; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Expires: Wed, 18 Dec 2024 18:26:23 GMT Connection: close Transfer-Encoding: chunked
2024-12-18 18:26:23 UTC	390	IN	Data Raw: 34 30 62 32 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 34 44 42 50 6e 42 53 56 49 7a 6e 48 6d 4b 69 7a 78 53 48 46 55 43 53 65 42 4c 30 42 63 67 49 37 66 36 4f 54 2d 65 64 6e 5a 79 35 6f 76 4e 45 43 74 53 6a 61 5a 4c 6c 44 37 5f 4c 31 69 6e 46 45 73 37 6b 58 76 6f 56 38 67 34 59 64 4f 48 61 4b 55 48 79 6b 6d 67 33 76 6e 4b 76 33 45 71 66 51 6b 67 6c 5a 71 41 72 6d 79 7a 34 46 68 48 32 36 46 46 56 63 72 61 53 4c 50 77 33 54 4f 78 6a 70 51 57 5f 37 5a 65 6f 37 35 58 47 57 6d 51 70 42 35 62 73 46 31 49 5f 46 33 42 58 57 50 2d 4e 41 54 55 4b 73 53 42 75 44 48 46 68 51 6a 76 72 72 6d 64 35 50 73 53 4e 4d 59 6d 46 38 7a 6f 71 75 50 39 72 50 39 5f 71 42 4b 70 47 78 58 45 74 45 4b 61 4a 68 51 30 4a 72 77 54 57 67 38 4f 70 46 46 65 Data Ascii: 40b2)]}'["rresp","03AFcWeA4DBPnBSVIznHmKizxSHFUCSeBL0BcgI7f6OT-ednZy5ovNECtSjaZLlD7_L1inFEs7kXvoV8g4YdOHaKUHykmg3vnKv3EqfQkglZqArmyz4FhH26FFVcraSLPw3TOxjpQW_7Zeo75XGWmQpB5bsF1I_F3BXWP-NATUKsSBuDHFhQjvrrmd5PsSNMYmF8zoquP9rP9_qBKpGxXEtEKaJhQ0JrwTWg8OpFFe
2024-12-18 18:26:23 UTC	1390	IN	Data Raw: 31 53 57 72 70 70 72 4b 4b 32 4e 39 65 34 6c 69 64 79 7a 6a 35 42 34 72 2d 5a 5f 74 6d 55 61 70 65 76 68 6c 53 56 66 58 43 73 64 5f 79 49 74 59 47 45 2d 36 43 46 44 33 4d 67 53 74 7a 4a 41 66 51 38 42 4c 64 68 2d 68 76 55 30 4b 48 42 4b 73 7a 69 78 79 7a 64 47 55 55 65 32 51 46 4f 6b 78 36 58 2d 35 38 56 39 2d 4b 72 49 64 33 59 58 73 4a 71 75 39 33 49 5a 52 74 4a 47 69 39 53 75 68 6f 49 78 68 73 56 66 71 35 55 4c 46 33 67 6f 46 6a 4f 4f 31 46 6b 6c 74 74 6e 71 69 73 6c 4b 49 51 31 61 35 58 51 6f 64 6b 77 57 37 52 37 46 58 75 4b 65 31 52 52 55 4d 45 39 31 76 57 35 34 52 62 75 37 63 65 53 6a 62 71 6c 36 5f 6f 42 79 66 42 49 31 52 6c 64 6c 38 54 30 6f 58 57 4c 41 4e 76 42 52 2d 56 79 79 52 47 39 42 4b 48 59 6d 43 61 42 53 58 74 4d 64 61 6e 44 53 67 4d 47 4e Data Ascii: 1SWrpprKK2N9e4lidyzj5B4r-Z_tmUapevhlSVfXCsd_yItYGE-6CFD3MgStzJAfQ8BLdh-hvU0KHBKszixyzdGUUe2QFOkx6X-58V9-KrId3YXsJqu93IZRtJGi9SuhoIxhsVfq5ULF3goFjOO1FklttnqislKIQ1a5XQodkwW7R7FXuKe1RRUME91vW54Rbu7ceSjbql6_oByfBI1Rldl8T0oXWLANvBR-VyyRG9BKHYmCaBSXtMdanDSgMGN
2024-12-18 18:26:23 UTC	1390	IN	Data Raw: 39 6d 57 51 68 52 44 58 4b 78 42 72 30 57 42 6f 38 72 68 77 61 7a 65 6c 4e 73 74 66 6e 47 36 55 79 63 35 36 34 54 34 4a 34 43 49 5a 61 77 77 30 35 41 43 4c 5a 38 64 31 31 61 48 45 63 31 38 41 71 38 35 6d 77 57 46 6f 65 43 69 6a 45 49 76 63 77 77 5a 75 4e 42 54 43 42 6b 69 76 66 52 50 38 39 78 59 4b 33 50 71 52 30 38 67 51 76 52 46 74 48 57 70 44 66 35 52 2d 49 65 67 33 6c 41 73 4b 75 35 4f 61 4b 73 56 76 5a 6a 53 31 64 4f 78 6c 45 59 79 70 41 59 58 64 50 45 47 48 72 61 31 4e 76 30 45 61 47 55 38 6b 33 36 75 4e 44 39 7a 75 53 48 71 54 5a 64 49 33 41 45 53 52 6d 5f 4d 56 6c 67 43 7a 49 41 2d 44 4f 77 36 4f 58 45 62 30 6f 50 4e 48 63 6a 4a 46 61 44 59 39 42 4c 4a 47 30 77 74 50 52 30 79 38 78 67 77 57 68 56 4a 58 39 4b 42 65 70 53 5f 66 59 67 34 68 48 7a 35 Data Ascii: 9mWQhRDXKxBr0WBo8rhwazelNstfnG6Uyc564T4J4CIZaww05ACLZ8d11aHEc18Aq85mwWFoeCijEIvcwwZuNBTCBkivfRP89xYK3PqR08gQvRFtHWpDf5R-Ieg3lAsKu5OaKsVvZjS1dOxlEYypAYXdPEGHra1Nv0EaGU8k36uND9zuSHqTZdI3AESRm_MVlgCzIA-DOw6OXEb0oPNHcjJFaDY9BLJG0wtPR0y8xgwWhVJX9KBepS_fYg4hHz5
2024-12-18 18:26:23 UTC	1390	IN	Data Raw: 48 43 4d 75 5a 4a 35 4a 30 4b 38 51 4c 5a 71 7a 64 49 35 43 41 78 74 73 67 6a 5a 35 6d 2d 74 65 5f 34 31 69 49 2d 66 38 2d 50 71 4e 74 65 6f 2d 44 2d 50 77 34 33 44 6a 76 4e 54 4b 67 38 55 63 43 54 4d 57 46 48 2d 45 6f 6b 4b 56 79 4b 6e 59 5a 41 63 5a 7a 68 6e 65 63 46 4a 4a 65 73 46 4d 6f 79 69 33 68 6b 36 5f 4a 6a 70 62 69 37 38 31 6d 52 59 31 32 59 52 4e 77 52 43 4d 30 55 72 44 78 70 58 6e 75 54 49 42 30 5f 78 68 70 48 6b 52 42 6d 67 6c 6f 73 36 51 49 57 5f 4c 6c 71 55 4c 4e 4b 4c 45 6f 78 50 63 62 38 71 58 59 44 42 4a 68 70 41 57 41 47 31 74 73 66 74 32 71 70 67 6d 55 50 68 79 4d 74 68 68 5a 74 39 48 32 69 5a 6f 42 54 63 6d 37 57 78 4b 77 32 58 61 33 63 47 39 79 31 78 6a 31 4c 41 4a 4f 61 59 41 75 6b 57 45 6c 34 73 59 77 34 49 69 71 4b 30 33 58 63 32 Data Ascii: HCMuZJ5J0K8QLZqzdI5CAxtsgjZ5m-te_41iI-f8-PqNteo-D-Pw43DjvNTKg8UcCTMWFH-EokKVyKnYZAcZzhnecFJJesFMoyi3hk6_Jjpbi781mRY12YRNwRCM0UrDxpXnuTIB0_xhpHkRBmglos6QIW_LlqULNKLEoxPcb8qXYDBJhpAWAG1tsft2qpgmUPhyMthhZt9H2iZoBTcm7WxKw2Xa3cG9y1xj1LAJOaYAukWEl4sYw4IiqK03Xc2
