Create Interactive Tour

Windows Analysis Report
https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y

Overview

General Information

Sample URL:	https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y
Analysis ID:	1636289
Infos:

Detection

Captcha Phish

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected Captcha Phish

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,12747472879211138210,13391912177036942368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6376 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.10.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.9.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.11.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.3.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.0.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.8.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.2.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.1.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.5.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.6.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.7.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.4.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.12.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
Click to see the 8 entries

HTTP traffic detected: POST /api/online HTTP/1.1Host: cityofmarion.in.gov.marion-police-department.reference-check.topConnection: keep-aliveContent-Length: 4sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0Accept: */*Origin: https://cityofmarion.in.gov.marion-police-department.reference-check.topSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610YAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 12 Mar 2025 14:51:02 GMTServer: Apache/2.4.56 (Debian)Content-Length: 327Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: chromecache_85.1.dr	String found in binary or memory: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?r
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmQiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAo.woff2
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmXiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmYiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmZiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmaiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmbiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVn6iArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVnoiArmlw.wo
Source: chromecache_93.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_93.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6864_574287239

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6864_574287239

Jump to behavior

Source: classification engine

Classification label: mal56.phis.win@24/54@13/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,12747472879211138210,13391912177036942368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,12747472879211138210,13391912177036942368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	12 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-1.svg	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=eacd99f81358d8e5e62e46415dc2a23b	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791104	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/css/styles.min.css	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=4d6e2debbedb5da83c50fefa8024eae6	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791044	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-sound-icon.gif	0%	Avira URL Cloud	safe
https://mrt.response-check.top/mpi.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791081	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/logo.jpg	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-sound-disabled-icon.gif	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/favicon.ico	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/css/bootstrap.min.css	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=4d6e2debbedb5da83c50fefa8024eae6	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-reload-disabled-icon.gif	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/api/online	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-3.svg	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/doc.jpg	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-2.svg	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=eacd99f81358d8e5e62e46415dc2a23b	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/api/counter	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?r	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-reload-icon.gif	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
atechelectricalengr.com	102.212.247.74	true	false	unknown
remote.captcha.com	188.40.246.96	true	false	high
www.google.com	142.250.186.36	true	false	high
response-check.top	94.159.113.79	true	false	unknown
reference-check.top	94.159.113.79	true	true	unknown
cityofmarion.in.gov.marion-police-department.reference-check.top	unknown	unknown	false	high
mrt.response-check.top	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/css/styles.min.css	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-1.svg	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=eacd99f81358d8e5e62e46415dc2a23b	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791044	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	false	Avira URL Cloud: safe	unknown
https://mrt.response-check.top/mpi.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-sound-icon.gif	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791104	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=4d6e2debbedb5da83c50fefa8024eae6	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791081	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/logo.jpg	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-sound-disabled-icon.gif	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-reload-disabled-icon.gif	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/css/bootstrap.min.css	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-3.svg	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/api/online	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/favicon.ico	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=4d6e2debbedb5da83c50fefa8024eae6	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/doc.jpg	false	Avira URL Cloud: safe	unknown
https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	false		unknown
https://remote.captcha.com/include.js?i=DSdFLpCLdukM1CE-jgQNC9zKESlcuxRZL05PWRsxoiIEK5O6IDlOSonnabb6CIaPI0SQU2TD3hRFtbVG0F2e0LkY-4b0bUxJsHpBJNEYq8p7PiQwDijt4l1tF9-x032A8Cszdz0JwcaLphSFsKwwbmn2sHLgZzCnJfC4m34lBHVT_dlOGsYT6e4rF07wNLO57f30Wmcau9ZG-rT_WrkKx772e-_P1cJFAZ_6UDQBdcmSzzFx98VlF_jM2-A	false		high
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-reload-icon.gif	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=eacd99f81358d8e5e62e46415dc2a23b	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	true		unknown
https://remote.captcha.com/include.js?i=DqEWLv6YsLoOBmE6c41vL5-nFjAXSPcD5Xh5NLbpFqjsbIrlcMpvOOXoMdVvxdkNcqqjoEEVn_G6tXRuiwTrtq3K83a8h71H9NtjBXW7gZsQ-4H2wDJknuiOY3Aeo7SM_iLT9mxzhEhGIoXdzX9hwfAjW1Fw-gtG1jhoVbMrsELKXn6VyMZXqKc-QAhnV9AW2XYJ_Am-tH01uBWSXDYmgkfI12rYsj7reGAHBbaghMZW0BEAALZRJG0Zwho	false		high
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-2.svg	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/api/counter	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/twbs/bootstrap/blob/main/LICENSE)	chromecache_93.1.dr	false		high
https://getbootstrap.com/)	chromecache_93.1.dr	false		high
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?r	chromecache_85.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
188.40.246.96	remote.captcha.com	Germany	24940	HETZNER-ASDE	false
102.212.247.74	atechelectricalengr.com	unknown	36926	CKL1-ASNKE	false
94.159.113.79	response-check.top	Russian Federation	49531	NETCOM-R-ASRU	true

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636289
Start date and time:	2025-03-12 15:49:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@24/54@13/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 172.217.18.14, 142.250.185.238, 173.194.76.84, 142.250.186.142, 142.250.184.238, 216.58.206.42, 216.58.206.67, 216.58.206.78, 142.250.185.78, 142.250.186.174, 142.250.186.42, 142.250.184.234, 216.58.212.170, 142.250.185.170, 142.250.186.138, 142.250.186.170, 142.250.186.74, 142.250.186.106, 216.58.206.74, 142.250.185.138, 142.250.185.202, 142.250.185.234, 142.250.74.202, 142.250.184.202, 142.250.181.234, 142.250.184.206, 142.250.186.99, 142.250.181.238, 142.250.185.142, 142.250.185.99, 142.250.186.110, 142.250.185.206, 4.245.163.56, 23.60.203.209, 40.126.31.128, 2.19.96.66
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, login.live.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	453
Entropy (8bit):	5.4631838475597725
Encrypted:	false
SSDEEP:	6:TMVBdojsMbdgXRxVnzVEnVWBrmaKmc4slZKYnic4sf35Ht/sUgqOeMVERINxIiHv:TMHdwsMi/nzVPK/KYf3Zt/spNl4iHv
MD5:	9BDF81A2C57C62EBC808E3051636FD80
SHA1:	6760FDAECFA139212FED4D6C51A731608818A828
SHA-256:	FC0E3CE72A4D2D7243A6241ADB725C9FB75F6EEF167B4DE8330DD5D64F8F50A4
SHA-512:	10BC5452B20A5C7333FA714EC53428788807AD691416F668D2A3B7E902B3C9DE3C01AF6A4A758A89BB5E2F6F2B6F6D2E3C69197C564F3085146A8B3327573715
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="...._1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... width="13.1px" height="66px" viewBox="0 0 13.1 66" style="enable-background:new 0 0 13.1 66;" xml:space="preserve">..<path d="M5,0v66H0V0H5z"/>..<path d="M13,26v40H8V26H13z"/>..</svg>..

Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	Joe Sandbox AI: Score: 7 Reasons: The URL 'cityofmarion.in.gov.marion-police-department.reference-check.top' contains multiple subdomains and an unusual domain extension '.top', which is often used in phishing., The legitimate domain for the City of Marion, Indiana, is likely 'cityofmarion.in.gov'. The additional segments 'marion-police-department' and 'reference-check' are suspicious and not typical for a government site., The brand 'Marion Police' is not widely recognized outside its local context, making it difficult to classify as 'known' or 'wellknown'., The presence of 'reference-check' in the URL suggests a potential phishing attempt to gather personal information under the guise of a police department check., The domain structure suggests an attempt to mimic a legitimate government site while redirecting to a potentially malicious domain. DOM: 0.1.pages.csv
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	Joe Sandbox AI: Score: 7 Reasons: The URL 'cityofmarion.in.gov.marion-police-department.reference-check.top' contains multiple subdomains and an unusual domain extension '.top', which is often used in phishing., The legitimate domain for the City of Marion, Indiana, is likely 'cityofmarion.in.gov'., The presence of 'marion-police-department' and 'reference-check' as subdomains is suspicious and suggests an attempt to mimic a legitimate site., The brand 'Marion Police' is not widely recognized outside its local context, making it 'unknown' in terms of global brand recognition., The use of a '.top' domain extension is uncommon for government-related websites, which typically use '.gov'. DOM: 0.2.pages.csv
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	Joe Sandbox AI: Score: 9 Reasons: The URL 'cityofmarion.in.gov.marion-police-department.reference-check.top' contains multiple subdomains and an unusual domain extension '.top', which is not typical for government websites., The legitimate domain for the City of Marion, Indiana, is likely 'cityofmarion.in.gov'., The presence of 'marion-police-department' as a subdomain and 'reference-check' in the URL is suspicious and suggests a phishing attempt., The '.top' domain extension is often used in phishing sites due to its low cost and less strict registration requirements., The brand 'Marion Police' is associated with a known entity, the Marion Police Department, which would typically use a '.gov' domain. DOM: 0.5.pages.csv

Source: Yara match	File source: 0.10.pages.csv, type: HTML
Source: Yara match	File source: 0.9.pages.csv, type: HTML
Source: Yara match	File source: 0.11.pages.csv, type: HTML
Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.8.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.5.pages.csv, type: HTML
Source: Yara match	File source: 0.6.pages.csv, type: HTML
Source: Yara match	File source: 0.7.pages.csv, type: HTML
Source: Yara match	File source: 0.4.pages.csv, type: HTML
Source: Yara match	File source: 0.12.pages.csv, type: HTML

Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.131
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: atechelectricalengr.com
Source: global traffic	DNS traffic detected: DNS query: mrt.response-check.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cityofmarion.in.gov.marion-police-department.reference-check.top
Source: global traffic	DNS traffic detected: DNS query: remote.captcha.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 12, 2025 15:50:31.612148046 CET	53	57948	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:31.632983923 CET	53	55626	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:32.266432047 CET	50425	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:32.266895056 CET	58210	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:32.620110989 CET	53	58210	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:32.622903109 CET	53	50425	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:34.917239904 CET	58919	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:34.917387962 CET	55003	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:34.926700115 CET	53	62496	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:35.525645018 CET	53	55003	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:35.794363022 CET	53	58919	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:36.390470028 CET	50651	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:36.390654087 CET	51721	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:36.397114038 CET	53	50651	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:36.397396088 CET	53	51721	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:39.522275925 CET	58294	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:39.522633076 CET	56030	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:39.905333042 CET	53	56030	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:40.534549952 CET	64051	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:40.846954107 CET	53	58294	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:41.710124016 CET	53	64051	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:47.850233078 CET	53	57877	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:51.360666990 CET	58612	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:51.360817909 CET	57696	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:51.899298906 CET	53	51636	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:52.042154074 CET	53	57696	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:52.239131927 CET	53	58612	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:55.845613003 CET	64182	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:55.846060991 CET	60496	53	192.168.2.16	1.1.1.1
Mar 12, 2025 15:50:55.852973938 CET	53	64182	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:55.853764057 CET	53	60496	1.1.1.1	192.168.2.16
Mar 12, 2025 15:50:55.885011911 CET	53	57404	1.1.1.1	192.168.2.16
Mar 12, 2025 15:51:10.978631973 CET	53	51646	1.1.1.1	192.168.2.16
Mar 12, 2025 15:51:16.207938910 CET	53	56421	1.1.1.1	192.168.2.16
Mar 12, 2025 15:51:31.551702976 CET	53	60884	1.1.1.1	192.168.2.16
Mar 12, 2025 15:51:33.940249920 CET	53	62858	1.1.1.1	192.168.2.16
Mar 12, 2025 15:51:37.071099997 CET	53	56242	1.1.1.1	192.168.2.16
Mar 12, 2025 15:51:43.375744104 CET	138	138	192.168.2.16	192.168.2.255
Mar 12, 2025 15:52:03.829015970 CET	53	60091	1.1.1.1	192.168.2.16