2024-12-18 18:26:23 UTC	1390	IN	Data Raw: 78 44 41 43 72 71 74 64 51 47 4d 57 61 71 74 6d 4c 4b 67 6a 64 5f 57 43 62 32 35 35 4b 78 46 46 5f 51 48 7a 41 6f 53 4e 6c 53 75 46 33 69 42 6d 41 53 52 52 56 76 30 50 48 73 6f 45 72 6a 64 4f 38 30 6a 4a 70 44 34 64 73 33 51 52 78 36 6b 66 55 6d 75 78 79 66 43 68 5f 71 64 57 73 38 6d 2d 32 36 49 39 31 6c 4c 68 4c 62 52 4f 4e 4d 36 4a 65 66 68 6b 54 42 37 44 42 52 4b 35 55 4b 62 2d 51 36 78 44 78 68 54 41 58 4a 61 49 6f 44 79 65 4b 61 4e 4e 74 33 4f 61 54 5f 6c 63 67 54 44 4d 71 78 4b 4d 59 39 38 58 35 55 6c 6d 6f 54 5f 6c 75 74 72 4a 55 76 48 64 62 6c 54 51 4b 4d 47 48 33 67 51 51 32 77 66 57 66 56 63 49 4b 64 31 75 70 49 65 6e 41 6c 48 54 41 4c 73 75 5a 6c 43 6a 6a 67 30 32 46 30 72 59 46 48 79 79 64 38 4e 4c 78 5a 49 68 50 6f 52 30 32 6e 70 70 5f 6e 69 Data Ascii: xDACrqtdQGMWaqtmLKgjd_WCb255KxFF_QHzAoSNlSuF3iBmASRRVv0PHsoErjdO80jJpD4ds3QRx6kfUmuxyfCh_qdWs8m-26I91lLhLbRONM6JefhkTB7DBRK5UKb-Q6xDxhTAXJaIoDyeKaNNt3OaT_lcgTDMqxKMY98X5UlmoT_lutrJUvHdblTQKMGH3gQQ2wfWfVcIKd1upIenAlHTALsuZlCjjg02F0rYFHyyd8NLxZIhPoR02npp_ni
2024-12-18 18:26:23 UTC	1390	IN	Data Raw: 65 57 6c 4d 57 6b 5a 56 54 55 74 6b 57 45 4e 68 63 47 30 7a 53 30 52 4a 63 55 4e 36 4e 6d 46 49 62 30 35 56 63 46 68 4f 57 57 31 55 5a 31 70 4c 53 56 56 30 4d 30 35 32 52 45 31 68 4c 31 45 32 53 57 4a 70 56 31 46 51 4e 46 4e 42 4d 55 4a 5a 4e 6d 67 35 61 6c 6c 6e 56 6d 6c 34 4e 33 42 72 4d 32 59 35 55 54 4a 79 5a 30 4d 35 64 58 64 6f 5a 30 38 33 56 44 42 6e 5a 55 34 79 64 6c 64 51 51 57 31 69 56 44 52 52 4e 30 4e 4b 64 43 73 33 5a 53 38 30 63 44 6c 68 51 32 78 49 61 56 70 59 59 6d 45 79 4d 6d 74 56 4f 56 67 32 5a 46 6c 61 57 55 4e 70 56 6b 70 53 54 32 5a 58 55 6d 78 47 52 47 64 51 54 45 74 32 5a 45 4a 32 4d 33 52 4d 63 54 56 6d 4e 33 70 73 54 48 6c 75 65 55 4e 73 53 58 45 79 53 33 51 34 56 30 77 79 53 57 6c 32 55 6d 78 77 56 7a 68 32 54 48 51 32 55 47 52 Data Ascii: eWlMWkZVTUtkWENhcG0zS0RJcUN6NmFIb05VcFhOWW1UZ1pLSVV0M052RE1hL1E2SWJpV1FQNFNBMUJZNmg5allnVml4N3BrM2Y5UTJyZ0M5dXdoZ083VDBnZU4ydldQQW1iVDRRN0NKdCs3ZS80cDlhQ2xIaVpYYmEyMmtVOVg2ZFlaWUNpVkpST2ZXUmxGRGdQTEt2ZEJ2M3RMcTVmN3psTHlueUNsSXEyS3Q4V0wySWl2UmxwVzh2THQ2UGR
2024-12-18 18:26:23 UTC	1390	IN	Data Raw: 5a 36 54 6e 46 73 4e 55 77 79 4e 56 46 79 5a 6a 68 76 52 32 30 35 63 30 5a 58 52 30 74 68 5a 47 5a 59 61 6b 46 74 52 47 74 30 63 6e 64 5a 64 57 5a 45 63 57 31 68 4d 33 6c 79 51 58 70 73 61 6d 6b 78 4d 6a 4a 61 55 47 4a 6f 61 7a 4a 52 59 57 64 79 55 31 6b 35 51 57 74 58 63 6d 56 34 52 33 59 35 65 6e 4e 4e 53 6b 4e 6d 54 57 68 58 5a 48 4a 6d 52 6d 46 6c 5a 57 34 31 54 6d 4a 50 57 46 6c 73 55 57 67 32 63 58 52 53 54 56 64 6a 61 6a 64 42 53 57 78 54 4d 30 51 30 54 48 56 59 51 6d 6f 7a 4e 55 5a 35 61 6d 56 47 5a 47 73 77 55 7a 5a 53 54 32 46 76 54 6e 70 35 4c 30 31 45 4c 31 4e 33 51 30 68 35 52 6d 38 32 62 33 4e 58 52 55 46 61 52 44 68 5a 55 46 4a 43 57 44 4a 61 62 6c 56 71 65 48 4a 44 4f 56 5a 4f 4d 6e 6c 79 4e 32 78 72 54 32 4a 6b 57 6b 78 57 4b 32 70 34 59 Data Ascii: Z6TnFsNUwyNVFyZjhvR205c0ZXR0thZGZYakFtRGt0cndZdWZEcW1hM3lyQXpsamkxMjJaUGJoazJRYWdyU1k5QWtXcmV4R3Y5enNNSkNmTWhXZHJmRmFlZW41TmJPWFlsUWg2cXRSTVdjajdBSWxTM0Q0THVYQmozNUZ5amVGZGswUzZST2FvTnp5L01EL1N3Q0h5Rm82b3NXRUFaRDhZUFJCWDJablVqeHJDOVZOMnlyN2xrT2JkWkxWK2p4Y
2024-12-18 18:26:23 UTC	1390	IN	Data Raw: 4f 54 6b 79 4f 46 4e 78 64 47 55 76 54 6b 4a 45 4e 30 6c 4c 53 44 42 54 5a 57 68 6c 5a 6a 42 72 63 31 6c 4e 56 6c 6c 50 4c 32 5a 32 4e 6d 52 77 56 56 55 7a 64 79 74 56 52 30 4e 45 54 6b 78 6c 65 48 56 72 62 6b 55 35 61 30 39 59 51 57 46 30 4d 30 77 31 5a 57 70 4f 61 7a 56 4a 53 55 31 72 65 6d 5a 54 4b 30 74 45 4d 54 5a 77 4d 47 70 46 4f 57 64 56 55 6d 31 6d 57 6d 64 53 56 6a 4a 6a 63 44 42 6d 5a 6e 5a 6b 59 30 78 6f 57 48 4a 59 5a 79 74 4f 4c 33 4a 6e 55 46 64 58 61 6b 64 36 64 56 64 34 55 7a 5a 36 64 56 42 68 56 7a 64 68 4c 31 4e 73 4b 31 4d 33 61 58 6f 30 53 46 42 6d 4e 47 52 4b 63 55 31 32 57 69 74 74 4f 58 6c 70 53 57 70 34 54 48 56 42 4e 55 56 6c 54 56 6f 76 65 47 52 4e 4e 31 46 31 52 58 56 30 51 30 5a 70 57 57 4e 33 4e 32 6c 47 64 30 52 4d 62 44 51 Data Ascii: OTkyOFNxdGUvTkJEN0lLSDBTZWhlZjBrc1lNVllPL2Z2NmRwVVUzdytVR0NETkxleHVrbkU5a09YQWF0M0w1ZWpOazVJSU1remZTK0tEMTZwMGpFOWdVUm1mWmdSVjJjcDBmZnZkY0xoWHJYZytOL3JnUFdXakd6dVd4UzZ6dVBhVzdhL1NsK1M3aXo0SFBmNGRKcU12WittOXlpSWp4THVBNUVlTVoveGRNN1F1RXV0Q0ZpWWN3N2lGd0RMbDQ
2024-12-18 18:26:23 UTC	1390	IN	Data Raw: 31 53 4e 30 52 54 52 55 39 46 64 46 4e 6b 4d 6d 34 76 4d 6b 70 5a 55 45 52 59 53 57 4a 4d 4f 45 74 79 56 47 6c 73 63 55 46 4c 53 32 4e 6e 63 6d 39 32 64 6b 45 76 57 54 4e 56 4f 57 5a 59 52 7a 56 77 4e 6c 52 55 65 45 68 52 56 31 4e 6c 55 6a 5a 72 56 7a 41 72 59 6d 38 34 62 6c 52 52 65 56 63 34 56 33 64 30 56 30 35 77 53 6a 68 58 52 6a 6c 4e 59 6c 52 56 4c 32 39 34 55 32 6c 78 56 55 31 45 53 30 70 30 51 55 31 76 51 6a 6c 69 54 47 74 30 51 33 64 50 62 6e 52 71 53 32 4a 34 5a 6c 42 50 51 6e 42 59 4e 32 52 7a 64 45 6c 53 63 33 68 56 65 45 4e 76 63 6b 6c 74 61 6d 39 72 52 57 30 77 64 6e 5a 6b 61 44 52 33 4e 6a 55 79 4e 46 4e 6a 54 58 49 31 54 46 6c 61 51 6d 4e 35 64 55 52 59 4e 6c 4e 47 53 44 49 79 4f 45 78 45 63 30 46 4f 51 55 35 35 4d 31 64 56 62 54 6c 33 62 Data Ascii: 1SN0RTRU9FdFNkMm4vMkpZUERYSWJMOEtyVGlscUFLS2Nncm92dkEvWTNVOWZYRzVwNlRUeEhRV1NlUjZrVzArYm84blRReVc4V3d0V05wSjhXRjlNYlRVL294U2lxVU1ES0p0QU1vQjliTGt0Q3dPbnRqS2J4ZlBPQnBYN2RzdElSc3hVeENvckltam9rRW0wdnZkaDR3NjUyNFNjTXI1TFlaQmN5dURYNlNGSDIyOExEc0FOQU55M1dVbTl3b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49792	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:25 UTC	610	OUT	GET /recaptcha/api2/reload?k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJNbFneg6JGPcvj59RepRC3nXXgdtwUkMy1vV5rGExz7mRxQ-MS4960akaoW7T5ysaYvOalq0S-4rgfYAjCvDTQ
2024-12-18 18:26:26 UTC	743	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 18 Dec 2024 18:26:26 GMT Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Allow: POST Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 18:26:26 UTC	647	IN	Data Raw: 36 38 30 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f Data Ascii: 680<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 405 (Bad Request)!!1</title><style>*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{backgro
2024-12-18 18:26:26 UTC	1024	IN	Data Raw: 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background
2024-12-18 18:26:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49796	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:25 UTC	1152	OUT	GET /recaptcha/api2/payload?p=06AFcWeA4YFRzCJeJ7iEASfaybY4kTmVYn01WAd41JO-iACJK_XSTVni0zjqDPxkAQ28jYhIba4FYwlGJwjJNdYd1EzyW3hmMaCPN7Z5lm7WAFiixSJTpzx2XM4re58oquNlyltuelM1o_8cFtN4W5qrpanFT0BMotJc6UCxEFoUmctwPZXIJUDDhuoDN-9YZELODO6se-duYB&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJNbFneg6JGPcvj59RepRC3nXXgdtwUkMy1vV5rGExz7mRxQ-MS4960akaoW7T5ysaYvOalq0S-4rgfYAjCvDTQ
2024-12-18 18:26:26 UTC	681	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Wed, 18 Dec 2024 18:26:26 GMT Date: Wed, 18 Dec 2024 18:26:26 GMT Cache-Control: private, max-age=30 Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Cross-Origin-Resource-Policy: same-site Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-18 18:26:26 UTC	709	IN	Data Raw: 36 63 36 30 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 6c60JFIFC!"$"$C,,"}!1AQa"q
2024-12-18 18:26:26 UTC	1390	IN	Data Raw: 7b e3 8a ea 24 52 c7 03 8a 60 85 59 58 32 86 1d 39 ad 23 55 a2 25 4d 3d 8e 75 65 43 b8 d0 65 5c 8c 9e f4 cb a8 71 2b ed 50 a3 3f 77 3d 2a b1 46 ef 5b de e6 3c a5 cf 31 4b 67 3d 85 1b 86 07 22 a8 ed 60 72 09 a0 17 1d e8 b8 b9 4b c7 04 fe 06 b4 74 0f f5 f3 7f bb fe 15 83 e7 38 e7 19 c5 6c f8 5e 4d f3 4f 91 d1 45 26 38 ad 4f a5 3f 64 91 ff 00 23 3f fd ba 7f ed 6a f7 62 2b c2 bf 64 8e be 27 ff 00 b7 4f fd ad 5e f0 45 7b f8 1f e0 47 e7 f9 9e 16 3d fe fe 5f 2f c8 8c d0 05 48 16 9c a9 5d 97 38 c8 f6 d3 76 fb 55 6d 6b 5a d1 74 58 d9 b5 6d 52 d2 cf 6a 6f 2b 2c 80 36 33 8c 85 ea 79 f6 ae 77 55 f8 9b e0 db 1b 24 b9 83 51 3a 8b c8 0e c8 6d 50 b3 7e 39 c6 df c6 b3 95 78 43 e2 76 1a 8c 9e c8 eb 04 59 ed 59 7a ce bd a0 e8 c1 4e ab ab 5a 5a 97 04 a8 79 06 5b 1d 70 07 35 Data Ascii: {$R`YX29#U%M=ueCe\q+P?w=*F[<1Kg="`rKt8l^MOE&8O?d#?jb+d'O^E{G=_/H]8vUmkZtXmRjo+,63ywU$Q:mP~9xCvYYzNZZy[p5