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:34 UTC	778	OUT	GET /mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y HTTP/1.1 Host: atechelectricalengr.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 14:50:34 UTC	541	IN	HTTP/1.1 302 Found Connection: close cache-control: no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache expires: 0 location: https://mrt.response-check.top/mpi.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y content-type: text/html; charset=UTF-8 content-length: 0 date: Wed, 12 Mar 2025 14:50:34 GMT alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:38 UTC	762	OUT	GET /mpi.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y HTTP/1.1 Host: mrt.response-check.top Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 14:50:39 UTC	191	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:38 GMT Server: Apache/2.4.56 (Debian) Vary: Accept-Encoding Content-Length: 289 Connection: close Content-Type: text/html; charset=UTF-8
2025-03-12 14:50:39 UTC	289	IN	Data Raw: 3c 64 69 76 3e 0a 20 20 20 20 3c 68 31 3e 3c 2f 68 31 3e 0a 20 20 20 20 3c 70 3e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 0a 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 69 74 79 6f 66 6d 61 72 69 6f 6e 2e 69 6e 2e 67 6f 76 2e 6d 61 72 69 6f 6e 2d 70 6f 6c 69 63 65 2d 64 65 70 61 72 74 6d 65 6e 74 2e 72 65 66 65 72 65 6e 63 65 2d 63 68 65 63 6b 2e 74 6f 70 2f 6f 6e 6c 69 6e 65 2d 64 6f 77 6e 6c 6f 61 64 2f 69 6e 64 65 78 2e 70 68 70 3f 72 69 6d 3d 74 6c 63 7a 73 35 71 64 63 26 78 79 72 3d 74 6f 75 7a 26 6b 74 69 3d 6a 6a 34 6a 64 33 6a 6d 7a 7a 6e 61 37 26 6d 73 6f 3d 35 35 39 68 62 38 30 30 74 77 34 6a 6c 6a 6a Data Ascii: <div> <h1></h1> <p></p></div><script type='text/javascript'> window.location.href='https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:43 UTC	850	OUT	GET /online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://mrt.response-check.top/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 14:50:43 UTC	362	IN	HTTP/1.1 302 Found Date: Wed, 12 Mar 2025 14:50:43 GMT Server: Apache/2.4.56 (Debian) Location: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Content-Length: 505 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-03-12 14:50:43 UTC	505	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 69 74 79 6f 66 6d 61 72 69 6f 6e 2e 69 6e 2e 67 6f 76 2e 6d 61 72 69 6f 6e 2d 70 6f 6c 69 63 65 2d 64 65 70 61 72 74 6d 65 6e 74 2e 72 65 66 65 72 65 6e 63 65 2d 63 68 65 63 6b 2e 74 6f 70 2f 6f 6e 6c 69 6e 65 2d 64 6f 77 6e 6c 6f 61 64 2f 69 6e 64 65 78 2e 70 68 70 3f 72 69 6d Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:43 UTC	843	OUT	GET /online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://mrt.response-check.top/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 14:50:44 UTC	360	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:44 GMT Server: Apache/2.4.56 (Debian) Set-Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Content-Length: 7913 Connection: close Content-Type: text/html; charset=UTF-8
2025-03-12 14:50:44 UTC	7832	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 72 69 6f 6e 20 50 44 20 44 6f 77 6e 6c 6f 61 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 63 73 73 2f Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Marion PD Download</title> <link href="css/bootstrap.min.css" rel="stylesheet"> <link href="css/
2025-03-12 14:50:44 UTC	81	IN	Data Raw: 64 6f 77 6e 54 69 6d 65 72 28 29 3b 0a 20 20 20 20 20 20 20 20 73 65 74 49 6e 74 65 72 76 61 6c 28 63 6f 75 6e 74 64 6f 77 6e 54 69 6d 65 72 2c 20 31 30 30 30 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: downTimer(); setInterval(countdownTimer, 1000);</script></body></html>

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=0], baseline, precision 8, 1081x1449, components 3
Category:	dropped
Size (bytes):	69113
Entropy (8bit):	7.570085661026048
Encrypted:	false
SSDEEP:	1536:JLCDY7ATCN6LQs90/uptTDDw1CZOPRqT38mVyKJDYnwFfflf:1Z72/ju+tUAOZqT38+lYnw7
MD5:	CEA688E482A69EB2B3EF419F8909A071
SHA1:	49DEB40970F439B5BBCAC06487615C73C89C0F95
SHA-256:	87E94491D81E8575B9D307C71F3DF3BA9F8FD1F0BCD70ECF917B179A7D2C477E
SHA-512:	4CD737245E5E589DACB3C42B7A5020601C36E28BDECAF776633B1987FB6F2248A5D24FF6FD1DB736FB97E9D3C24EA1F862DDE3F6CB06996092966DF2D0881FF4
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`......Exif..MM.*.............>http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>..<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 ">...<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">....<rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:3E8A917AC5F811EC800486838A1A1664" xmpMM:InstanceID="xmp.iid:3E8A9179C5F811EC800486838A1A1664" xmp:CreatorTool="Adobe Photoshop CC 2019 Windows">.....<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2C432877A9B811EC8774A7A407060043" stRef:documentID="xmp.did:2C432878A9B811EC8774A7A407060043"/>....</rdf:Description>...</rdf:RDF>..</x:xmpmeta>..<?xpacket end='w'?>...C....................................................................C...................................................

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:46 UTC	818	OUT	GET /online-download/css/bootstrap.min.css HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm
2025-03-12 14:50:47 UTC	275	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:47 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Wed, 15 Sep 2021 06:46:46 GMT ETag: "27bcc-5cc030fd2e180" Accept-Ranges: bytes Content-Length: 162764 Vary: Accept-Encoding Connection: close Content-Type: text/css
2025-03-12 14:50:47 UTC	7917	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 35 2e 31 2e 31 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 31 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 31 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 69 6e 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 3a 72 6f 6f 74 7b 2d 2d 62 73 2d 62 6c 75 65 3a 23 30 64 36 65 66 64 3b 2d Data Ascii: @charset "UTF-8";/! Bootstrap v5.1.1 (https://getbootstrap.com/) * Copyright 2011-2021 The Bootstrap Authors * Copyright 2011-2021 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE) */:root{--bs-blue:#0d6efd;-
2025-03-12 14:50:47 UTC	8000	IN	Data Raw: 7b 6d 61 78 2d 77 69 64 74 68 3a 37 32 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 39 39 32 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6c 67 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6d 64 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 7b 6d 61 78 2d 77 69 64 74 68 3a 39 36 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6c 67 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6d 64 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 78 6c 7b 6d 61 78 2d 77 69 64 74 68 3a 31 31 34 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 34 30 30 70 78 29 7b 2e 63 6f 6e 74 Data Ascii: {max-width:720px}}@media (min-width:992px){.container,.container-lg,.container-md,.container-sm{max-width:960px}}@media (min-width:1200px){.container,.container-lg,.container-md,.container-sm,.container-xl{max-width:1140px}}@media (min-width:1400px){.cont
2025-03-12 14:50:47 UTC	8000	IN	Data Raw: 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 35 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 34 31 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 36 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 35 30 25 7d 2e 63 6f 6c 2d 78 6c 2d 37 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 38 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 36 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 39 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 37 35 25 7d 2e 63 6f 6c 2d 78 6c 2d 31 30 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 38 33 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f Data Ascii: .33333333%}.col-xl-5{flex:0 0 auto;width:41.66666667%}.col-xl-6{flex:0 0 auto;width:50%}.col-xl-7{flex:0 0 auto;width:58.33333333%}.col-xl-8{flex:0 0 auto;width:66.66666667%}.col-xl-9{flex:0 0 auto;width:75%}.col-xl-10{flex:0 0 auto;width:83.33333333%}.co
2025-03-12 14:50:47 UTC	8000	IN	Data Raw: 6f 6c 3a 64 69 73 61 62 6c 65 64 2c 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 5b 72 65 61 64 6f 6e 6c 79 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 39 65 63 65 66 3b 6f 70 61 63 69 74 79 3a 31 7d 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 3a 3a 66 69 6c 65 2d 73 65 6c 65 63 74 6f 72 2d 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 3a 2e 33 37 35 72 65 6d 20 2e 37 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 2d 2e 33 37 35 72 65 6d 20 2d 2e 37 35 72 65 6d 3b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 65 6e 64 3a 2e 37 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 2e 37 35 72 65 6d 3b 63 6f 6c 6f 72 3a 23 32 31 32 35 32 39 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 39 65 63 65 66 3b 70 6f 69 6e 74 65 72 2d 65 76 65 Data Ascii: ol:disabled,.form-control[readonly]{background-color:#e9ecef;opacity:1}.form-control::file-selector-button{padding:.375rem .75rem;margin:-.375rem -.75rem;-webkit-margin-end:.75rem;margin-inline-end:.75rem;color:#212529;background-color:#e9ecef;pointer-eve
2025-03-12 14:50:47 UTC	8000	IN	Data Raw: 65 72 2d 74 68 75 6d 62 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 36 64 34 66 65 7d 2e 66 6f 72 6d 2d 72 61 6e 67 65 3a 3a 2d 77 65 62 6b 69 74 2d 73 6c 69 64 65 72 2d 72 75 6e 6e 61 62 6c 65 2d 74 72 61 63 6b 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 2e 35 72 65 6d 3b 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 65 65 32 65 36 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 72 65 6d 7d 2e 66 6f 72 6d 2d 72 61 6e 67 65 3a 3a 2d 6d 6f 7a 2d 72 61 6e 67 65 2d 74 68 75 6d 62 7b 77 69 64 74 68 3a 31 72 65 6d 3b 68 65 69 67 Data Ascii: er-thumb:active{background-color:#b6d4fe}.form-range::-webkit-slider-runnable-track{width:100%;height:.5rem;color:transparent;cursor:pointer;background-color:#dee2e6;border-color:transparent;border-radius:1rem}.form-range::-moz-range-thumb{width:1rem;heig
2025-03-12 14:50:48 UTC	8000	IN	Data Raw: 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 20 76 69 65 77 42 6f 78 3d 27 30 20 30 20 31 32 20 31 32 27 20 77 69 64 74 68 3d 27 31 32 27 20 68 65 69 67 68 74 3d 27 31 32 27 20 66 69 6c 6c 3d 27 6e 6f 6e 65 27 20 73 74 72 6f 6b 65 3d 27 25 32 33 64 63 33 35 34 35 27 25 33 65 25 33 63 63 69 72 63 6c 65 20 63 78 3d 27 36 27 20 63 79 3d 27 36 27 20 72 3d 27 34 2e 35 27 2f 25 33 65 25 33 63 70 61 74 68 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 27 72 6f 75 6e 64 27 20 64 3d 27 4d 35 2e 38 20 33 2e 36 68 2e 34 4c 36 20 36 2e 35 7a 27 2f 25 33 65 25 33 63 63 69 72 63 6c 65 20 63 78 3d 27 36 27 20 63 79 3d 27 38 2e 32 27 20 72 3d 27 2e 36 27 20 66 69 6c 6c 3d 27 25 32 33 64 63 33 35 34 35 27 20 73 74 72 6f 6b Data Ascii: s='http://www.w3.org/2000/svg' viewBox='0 0 12 12' width='12' height='12' fill='none' stroke='%23dc3545'%3e%3ccircle cx='6' cy='6' r='4.5'/%3e%3cpath stroke-linejoin='round' d='M5.8 3.6h.4L6 6.5z'/%3e%3ccircle cx='6' cy='8.2' r='.6' fill='%23dc3545' strok
2025-03-12 14:50:48 UTC	8000	IN	Data Raw: 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 61 35 32 38 33 34 7d 2e 62 74 6e 2d 63 68 65 63 6b 3a 61 63 74 69 76 65 2b 2e 62 74 6e 2d 64 61 6e 67 65 72 3a 66 6f 63 75 73 2c 2e 62 74 6e 2d 63 68 65 63 6b 3a 63 68 65 63 6b 65 64 2b 2e 62 74 6e 2d 64 61 6e 67 65 72 3a 66 6f 63 75 73 2c 2e 62 74 6e 2d 64 61 6e 67 65 72 2e 61 63 74 69 76 65 3a 66 6f 63 75 73 2c 2e 62 74 6e 2d 64 61 6e 67 65 72 3a 61 63 74 69 76 65 3a 66 6f 63 75 73 2c 2e 73 68 6f 77 3e 2e 62 74 6e 2d 64 61 6e 67 65 72 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 3a 66 6f 63 75 73 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 2e 32 35 72 65 6d 20 72 67 62 61 28 32 32 35 2c 38 33 2c 39 37 2c 2e 35 29 7d 2e 62 74 6e 2d 64 61 6e 67 65 72 2e 64 69 73 61 62 6c 65 64 2c 2e 62 74 6e 2d 64 61 6e Data Ascii: order-color:#a52834}.btn-check:active+.btn-danger:focus,.btn-check:checked+.btn-danger:focus,.btn-danger.active:focus,.btn-danger:active:focus,.show>.btn-danger.dropdown-toggle:focus{box-shadow:0 0 0 .25rem rgba(225,83,97,.5)}.btn-danger.disabled,.btn-dan
2025-03-12 14:50:48 UTC	8000	IN	Data Raw: 6f 77 6e 2d 74 6f 67 67 6c 65 2e 73 68 6f 77 2c 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 72 6b 3a 61 63 74 69 76 65 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 31 32 35 32 39 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 31 32 35 32 39 7d 2e 62 74 6e 2d 63 68 65 63 6b 3a 61 63 74 69 76 65 2b 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 72 6b 3a 66 6f 63 75 73 2c 2e 62 74 6e 2d 63 68 65 63 6b 3a 63 68 65 63 6b 65 64 2b 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 72 6b 3a 66 6f 63 75 73 2c 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 72 6b 2e 61 63 74 69 76 65 3a 66 6f 63 75 73 2c 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 72 6b 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 2e 73 68 6f 77 3a 66 6f Data Ascii: own-toggle.show,.btn-outline-dark:active{color:#fff;background-color:#212529;border-color:#212529}.btn-check:active+.btn-outline-dark:focus,.btn-check:checked+.btn-outline-dark:focus,.btn-outline-dark.active:focus,.btn-outline-dark.dropdown-toggle.show:fo
2025-03-12 14:50:48 UTC	8000	IN	Data Raw: 2e 62 74 6e 2d 67 72 6f 75 70 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 63 68 69 6c 64 29 3e 2e 62 74 6e 2c 2e 62 74 6e 2d 67 72 6f 75 70 2d 76 65 72 74 69 63 61 6c 3e 2e 62 74 6e 7e 2e 62 74 6e 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 30 7d 2e 6e 61 76 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 2e 6e 61 76 2d 6c 69 6e 6b 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 3a 2e 35 72 65 6d 20 31 72 65 6d 3b 63 6f 6c 6f 72 3a 23 30 64 36 65 66 64 3b 74 65 78 Data Ascii: .btn-group:not(:first-child)>.btn,.btn-group-vertical>.btn~.btn{border-top-left-radius:0;border-top-right-radius:0}.nav{display:flex;flex-wrap:wrap;padding-left:0;margin-bottom:0;list-style:none}.nav-link{display:block;padding:.5rem 1rem;color:#0d6efd;tex
2025-03-12 14:50:48 UTC	8000	IN	Data Raw: 6e 64 20 2e 6f 66 66 63 61 6e 76 61 73 2d 68 65 61 64 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 6e 61 76 62 61 72 2d 65 78 70 61 6e 64 20 2e 6f 66 66 63 61 6e 76 61 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 68 65 72 69 74 3b 62 6f 74 74 6f 6d 3a 30 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 3b 66 6c 65 78 2d 67 72 6f 77 3a 31 3b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 30 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 30 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6e 6f 6e 65 3b 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 2e 6e 61 76 62 61 72 2d 65 78 70 61 6e 64 20 2e 6f 66 66 63 61 6e 76 61 73 2d Data Ascii: nd .offcanvas-header{display:none}.navbar-expand .offcanvas{position:inherit;bottom:0;z-index:1000;flex-grow:1;visibility:visible!important;background-color:transparent;border-right:0;border-left:0;transition:none;transform:none}.navbar-expand .offcanvas-