2024-12-18 18:26:26 UTC	1390	IN	Data Raw: 8d 11 cd 33 4d b7 85 ee 2e a7 68 63 69 63 b9 91 15 ca 8d ca 38 c8 06 ae 32 51 17 a0 a4 b5 28 3c 78 24 54 2e 95 a3 22 65 7a 73 55 e4 4a d5 33 36 8a 45 69 8c 95 69 96 a3 22 ad 32 1a 2b 32 53 0a d5 a6 5a 88 8e 7a 53 44 1f 28 4e 93 88 8b 3c 80 af 7c 0f 7a a7 6e 1b ed 00 a6 37 2b 64 1a d4 bd e2 d0 f1 df fa d6 7d 97 37 04 f6 ae 66 7a 2b 63 ae b2 b9 8a ee 00 06 23 9b 1c a1 3c 1f a5 59 11 b0 0a 18 10 45 73 8a 3e 54 c1 c7 20 d6 9d a6 ab 22 62 2b 85 f3 50 74 3f c4 2b 09 d1 ec 6d 1a bd 18 e3 a8 45 1c cd 14 f1 bc 6e 18 00 08 fb c3 d4 54 17 57 51 4d 76 91 ef 50 14 6e c1 38 cd 1a a5 9c 17 72 ad e4 77 72 32 15 2b b0 1e 57 82 6b 9b f2 e5 69 d0 be fd a7 ee 96 1f 78 66 a6 34 d3 29 d4 67 a7 5b 94 11 44 80 fd d4 03 f4 a9 b8 20 9f 4a c1 b2 bd 49 97 7a 33 2a e4 8c 30 c1 18 ad Data Ascii: 3M.hcic82Q(<x$T."ezsUJ36Eii"2+2SZzSD(N<\|zn7+d}7fz+c#<YEs>T "b+Pt?+mEnTWQMvPn8rwr2+Wkixf4)g[D JIz3*0
2024-12-18 18:26:26 UTC	1390	IN	Data Raw: 61 b7 0c 3e f7 7e 07 e9 57 66 89 fc c0 a6 da 56 da 0e e0 f2 67 19 ee 7f cf 5a a3 a5 48 11 26 cb 6c 27 6f 20 0c 8e bd 2a f2 a5 d3 a9 fd e7 95 18 19 27 f8 7d b9 ef c5 09 db 56 79 b8 a5 fb d7 fd 74 14 ce 12 36 b8 97 62 2a 02 15 14 72 79 f7 e6 ab a8 39 02 08 36 99 00 2e fd 42 93 c7 e9 56 e5 b5 2f 01 73 3a b4 84 1d a5 c7 22 90 e9 7a 96 ac 88 2d a4 1e 64 4b 91 ce d5 cf 7e 6a 25 52 31 57 6c cd 42 db 8d b1 b2 0c e5 18 7d a2 5c e4 95 c8 0a bd 3e 9f 53 57 86 9b 71 71 26 eb 3f 20 22 29 32 ed 90 02 17 d4 f3 d3 35 7e de c6 4b 0b 58 e3 be 96 d8 b3 10 65 2a 0b 60 0e 83 27 f4 e3 a9 ac 8f 13 4e 6e 5d 6f 60 89 a3 0a 9b 59 63 e3 7a 93 c8 e9 d7 f0 fe 84 72 3c 54 a7 3b 44 d2 9c 23 29 6b b1 61 f4 69 ed 2d e1 10 ac 45 df 25 94 48 0b e3 23 9e 3b 1e b8 a8 6d 23 b6 d2 20 7b b4 db Data Ascii: a>~WfVgZH&l'o '}Vyt6bry96.BV/s:"z-dK~j%R1WlB}\>SWqq&? ")25~KXe*`'Nn]o`Yczr<T;D#)kai-E%H#;m# {
2024-12-18 18:26:26 UTC	1390	IN	Data Raw: 50 de 8b 6b 48 43 49 2e 7e 69 0e 56 30 06 4e ee be 95 c7 52 70 84 9b 67 06 27 f8 ac ad a7 ca 35 08 56 5f 2d fc b4 25 54 83 85 ce 7a f3 cf 1f d2 ba 16 d4 16 0b 2f 2d 22 74 4c 6c 18 1d 79 fd 6b 26 e1 61 d2 57 6b 46 23 84 33 15 48 ce 49 e7 9a a2 fa e5 b4 51 8b 78 c0 3b 5b 73 2b 8c e7 e9 ea 71 fc eb 9e 51 75 9d d6 c6 3c b7 35 fe de 4b 49 6f 19 76 ca 10 db 9b b7 d3 bf 5e 95 95 73 a8 88 6e bc b5 1e 65 a9 1b 5b 78 21 4f 07 20 90 78 f4 cf 3d fd 46 29 d9 5c 47 3d e8 91 d1 91 4a 9e b9 e8 7e b9 c7 19 c7 d4 56 54 b7 46 57 bd 81 ae 01 11 1c 2a b7 f1 00 71 8f eb c5 6f 0a 2a e7 4e 1e 12 75 39 2d b8 e5 69 2c ae a6 96 03 24 50 2b 11 1f 96 bf 2e 71 9d a4 f4 c1 fc 79 ed 8a 85 ee 27 53 f6 9b 62 23 2c c3 ed 0a 18 85 24 0c e4 f1 d0 f3 9e bf e3 8e f7 12 3c 0d 15 c3 6d 28 48 01 Data Ascii: PkHCI.~iV0NRpg'5V_-%Tz/-"tLlyk&aWkF#3HIQx;[s+qQu<5KIov^sne[x!O x=F)\G=J~VTFWqoNu9-i,$P+.qy'Sb#,$<m(H
2024-12-18 18:26:26 UTC	1390	IN	Data Raw: 7e b5 5d 96 33 0a 09 55 d2 61 90 58 9c 65 7b 7e 34 e2 ac 8e d8 d2 9a 9a ea d1 5f 52 0b 7e 2d ae 12 e0 19 36 95 68 c9 0d b5 46 06 78 eb 9e 78 eb 59 b7 12 39 04 c8 e8 d8 6c 10 48 c8 00 f2 33 cf a0 f5 ab 17 10 fd 94 4b 14 8c 4f 97 3e e0 33 d8 8e a3 03 9e 8b f9 f7 a8 67 81 0d ba c8 13 f7 81 80 66 cf 38 3e dd b9 fe 95 d3 cd 73 49 26 86 89 43 58 ba bc 65 db 86 c6 e2 49 ea 33 fa ff 00 9c 54 d6 d2 b1 12 5b a1 44 0c a7 68 da 0b 67 07 b9 e8 39 3d 0f 5f 5a ab 1b 18 b6 c9 09 28 e0 ee 07 3d 0f 3b 86 3f 15 20 d4 cb 39 92 4f 33 8f 33 0c 5b 8f 97 9e f8 1f d6 9a 42 b9 16 d7 f3 64 b6 55 dc d9 c7 3d 7d 0f 15 6e ca c5 22 b1 91 8c 8a ce 8e 11 e3 c7 38 61 cf 5f 4e 6a 0d fe 64 9e 6c 7b 4b 46 b9 2f 83 8e b8 c8 e3 a7 7e 45 6b 68 9a 62 ea a6 58 85 e0 8e 62 ac e8 87 3c 7d 71 f5 15 Data Ascii: ~]3UaXe{~4_R~-6hFxxY9lH3KO>3gf8>sI&CXeI3T[Dhg9=_Z(=;? 9O33[BdU=}n"8a_Njdl{KF/~EkhbXb<}q
2024-12-18 18:26:26 UTC	1390	IN	Data Raw: 9a 11 e7 ff 00 23 d7 d4 f1 47 b9 99 7c e9 c1 1f ed d3 cc 0f 8f 96 e6 6f cc 7f 85 4f b6 93 57 5f d7 e2 3d 99 f0 5f c6 cf 84 37 7f 0d 6e f4 0d 37 4d d7 0e bc da e3 4f e6 3b da 1b 54 b4 48 7c bc bb 7c cf b9 4f 9b ed d3 be 6b 80 f1 2f 87 ed b4 db 89 a3 8f c4 31 dc 38 04 aa c5 6e 57 f9 35 7d 3f fb 6b c9 71 67 2f 84 a6 5b 86 39 83 50 56 dd 8e 87 ec dc 0c 63 fc 8a f9 31 99 e4 81 a7 40 a4 39 c6 77 72 31 eb f9 56 d4 ec e3 cc fa 98 4e 0a 52 b9 8f 2d a4 85 a6 57 b8 67 23 80 c7 83 fd 78 a9 ad a2 5b 35 03 99 58 ae 09 cf 41 f8 73 9f 7a ba 6d 99 65 de 55 b0 40 cf b5 59 4b 79 64 5d a8 23 24 0e 06 ce a3 26 a9 b2 e3 14 b6 28 47 72 ae 8a ad be 12 1b 70 91 79 6f a6 7b 54 90 da 5d 6a 53 46 d6 76 ee 48 7c 23 90 70 14 7f 13 0f c6 ae 5f 69 5a 9d a7 ef e6 b4 92 00 ca 0c 6c c3 d4 Data Ascii: #G\|oOW_=_7n7MO;TH\|\|Ok/18nW5}?kqg/[9PVc1@9wr1VNR-Wg#x[5XAszmeU@YKyd]#$&(Grpyo{T]jSFvH\|#p_iZl
2024-12-18 18:26:26 UTC	1390	IN	Data Raw: 89 15 81 f9 80 c7 5e f5 d8 7c 40 f1 5d 96 bd e1 bb 5b 0b 49 2f e2 9a ee f6 2b 21 73 70 3e cd 28 20 0d c4 f1 d3 71 52 70 08 cf a7 15 cf 37 88 2e f5 3d 36 c7 c3 fa d4 d7 32 cf 63 72 c2 f1 13 07 ce 45 e0 4c a7 bb 11 bb 3c f5 1e f5 cd 4e 72 b9 b4 a3 a5 d9 e9 be 1b f8 97 7c da 5a 36 b1 e0 ff 00 14 34 ff 00 c2 f6 da 53 95 75 c0 c1 e4 f5 ab 77 3f 14 6c 61 8c bc be 13 f1 72 2a f5 2d a6 e3 ff 00 66 ac 9d 1b c2 9a 7d 95 9a 49 75 e1 d9 75 cb 67 50 d0 de 5a dc 1f 9d 0f 4c c6 58 10 70 79 c6 6b ad 6f 00 f8 4c 80 57 44 83 fe 04 cc 7f ad 6f 39 54 71 d8 ca d0 4f 53 94 9b e2 46 9d ab 5e dd d8 49 a1 cd 6e b6 b6 12 5d 63 53 55 8d dd 80 c6 d5 8c e7 77 de 1d fa 67 8a d6 f8 51 e1 bd 15 3c 27 05 e3 c2 2e e5 bc 02 59 56 61 b9 15 bd 02 1e 06 3d 71 9e 7a e2 bc e3 c6 de 10 b0 79 7c Data Ascii: ^\|@][I/+!sp>( qRp7.=62crEL<Nr\|Z64Suw?lar*-f}IuugPZLXpykoLWDo9TqOSF^In]cSUwgQ<'.YVa=qzy\|
2024-12-18 18:26:26 UTC	1390	IN	Data Raw: ff 00 4e f1 66 ad 71 0c 6f 8d b6 50 9d be 5f 71 ec bf 4c 13 eb 55 fc 2d 00 f1 5f 8f b5 2f 11 5d a8 96 d2 c1 c4 56 aa 4e 40 3c ed 38 f6 c1 3f 56 ae eb 57 bb 3a 6e 9f 77 79 92 76 44 59 07 f7 9b 1f 28 fa e7 03 f1 ae 69 4e db ad 0d b5 f9 9f 3e 6b ba 65 b7 8a be 25 c9 a1 c3 75 3c 3a 45 bc f3 c8 cc 7a 44 b1 02 5c a9 f7 20 0e 3d bd 2b 3a 4b 59 74 8d 6f 4c d5 2d de 5b c8 51 fc cb 79 93 2a d3 c4 0f cf 13 63 a3 01 fe 35 da 59 e9 4f a5 69 ba c7 96 37 de ba c5 a2 40 c3 f8 dd ce f9 db 3e ee ed cf fb 35 b9 26 90 cd ab 49 a2 e9 21 22 3a 65 84 32 c3 28 5c 66 e9 49 2a de fb 86 41 f5 15 cf 1a 8d 5a c6 ee 27 05 e1 df 1f 6a 1a 07 89 27 b9 d3 43 5c e9 c2 37 cc 52 48 44 7e 5b 30 28 e1 7b 6d c8 ce 3d f9 c7 35 ed 3f 0d bc 6d ff 00 09 44 57 10 5d c7 04 37 b0 e1 b6 c6 7e 57 4f 51 Data Ascii: NfqoP_qLU-_/]VN@<8?VW:nwyvDY(iN>ke%u<:EzD\ =+:KYtoL-[Qyc5YOi7@>5&I!":e2(\fIAZ'j'C\7RHD~[0({m=5?mDW]7~WOQ
2024-12-18 18:26:26 UTC	1390	IN	Data Raw: 67 79 67 7b 18 92 ce ee 0b 84 23 21 a2 90 30 23 f0 fa d5 a0 26 cd 2e 69 28 a7 71 58 78 3c 52 83 4c 62 a8 b9 76 0a 3d 49 c5 2f 18 04 1c 83 d0 8a 77 11 20 6a 72 b5 43 9a 70 34 5c 09 d5 aa 40 f5 59 5b be 71 50 43 a9 e9 b3 a6 f8 75 1b 49 17 38 ca 4e a4 7f 3a 77 03 cd 7e 16 f8 92 db 4a b2 6d 3e 78 d5 44 92 97 12 67 1c 90 06 0f e5 5d ee b5 78 24 16 4e aa b2 5a 79 be 74 81 80 39 2a 3e 55 1d b2 58 af e5 5e 35 a6 69 b3 4b a7 dd 15 1f bd b5 93 6c 8b fe 7e 86 b5 fc 33 a9 b2 5d 43 65 73 14 77 2b 2b ec 51 28 dc 06 7a 0f cf 15 cb 37 7b d8 e8 82 4f 73 a5 d2 e3 df 71 a6 24 f1 e1 ac d2 4d 4a f1 58 7c c6 59 89 60 00 3c e4 6e 7f c8 57 49 e1 14 b5 b9 bb d5 35 88 e4 46 5b 9b 80 91 3f 72 91 a8 51 81 f5 dd 5c cc de 13 d2 f5 fb b9 b5 28 35 2b b4 96 e9 02 39 8e 5c 01 c7 71 e9 d3 Data Ascii: gyg{#!0#&.i(qXx<RLbv=I/w jrCp4\@Y[qPCuI8N:w~Jm>xDg]x$NZyt9*>UX^5iKl~3]Cesw++Q(z7{Osq$MJX\|Y`<nWI5F[?rQ\(5+9\q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49808	142.250.181.132	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:26:28 UTC	820	OUT	GET /recaptcha/api2/payload?p=06AFcWeA4YFRzCJeJ7iEASfaybY4kTmVYn01WAd41JO-iACJK_XSTVni0zjqDPxkAQ28jYhIba4FYwlGJwjJNdYd1EzyW3hmMaCPN7Z5lm7WAFiixSJTpzx2XM4re58oquNlyltuelM1o_8cFtN4W5qrpanFT0BMotJc6UCxEFoUmctwPZXIJUDDhuoDN-9YZELODO6se-duYB&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJNbFneg6JGPcvj59RepRC3nXXgdtwUkMy1vV5rGExz7mRxQ-MS4960akaoW7T5ysaYvOalq0S-4rgfYAjCvDTQ