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:46 UTC	815	OUT	GET /online-download/css/styles.min.css HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm
2025-03-12 14:50:47 UTC	273	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:47 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Sun, 12 Jun 2022 15:59:32 GMT ETag: "2a60-5e14241d32100" Accept-Ranges: bytes Content-Length: 10848 Vary: Accept-Encoding Connection: close Content-Type: text/css
2025-03-12 14:50:47 UTC	7919	IN	Data Raw: 40 69 6d 70 6f 72 74 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 77 67 68 74 40 34 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 29 3b 62 6f 64 79 2c 68 74 6d 6c 7b 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 2e 73 69 67 6e 49 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 7d 62 6f 64 79 2e 73 69 67 6e 49 6e 20 2e 73 69 6e 67 49 6e 2d 62 67 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 62 6f 64 79 Data Ascii: @import url(https://fonts.googleapis.com/css2?family=Roboto:wght@400&display=swap);body,html{height:100%}body.signIn{background:#fff}body.signIn .singIn-bg{display:flex;align-items:center;width:100%;height:100%;text-align:center;flex-direction:column}body
2025-03-12 14:50:47 UTC	2929	IN	Data Raw: 31 34 70 78 7d 62 6f 64 79 2e 69 6e 64 65 78 20 2e 77 72 61 70 70 65 72 2d 62 67 2d 69 6e 64 65 78 20 2e 62 67 20 2e 77 72 61 70 70 65 72 2d 62 67 20 2e 77 72 61 70 70 65 72 2d 62 67 2d 72 69 67 68 74 3e 64 69 76 20 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 64 31 32 65 32 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 38 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 39 34 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 62 6f 64 79 2e 69 6e 64 65 78 20 2e 77 72 61 70 70 65 72 2d 62 67 2d 69 6e 64 65 78 20 2e 62 67 20 2e 77 72 61 70 70 65 72 2d 62 67 20 2e 77 72 61 70 70 65 72 2d 62 67 2d 72 69 67 68 74 3e 64 69 76 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 Data Ascii: 14px}body.index .wrapper-bg-index .bg .wrapper-bg .wrapper-bg-right>div span{color:#d12e26;font-size:80px;line-height:94px;padding-right:14px;font-weight:700}body.index .wrapper-bg-index .bg .wrapper-bg .wrapper-bg-right>div p{font-size:24px;line-height:2

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:47 UTC	852	OUT	GET /online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791044 HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm
2025-03-12 14:50:47 UTC	271	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:47 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Mon, 22 Jul 2019 15:47:45 GMT ETag: "e1b-58e46ff432a40" Accept-Ranges: bytes Content-Length: 3611 Vary: Accept-Encoding Connection: close Content-Type: text/css
2025-03-12 14:50:47 UTC	3611	IN	Data Raw: 2e 42 44 43 5f 43 61 70 74 63 68 61 44 69 76 20 7b 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 76 69 73 69 62 6c 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 0a 2e 42 44 43 5f 43 61 70 74 63 68 61 49 6d 61 67 65 44 69 76 20 7b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 2d 6d 6f 7a 2d 69 6e 6c 69 6e 65 2d 73 74 61 63 6b 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 Data Ascii: .BDC_CaptchaDiv { padding: 0 !important; margin: 0 !important; overflow: visible !important;}.BDC_CaptchaImageDiv { margin: 0 !important; padding: 0 !important; display: -moz-inline-stack; display: inline-block !important; vertical-alig