2024-12-18 18:26:29 UTC	681	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Wed, 18 Dec 2024 18:26:29 GMT Date: Wed, 18 Dec 2024 18:26:29 GMT Cache-Control: private, max-age=30 Cross-Origin-Resource-Policy: same-site Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-18 18:26:29 UTC	709	IN	Data Raw: 36 63 36 30 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 6c60JFIFC!"$"$C,,"}!1AQa"q
2024-12-18 18:26:29 UTC	1390	IN	Data Raw: 7b e3 8a ea 24 52 c7 03 8a 60 85 59 58 32 86 1d 39 ad 23 55 a2 25 4d 3d 8e 75 65 43 b8 d0 65 5c 8c 9e f4 cb a8 71 2b ed 50 a3 3f 77 3d 2a b1 46 ef 5b de e6 3c a5 cf 31 4b 67 3d 85 1b 86 07 22 a8 ed 60 72 09 a0 17 1d e8 b8 b9 4b c7 04 fe 06 b4 74 0f f5 f3 7f bb fe 15 83 e7 38 e7 19 c5 6c f8 5e 4d f3 4f 91 d1 45 26 38 ad 4f a5 3f 64 91 ff 00 23 3f fd ba 7f ed 6a f7 62 2b c2 bf 64 8e be 27 ff 00 b7 4f fd ad 5e f0 45 7b f8 1f e0 47 e7 f9 9e 16 3d fe fe 5f 2f c8 8c d0 05 48 16 9c a9 5d 97 38 c8 f6 d3 76 fb 55 6d 6b 5a d1 74 58 d9 b5 6d 52 d2 cf 6a 6f 2b 2c 80 36 33 8c 85 ea 79 f6 ae 77 55 f8 9b e0 db 1b 24 b9 83 51 3a 8b c8 0e c8 6d 50 b3 7e 39 c6 df c6 b3 95 78 43 e2 76 1a 8c 9e c8 eb 04 59 ed 59 7a ce bd a0 e8 c1 4e ab ab 5a 5a 97 04 a8 79 06 5b 1d 70 07 35 Data Ascii: {$R`YX29#U%M=ueCe\q+P?w=*F[<1Kg="`rKt8l^MOE&8O?d#?jb+d'O^E{G=_/H]8vUmkZtXmRjo+,63ywU$Q:mP~9xCvYYzNZZy[p5
2024-12-18 18:26:29 UTC	1390	IN	Data Raw: 8d 11 cd 33 4d b7 85 ee 2e a7 68 63 69 63 b9 91 15 ca 8d ca 38 c8 06 ae 32 51 17 a0 a4 b5 28 3c 78 24 54 2e 95 a3 22 65 7a 73 55 e4 4a d5 33 36 8a 45 69 8c 95 69 96 a3 22 ad 32 1a 2b 32 53 0a d5 a6 5a 88 8e 7a 53 44 1f 28 4e 93 88 8b 3c 80 af 7c 0f 7a a7 6e 1b ed 00 a6 37 2b 64 1a d4 bd e2 d0 f1 df fa d6 7d 97 37 04 f6 ae 66 7a 2b 63 ae b2 b9 8a ee 00 06 23 9b 1c a1 3c 1f a5 59 11 b0 0a 18 10 45 73 8a 3e 54 c1 c7 20 d6 9d a6 ab 22 62 2b 85 f3 50 74 3f c4 2b 09 d1 ec 6d 1a bd 18 e3 a8 45 1c cd 14 f1 bc 6e 18 00 08 fb c3 d4 54 17 57 51 4d 76 91 ef 50 14 6e c1 38 cd 1a a5 9c 17 72 ad e4 77 72 32 15 2b b0 1e 57 82 6b 9b f2 e5 69 d0 be fd a7 ee 96 1f 78 66 a6 34 d3 29 d4 67 a7 5b 94 11 44 80 fd d4 03 f4 a9 b8 20 9f 4a c1 b2 bd 49 97 7a 33 2a e4 8c 30 c1 18 ad Data Ascii: 3M.hcic82Q(<x$T."ezsUJ36Eii"2+2SZzSD(N<\|zn7+d}7fz+c#<YEs>T "b+Pt?+mEnTWQMvPn8rwr2+Wkixf4)g[D JIz3*0
2024-12-18 18:26:29 UTC	1390	IN	Data Raw: 61 b7 0c 3e f7 7e 07 e9 57 66 89 fc c0 a6 da 56 da 0e e0 f2 67 19 ee 7f cf 5a a3 a5 48 11 26 cb 6c 27 6f 20 0c 8e bd 2a f2 a5 d3 a9 fd e7 95 18 19 27 f8 7d b9 ef c5 09 db 56 79 b8 a5 fb d7 fd 74 14 ce 12 36 b8 97 62 2a 02 15 14 72 79 f7 e6 ab a8 39 02 08 36 99 00 2e fd 42 93 c7 e9 56 e5 b5 2f 01 73 3a b4 84 1d a5 c7 22 90 e9 7a 96 ac 88 2d a4 1e 64 4b 91 ce d5 cf 7e 6a 25 52 31 57 6c cd 42 db 8d b1 b2 0c e5 18 7d a2 5c e4 95 c8 0a bd 3e 9f 53 57 86 9b 71 71 26 eb 3f 20 22 29 32 ed 90 02 17 d4 f3 d3 35 7e de c6 4b 0b 58 e3 be 96 d8 b3 10 65 2a 0b 60 0e 83 27 f4 e3 a9 ac 8f 13 4e 6e 5d 6f 60 89 a3 0a 9b 59 63 e3 7a 93 c8 e9 d7 f0 fe 84 72 3c 54 a7 3b 44 d2 9c 23 29 6b b1 61 f4 69 ed 2d e1 10 ac 45 df 25 94 48 0b e3 23 9e 3b 1e b8 a8 6d 23 b6 d2 20 7b b4 db Data Ascii: a>~WfVgZH&l'o '}Vyt6bry96.BV/s:"z-dK~j%R1WlB}\>SWqq&? ")25~KXe*`'Nn]o`Yczr<T;D#)kai-E%H#;m# {
2024-12-18 18:26:29 UTC	1390	IN	Data Raw: 50 de 8b 6b 48 43 49 2e 7e 69 0e 56 30 06 4e ee be 95 c7 52 70 84 9b 67 06 27 f8 ac ad a7 ca 35 08 56 5f 2d fc b4 25 54 83 85 ce 7a f3 cf 1f d2 ba 16 d4 16 0b 2f 2d 22 74 4c 6c 18 1d 79 fd 6b 26 e1 61 d2 57 6b 46 23 84 33 15 48 ce 49 e7 9a a2 fa e5 b4 51 8b 78 c0 3b 5b 73 2b 8c e7 e9 ea 71 fc eb 9e 51 75 9d d6 c6 3c b7 35 fe de 4b 49 6f 19 76 ca 10 db 9b b7 d3 bf 5e 95 95 73 a8 88 6e bc b5 1e 65 a9 1b 5b 78 21 4f 07 20 90 78 f4 cf 3d fd 46 29 d9 5c 47 3d e8 91 d1 91 4a 9e b9 e8 7e b9 c7 19 c7 d4 56 54 b7 46 57 bd 81 ae 01 11 1c 2a b7 f1 00 71 8f eb c5 6f 0a 2a e7 4e 1e 12 75 39 2d b8 e5 69 2c ae a6 96 03 24 50 2b 11 1f 96 bf 2e 71 9d a4 f4 c1 fc 79 ed 8a 85 ee 27 53 f6 9b 62 23 2c c3 ed 0a 18 85 24 0c e4 f1 d0 f3 9e bf e3 8e f7 12 3c 0d 15 c3 6d 28 48 01 Data Ascii: PkHCI.~iV0NRpg'5V_-%Tz/-"tLlyk&aWkF#3HIQx;[s+qQu<5KIov^sne[x!O x=F)\G=J~VTFWqoNu9-i,$P+.qy'Sb#,$<m(H