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:47 UTC	778	OUT	GET /api/counter HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm
2025-03-12 14:50:48 UTC	593	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:47 GMT Server: Apache/2.4.56 (Debian) Vary: Accept,Accept-Encoding Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Access-Control-Allow-Origin: * Content-Length: 4280 Content-Type: text/html; charset=UTF-8 Set-Cookie: gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D; expires=Thu, 12-Mar-2026 14:50:47 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=None Connection: close
2025-03-12 14:50:48 UTC	4280	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 28 29 7d 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 62 28 29 3a 61 2e 69 66 76 69 73 69 62 6c 65 3d 62 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 2c 68 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 3b 72 65 74 75 72 6e 20 69 3d 7b 7d 2c 63 3d 64 6f 63 75 6d 65 6e 74 2c 6b 3d 21 31 2c 6c 3d 22 61 63 74 69 76 65 22 2c 67 3d 36 65 34 Data Ascii: (function(){!function(a,b){return"function"==typeof define&&define.amd?define(function(){return b()}):"object"==typeof exports?module.exports=b():a.ifvisible=b()}(this,function(){var a,b,c,d,e,f,g,h,i,j,k,l,m,n;return i={},c=document,k=!1,l="active",g=6e4

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:50 UTC	1025	OUT	GET /online-download/img/logo.jpg HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:51 UTC	254	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:50 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Mon, 10 Mar 2025 12:55:45 GMT ETag: "26631-62ffc7d8e3640" Accept-Ranges: bytes Content-Length: 157233 Connection: close Content-Type: image/jpeg
2025-03-12 14:50:51 UTC	7938	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 04 fa 04 34 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC4"}!1AQa"q2
2025-03-12 14:50:51 UTC	8000	IN	Data Raw: d2 90 09 b4 52 a3 bc 47 31 bb 02 39 dc ad 8a 4e d8 34 b5 a4 2a 4e 9b bc 1d bd 09 71 52 56 68 e8 74 9f 88 1a ce 93 80 b7 2d 2a 0e 89 27 cd 5d a6 8f f1 a1 38 4d 42 dd 87 fb 71 f4 fc ab ca 4f 6a 08 e2 be bf 2f e2 cc d7 2f 69 53 aa da 5d 1e a8 f3 2b 65 b8 7a eb 58 a5 e9 a1 f4 7e 97 e3 2d 2b 56 09 e4 5e 46 49 e8 a7 83 f9 56 e2 c8 ac b9 4e 95 f2 b2 bb 21 05 4b 02 3a 15 e3 f9 57 43 a3 f8 ff 00 59 d1 b0 12 e1 a7 8c 7f 04 9c d7 ea 39 5f 89 54 dd a1 8e a7 6f 35 fe 47 cf d7 c8 64 b5 a5 2b f9 33 e8 90 00 a7 57 97 68 9f 18 ed a7 21 35 18 1a dd ff 00 be bc ad 77 fa 6f 88 2c 35 54 dd 6f 73 1c a3 d1 5b fa 57 ea 99 7e 7f 97 66 71 52 c3 d5 4f cb 67 f7 1f 3b 5b 09 5f 0e ed 38 d8 d2 a2 9b e6 0a 50 c3 b5 7d 1a 6b a1 c6 2d 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 Data Ascii: RG19N4NqRVht-']8MBqOj//iS]+ezX~-+V^FIVN!K:WCY9_To5Gd+3Wh!5wo,5Tos[W~fqROg;[_8P}k-Q@Q@Q@Q@Q
2025-03-12 14:50:51 UTC	8000	IN	Data Raw: 96 17 d5 fe 87 de f0 9f f1 2a 7a 23 ab fd 68 c7 18 a5 e9 4c 0e 1b a1 5f 4f ca bf 95 8f d2 b6 06 03 67 3d 2b f3 63 f6 e4 f0 69 f0 cf c6 b9 ef d1 18 5b 6b 36 f1 dd 86 55 e3 70 ca 38 fa e5 73 f8 8a fd 28 6e 57 8f fc 76 be 4f ff 00 82 82 f8 38 6a 7f 0f f4 3f 10 22 7e f7 4c bb 30 c8 ca bf f2 ce 40 3f f6 65 15 fa b7 86 99 92 cb f3 ea 74 e4 f4 a8 9c 5f cf 55 f8 9f 35 c4 18 7f 6f 81 93 5b c6 cd 7c b7 fc 0f 81 29 a0 fe 54 2d 0b c0 af ed 93 f1 d1 d4 51 45 00 14 df e2 a5 e8 2b 7f e1 f7 87 df c5 7e 39 d0 b4 78 d3 7b de de c5 09 5f f6 4b 0c fe 95 86 22 a4 68 51 95 59 3b 24 9b 7e 89 17 4e 2e 73 50 5b bb 23 f5 07 f6 72 f0 80 f0 4f c1 6f 0a 69 85 31 2f d8 d6 e2 65 db 83 be 43 bd b3 f4 2d 8f c2 bd 37 f4 a8 2c ed 92 d2 ce 0b 74 18 48 a3 11 85 f4 00 00 05 4a d8 db 8f 6f e9 Data Ascii: *z#hL_Og=+ci[k6Up8s(nWvO8j?"~L0@?et_U5o[\|)T-QE+~9x{_K"hQY;$~N.sP[#rOoi1/eC-7,tHJo