2024-12-18 18:26:29 UTC	1390	IN	Data Raw: 7e b5 5d 96 33 0a 09 55 d2 61 90 58 9c 65 7b 7e 34 e2 ac 8e d8 d2 9a 9a ea d1 5f 52 0b 7e 2d ae 12 e0 19 36 95 68 c9 0d b5 46 06 78 eb 9e 78 eb 59 b7 12 39 04 c8 e8 d8 6c 10 48 c8 00 f2 33 cf a0 f5 ab 17 10 fd 94 4b 14 8c 4f 97 3e e0 33 d8 8e a3 03 9e 8b f9 f7 a8 67 81 0d ba c8 13 f7 81 80 66 cf 38 3e dd b9 fe 95 d3 cd 73 49 26 86 89 43 58 ba bc 65 db 86 c6 e2 49 ea 33 fa ff 00 9c 54 d6 d2 b1 12 5b a1 44 0c a7 68 da 0b 67 07 b9 e8 39 3d 0f 5f 5a ab 1b 18 b6 c9 09 28 e0 ee 07 3d 0f 3b 86 3f 15 20 d4 cb 39 92 4f 33 8f 33 0c 5b 8f 97 9e f8 1f d6 9a 42 b9 16 d7 f3 64 b6 55 dc d9 c7 3d 7d 0f 15 6e ca c5 22 b1 91 8c 8a ce 8e 11 e3 c7 38 61 cf 5f 4e 6a 0d fe 64 9e 6c 7b 4b 46 b9 2f 83 8e b8 c8 e3 a7 7e 45 6b 68 9a 62 ea a6 58 85 e0 8e 62 ac e8 87 3c 7d 71 f5 15 Data Ascii: ~]3UaXe{~4_R~-6hFxxY9lH3KO>3gf8>sI&CXeI3T[Dhg9=_Z(=;? 9O33[BdU=}n"8a_Njdl{KF/~EkhbXb<}q
2024-12-18 18:26:29 UTC	1390	IN	Data Raw: 9a 11 e7 ff 00 23 d7 d4 f1 47 b9 99 7c e9 c1 1f ed d3 cc 0f 8f 96 e6 6f cc 7f 85 4f b6 93 57 5f d7 e2 3d 99 f0 5f c6 cf 84 37 7f 0d 6e f4 0d 37 4d d7 0e bc da e3 4f e6 3b da 1b 54 b4 48 7c bc bb 7c cf b9 4f 9b ed d3 be 6b 80 f1 2f 87 ed b4 db 89 a3 8f c4 31 dc 38 04 aa c5 6e 57 f9 35 7d 3f fb 6b c9 71 67 2f 84 a6 5b 86 39 83 50 56 dd 8e 87 ec dc 0c 63 fc 8a f9 31 99 e4 81 a7 40 a4 39 c6 77 72 31 eb f9 56 d4 ec e3 cc fa 98 4e 0a 52 b9 8f 2d a4 85 a6 57 b8 67 23 80 c7 83 fd 78 a9 ad a2 5b 35 03 99 58 ae 09 cf 41 f8 73 9f 7a ba 6d 99 65 de 55 b0 40 cf b5 59 4b 79 64 5d a8 23 24 0e 06 ce a3 26 a9 b2 e3 14 b6 28 47 72 ae 8a ad be 12 1b 70 91 79 6f a6 7b 54 90 da 5d 6a 53 46 d6 76 ee 48 7c 23 90 70 14 7f 13 0f c6 ae 5f 69 5a 9d a7 ef e6 b4 92 00 ca 0c 6c c3 d4 Data Ascii: #G\|oOW_=_7n7MO;TH\|\|Ok/18nW5}?kqg/[9PVc1@9wr1VNR-Wg#x[5XAszmeU@YKyd]#$&(Grpyo{T]jSFvH\|#p_iZl
2024-12-18 18:26:29 UTC	1390	IN	Data Raw: 89 15 81 f9 80 c7 5e f5 d8 7c 40 f1 5d 96 bd e1 bb 5b 0b 49 2f e2 9a ee f6 2b 21 73 70 3e cd 28 20 0d c4 f1 d3 71 52 70 08 cf a7 15 cf 37 88 2e f5 3d 36 c7 c3 fa d4 d7 32 cf 63 72 c2 f1 13 07 ce 45 e0 4c a7 bb 11 bb 3c f5 1e f5 cd 4e 72 b9 b4 a3 a5 d9 e9 be 1b f8 97 7c da 5a 36 b1 e0 ff 00 14 34 ff 00 c2 f6 da 53 95 75 c0 c1 e4 f5 ab 77 3f 14 6c 61 8c bc be 13 f1 72 2a f5 2d a6 e3 ff 00 66 ac 9d 1b c2 9a 7d 95 9a 49 75 e1 d9 75 cb 67 50 d0 de 5a dc 1f 9d 0f 4c c6 58 10 70 79 c6 6b ad 6f 00 f8 4c 80 57 44 83 fe 04 cc 7f ad 6f 39 54 71 d8 ca d0 4f 53 94 9b e2 46 9d ab 5e dd d8 49 a1 cd 6e b6 b6 12 5d 63 53 55 8d dd 80 c6 d5 8c e7 77 de 1d fa 67 8a d6 f8 51 e1 bd 15 3c 27 05 e3 c2 2e e5 bc 02 59 56 61 b9 15 bd 02 1e 06 3d 71 9e 7a e2 bc e3 c6 de 10 b0 79 7c Data Ascii: ^\|@][I/+!sp>( qRp7.=62crEL<Nr\|Z64Suw?lar*-f}IuugPZLXpykoLWDo9TqOSF^In]cSUwgQ<'.YVa=qzy\|
2024-12-18 18:26:29 UTC	1390	IN	Data Raw: ff 00 4e f1 66 ad 71 0c 6f 8d b6 50 9d be 5f 71 ec bf 4c 13 eb 55 fc 2d 00 f1 5f 8f b5 2f 11 5d a8 96 d2 c1 c4 56 aa 4e 40 3c ed 38 f6 c1 3f 56 ae eb 57 bb 3a 6e 9f 77 79 92 76 44 59 07 f7 9b 1f 28 fa e7 03 f1 ae 69 4e db ad 0d b5 f9 9f 3e 6b ba 65 b7 8a be 25 c9 a1 c3 75 3c 3a 45 bc f3 c8 cc 7a 44 b1 02 5c a9 f7 20 0e 3d bd 2b 3a 4b 59 74 8d 6f 4c d5 2d de 5b c8 51 fc cb 79 93 2a d3 c4 0f cf 13 63 a3 01 fe 35 da 59 e9 4f a5 69 ba c7 96 37 de ba c5 a2 40 c3 f8 dd ce f9 db 3e ee ed cf fb 35 b9 26 90 cd ab 49 a2 e9 21 22 3a 65 84 32 c3 28 5c 66 e9 49 2a de fb 86 41 f5 15 cf 1a 8d 5a c6 ee 27 05 e1 df 1f 6a 1a 07 89 27 b9 d3 43 5c e9 c2 37 cc 52 48 44 7e 5b 30 28 e1 7b 6d c8 ce 3d f9 c7 35 ed 3f 0d bc 6d ff 00 09 44 57 10 5d c7 04 37 b0 e1 b6 c6 7e 57 4f 51 Data Ascii: NfqoP_qLU-_/]VN@<8?VW:nwyvDY(iN>ke%u<:EzD\ =+:KYtoL-[Qyc5YOi7@>5&I!":e2(\fIAZ'j'C\7RHD~[0({m=5?mDW]7~WOQ
2024-12-18 18:26:29 UTC	1390	IN	Data Raw: 67 79 67 7b 18 92 ce ee 0b 84 23 21 a2 90 30 23 f0 fa d5 a0 26 cd 2e 69 28 a7 71 58 78 3c 52 83 4c 62 a8 b9 76 0a 3d 49 c5 2f 18 04 1c 83 d0 8a 77 11 20 6a 72 b5 43 9a 70 34 5c 09 d5 aa 40 f5 59 5b be 71 50 43 a9 e9 b3 a6 f8 75 1b 49 17 38 ca 4e a4 7f 3a 77 03 cd 7e 16 f8 92 db 4a b2 6d 3e 78 d5 44 92 97 12 67 1c 90 06 0f e5 5d ee b5 78 24 16 4e aa b2 5a 79 be 74 81 80 39 2a 3e 55 1d b2 58 af e5 5e 35 a6 69 b3 4b a7 dd 15 1f bd b5 93 6c 8b fe 7e 86 b5 fc 33 a9 b2 5d 43 65 73 14 77 2b 2b ec 51 28 dc 06 7a 0f cf 15 cb 37 7b d8 e8 82 4f 73 a5 d2 e3 df 71 a6 24 f1 e1 ac d2 4d 4a f1 58 7c c6 59 89 60 00 3c e4 6e 7f c8 57 49 e1 14 b5 b9 bb d5 35 88 e4 46 5b 9b 80 91 3f 72 91 a8 51 81 f5 dd 5c cc de 13 d2 f5 fb b9 b5 28 35 2b b4 96 e9 02 39 8e 5c 01 c7 71 e9 d3 Data Ascii: gyg{#!0#&.i(qXx<RLbv=I/w jrCp4\@Y[qPCuI8N:w~Jm>xDg]x$NZyt9*>UX^5iKl~3]Cesw++Q(z7{Osq$MJX\|Y`<nWI5F[?rQ\(5+9\q

Target ID:	0
Start time:	13:25:38
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:25:43
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2384,i,1323912080641651643,15447930956936917658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:25:49
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://courtscali.com/"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://courtscali.com/	HTTP Parser: No favicon
Source: https://courtscali.com/	HTTP Parser: No favicon
Source: https://courtscali.com/	HTTP Parser: No favicon
Source: https://courtscali.com/	HTTP Parser: No favicon
Source: https://courtscali.com/	HTTP Parser: No favicon
Source: https://courtscali.com/	HTTP Parser: No favicon
Source: https://courtscali.com/	HTTP Parser: No favicon
Source: https://courtscali.com/	HTTP Parser: No favicon
Source: https://courtscali.com/	HTTP Parser: No favicon
Source: https://courtscali.com/	HTTP Parser: No favicon

Source: Network traffic	Suricata IDS: 2057273 - Severity 1 - ET PHISHING BULLSreCaptcha Credential Phish Landing Page M1 2024-10-17 : 193.143.1.14:443 -> 192.168.2.5:49714
Source: Network traffic	Suricata IDS: 2057274 - Severity 1 - ET PHISHING Suspected BULLSreCaptcha Credential Phish Landing Page M2 2024-10-17 : 193.143.1.14:443 -> 192.168.2.5:49714

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: courtscali.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://courtscali.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7&co=aHR0cHM6Ly9jb3VydHNjYWxpLmNvbTo0NDM.&hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&theme=light&size=normal&cb=e6205o3v2ehn HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://courtscali.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7&co=aHR0cHM6Ly9jb3VydHNjYWxpLmNvbTo0NDM.&hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&theme=light&size=normal&cb=e6205o3v2ehnAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/Xe7AbhhPfZcEikoNmhghBXAEhOusDIBKWKS_roS4Q7E.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7&co=aHR0cHM6Ly9jb3VydHNjYWxpLmNvbTo0NDM.&hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&theme=light&size=normal&cb=e6205o3v2ehnAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: courtscali.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://courtscali.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=284047251f4bef2673c2989d79659c5e
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/Xe7AbhhPfZcEikoNmhghBXAEhOusDIBKWKS_roS4Q7E.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://courtscali.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AJNbFneg6JGPcvj59RepRC3nXXgdtwUkMy1vV5rGExz7mRxQ-MS4960akaoW7T5ysaYvOalq0S-4rgfYAjCvDTQ
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA4YFRzCJeJ7iEASfaybY4kTmVYn01WAd41JO-iACJK_XSTVni0zjqDPxkAQ28jYhIba4FYwlGJwjJNdYd1EzyW3hmMaCPN7Z5lm7WAFiixSJTpzx2XM4re58oquNlyltuelM1o_8cFtN4W5qrpanFT0BMotJc6UCxEFoUmctwPZXIJUDDhuoDN-9YZELODO6se-duYB&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AJNbFneg6JGPcvj59RepRC3nXXgdtwUkMy1vV5rGExz7mRxQ-MS4960akaoW7T5ysaYvOalq0S-4rgfYAjCvDTQ
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA4YFRzCJeJ7iEASfaybY4kTmVYn01WAd41JO-iACJK_XSTVni0zjqDPxkAQ28jYhIba4FYwlGJwjJNdYd1EzyW3hmMaCPN7Z5lm7WAFiixSJTpzx2XM4re58oquNlyltuelM1o_8cFtN4W5qrpanFT0BMotJc6UCxEFoUmctwPZXIJUDDhuoDN-9YZELODO6se-duYB&k=6LcFJZ4qAAAAAKknij_jePSdXGfg5oSW0ojo3sq7 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AJNbFneg6JGPcvj59RepRC3nXXgdtwUkMy1vV5rGExz7mRxQ-MS4960akaoW7T5ysaYvOalq0S-4rgfYAjCvDTQ

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: courtscali.com

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://courtscali.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Windows Analysis Report
https://courtscali.com/