2025-03-12 14:50:51 UTC	8000	IN	Data Raw: d2 c7 eb 23 9a f9 53 ef 72 3e ed 7d 25 fb 7c 5d 79 bf 1b d6 20 73 e5 69 d0 0d bf 5c 9f eb 5f 37 28 c0 e9 8a fe f8 e0 b8 2a 7c 3f 84 8a fe 45 f8 ea 7e 21 9c 4b 9b 1f 55 f9 fe 42 1c 01 d2 be d6 ff 00 82 72 dd 0d be 33 b6 3d 73 04 9f 87 cc 3f 98 af 8a b1 f2 e2 be 9a fd 81 3c 54 9a 2f c5 bb cd 22 57 d8 9a bd 8b 47 1a ff 00 7e 44 21 c0 ff 00 be 77 9f c2 b9 f8 f3 0b 2c 5f 0e e2 a1 0d d2 4f e4 ac d9 ae 49 51 53 c7 d3 93 da f6 fb cf d1 30 7b 50 78 c5 22 11 b6 95 ba 57 f0 7a f7 65 73 f6 a3 f2 4f f6 82 d3 4e 91 f1 a7 c6 76 c4 63 1a 94 a4 7f ba 4e 47 e8 6b cf 47 5f 6a fa 7f f6 f4 f8 78 fe 1e f8 9d 07 89 61 8f fd 0b 5a 81 7c c6 55 e1 26 40 10 8f c5 40 3f 9d 7c c3 9a ff 00 41 f8 67 1b 0c c3 27 c3 57 a6 ef 78 ab f9 34 92 68 fc 2b 32 a2 f0 f8 ba 90 7d df dc f6 16 8a 4c Data Ascii: #Sr>}%\|]y si\_7(*\|?E~!KUBr3=s?<T/"WG~D!w,_OIQS0{Px"WzesONvcNGkG_jxaZ\|U&@@?\|Ag'Wx4h+2}L
2025-03-12 14:50:51 UTC	8000	IN	Data Raw: 80 00 00 fd 2a db 74 fa 51 d0 71 e9 4d 73 84 24 fc a0 0e 7e 95 c5 39 ba d5 1c e5 bc 8d a3 15 08 a4 8f 83 7f e0 a1 9e 33 17 de 2f f0 f7 86 21 7c a5 85 b9 bb 99 57 fb f2 1c 00 7e 8a b9 ff 00 81 d7 c8 a0 66 bd 1f f6 88 f1 6f fc 26 df 19 bc 51 a9 ab f9 91 7d ac c3 1b 7f b0 9f 20 c7 b6 05 79 cf 4e 95 fd fb c2 99 7a ca f2 6c 36 1a d6 6a 29 bf 57 ab 3f 0f cd 2b fd 67 17 39 f4 bd 97 a2 d1 0b 45 14 57 d6 1e 50 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 d2 71 fd 2b f4 5b f6 22 f8 c0 fe 3a f0 03 f8 7b 50 9f cd d5 74 4c 46 1d db 96 80 93 b0 fe 1f 77 f2 af ce a2 06 2b d3 7f 67 1f 89 52 fc 2d f8 b1 a3 6a 66 46 4b 09 a4 16 b7 89 d8 c4 fc 12 7e 87 04 7d 2b e0 b8 db 22 8e 7b 93 d4 a4 a3 ef c1 5e 3e ab a7 cc f7 72 6c 6b c1 62 a2 db f7 5e 8f d1 Data Ascii: *tQqMs$~93/!\|W~fo&Q} yNzl6j)W?+g9EWPQEQEQEQEQEQEq+[":{PtLFw+gR-jfFK~}+"{^>rlkb^
2025-03-12 14:50:51 UTC	8000	IN	Data Raw: b7 8d 40 50 a0 00 3a 57 8c bf ed b1 f0 ea db e3 35 ff 00 c3 bb ad 56 de da ea d2 11 ba fa 47 02 0f 3c 1c 34 3b ba 64 0e bf 95 60 fe dd df b4 b1 fd 9f 7e 11 ca 96 12 7f c5 4f ae 6e b4 b0 5e f1 0c 0d f2 9f a0 38 1e e4 57 e2 6d f5 f4 fa 85 e4 f7 77 32 b4 b7 13 48 64 92 46 6c b1 24 92 49 3d 72 6b cd c3 61 7d ba 72 9e 8b a1 d9 5a bf b3 6a 31 3e fe ff 00 82 99 fe d6 1a 57 c4 24 b0 f8 75 e1 4d 41 2f f4 eb 59 45 d6 a5 73 6e d9 49 24 1f 72 30 47 04 0e a7 b6 71 5f 27 fe cb ff 00 0a b5 3f 8b ff 00 1b bc 29 a1 69 b6 ed 20 5b d8 ae ae e4 65 e2 28 23 70 ce 4f e0 30 3d f0 2b cd 34 dd 36 eb 5a d4 2d ec ac e1 7b 9b bb 99 16 28 e3 89 72 ce c7 80 00 f5 cd 7e bf 7e c9 ff 00 02 b4 6f d8 cf e0 76 ab e3 7f 17 bc 71 6b f2 5a 1b dd 4a 46 c6 6d e3 03 29 02 fb 93 80 7d 49 c5 7a 35 Data Ascii: @P:W5VG<4;d`~On^8Wmw2HdFl$I=rka}rZj1>W$uMA/YEsnI$r0Gq_'?)i [e(#pO0=+46Z-{(r~~ovqkZJFm)}Iz5
2025-03-12 14:50:51 UTC	8000	IN	Data Raw: 1f 0a 47 3e a1 e1 79 7f b6 6c 17 93 6f d2 64 1e c3 be 2b f6 2c 17 18 70 ef 15 53 58 7c c6 0a 12 7d 1d b7 f2 67 ca 55 ca b1 f9 64 bd a6 1e 57 4b b7 f9 1f 53 7c 2a fd a9 3c 19 f1 4a 08 22 8a f1 74 ed 4d 80 0d 67 74 c1 4e 7d 8f 42 2b d7 0c 71 dd c5 b1 d1 65 8d 86 0a b2 82 08 3f a6 2b f1 a2 ee c7 51 f0 de a2 f0 dc 45 71 61 77 11 e5 59 4a b0 23 d3 a5 7d 05 f0 5f f6 ce f1 2f 80 3c ab 0d 74 b6 b9 a5 2e 17 73 b7 ef a3 1e c7 be 2b e5 33 ef 0c 5c 62 f1 79 15 4b ad ed 7f c9 9e a6 07 88 53 6a 96 31 59 f7 ff 00 34 7d 1d f1 af f6 33 f0 e7 8f d6 7d 43 42 09 a1 ea ec 0b 6d 8d 71 0b b7 b8 1d 33 ed 5f 07 fc 44 f8 55 e2 3f 85 da ab d8 eb b6 0f 6e 41 21 64 55 ca 38 1c 02 0f 4e 6b f5 33 e1 df c5 8f 0d 7c 52 d2 e2 be d0 b5 08 e7 c8 cb 5b ee 01 d3 d8 8a d0 f1 b7 80 74 3f 88 3a Data Ascii: G>ylod+,pSX\|}gUdWKS\|*<J"tMgtN}B+qe?+QEqawYJ#}_/<t.s+3\byKSj1Y4}3}CBmq3_DU?nA!dU8Nk3\|R[t?:
2025-03-12 14:50:51 UTC	8000	IN	Data Raw: 45 00 27 dd 15 e5 5f 1b 2c 41 b3 d3 6e 80 e5 1d 90 9f a8 04 7e 58 af 55 20 01 5c 67 c5 4d 3f ed 7e 11 b9 6c 7c d0 91 20 fc 08 1f d6 be 47 8a f0 bf 5b c9 b1 14 ed b2 6f ee d4 f4 72 fa 9e cf 13 09 2e f6 fb f4 3c 17 3d 85 2d 35 7a d2 af 4a fe 33 b2 4f 43 f5 04 23 7d de 3d 2b f3 ef fe 0a 0d a0 7d 8f e2 5e 8d aa 84 c2 5e e9 e2 32 de e8 c4 7f 23 5f a0 a7 a7 d2 be 45 ff 00 82 87 78 77 ed 3e 05 f0 de b4 83 26 d2 f8 da b3 7b 3a 12 3f 54 fd 6b f5 1f 0d b1 9f 54 e2 2a 2b a4 d3 5f 7a ba 3e 73 88 29 7b 4c 04 fc ac fe e3 e0 bc 7c d5 f4 17 ec 3b f1 c3 46 f8 01 f1 ce 2f 11 eb e8 ff 00 d9 53 d8 cd a7 cd 24 6b 93 1e f6 46 0d 8f 40 50 03 f5 af 9f ba 71 49 8f 4e 95 fd b7 38 a9 c5 c5 ec cf c7 a3 27 09 29 2e 87 ee 55 c7 ed fd f0 56 db 4c 4b bf f8 4b ad e4 24 02 21 45 3b 87 b6 Data Ascii: E'_,An~XU \gM?~l\| G[or.<=-5zJ3OC#}=+}^^2#_Exw>&{:?TkT*+_z>s){L\|;F/S$kF@PqIN8').UVLKK$!E;
2025-03-12 14:50:51 UTC	8000	IN	Data Raw: 28 1c 0e 6b e9 a9 53 54 e0 a0 b6 47 8b 39 39 c9 b6 2d 14 51 5a 10 7d e7 f1 27 fe 0a 95 ad eb ff 00 0c 6c b4 3f 0d 69 4d a3 eb 92 5a 2c 37 9a 83 38 c2 30 50 a4 c6 07 4c f2 47 a5 71 1f b0 a7 c2 d9 3c 53 e2 9d 4f c7 fa c8 7b 81 6a cd 1d ab cd c9 92 76 c9 77 24 f5 20 1c 7d 4d 7c 95 a5 e9 d3 ea fa 95 a5 8d a4 6d 2d cd c4 8b 14 68 bd 5c 92 00 1f 9d 7e b6 fc 1e f8 7f 6d f0 bb e1 e6 8d e1 f8 02 97 b5 84 19 e4 5f e3 90 e0 b9 fc 4f 4a fc 63 c4 8c e2 39 2e 55 f5 5a 0e d5 2b 69 e6 97 5f bc fb 1e 1f c3 4b 19 89 f6 b5 35 8c 75 f9 f4 3a 9d 5b 54 b6 d1 34 bb 9b fb b9 16 2b 4b 58 9a 69 1d ba 05 03 24 fe 00 57 e4 ef c6 df 89 f7 7f 16 fe 21 ea 7a ed c9 61 0b 49 e5 5a c7 da 38 87 08 07 e1 c9 f7 af b2 7f 6e df 8b 4d e1 6f 05 5b 78 4e c2 5d 97 ba cf 37 0c ad ca 40 08 e3 fe 04 Data Ascii: (kSTG99-QZ}'l?iMZ,780PLGq<SO{jvw$ }M\|m-h\~m_OJc9.UZ+i_K5u:[T4+KXi$W!zaIZ8nMo[xN]7@
2025-03-12 14:50:51 UTC	8000	IN	Data Raw: 31 19 47 4f de 38 0e ff 00 f8 f1 35 dd 6d 15 0d b2 88 e2 08 9d 00 00 7d 3b 54 cb f7 ab f9 7b 30 c4 cb 17 8c ab 88 96 f2 6d bf bc fd 26 8d 35 4e 9c 60 b6 49 2f b9 0b 45 14 57 9e 6c 14 51 45 00 14 51 45 00 14 51 45 00 14 51 45 00 67 78 8f fe 45 fd 47 fe bd 64 ff 00 d0 0d 7e 61 f8 67 fe 46 8d 2f fe bf 62 ff 00 d0 c5 7e 9e 78 8f fe 45 fd 47 fe bd 64 ff 00 d0 0d 7e 61 f8 67 fe 46 8d 2f fe bf 62 ff 00 d0 c5 7f 4a f8 4f fe e5 98 7a 2f c9 9f 03 c4 9f c7 a1 fd 76 3f 41 be 3e 7f c9 16 f1 47 fd 79 7f ec cb 5f 12 fc 1d f8 5e 7e 2b 5e eb 5a 6c 32 f9 17 b0 5a 79 f6 ec df 74 b0 60 30 7d 88 e2 be db f8 f9 ff 00 24 57 c5 3f f5 e5 ff 00 b3 2d 7c d5 fb 13 0c fc 44 d5 c7 fd 43 ff 00 f6 71 51 c1 d8 ea b9 6f 0b 63 f1 74 1d a5 09 b6 be 56 1e 6b 4a 35 f3 1a 14 e6 b4 6a c7 84 6b Data Ascii: 1GO85m};T{0m&5N`I/EWlQEQEQEQEgxEGd~agF/b~xEGd~agF/bJOz/v?A>Gy_^~+^Zl2Zyt`0}$W?-\|DCqQoctVkJ5jk

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:50 UTC	1091	OUT	GET /online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010 HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:51 UTC	314	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:51 GMT Server: Apache/2.4.56 (Debian) Expires: -1 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Close Accept-Ranges: none X-Robots-Tag: noindex, nofollow, noarchive, nosnippet Content-Length: 3948 Content-Type: image/jpeg
2025-03-12 14:50:51 UTC	3948	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3e 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 64 65 66 61 75 6c 74 20 71 75 61 6c 69 74 79 0a ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 28 00 fa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 Data Ascii: JFIF``>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default qualityC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222("

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:53 UTC	1048	OUT	GET /online-download/botdetect/public/bdc-sound-icon.gif HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:53 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:53 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Mon, 22 Jul 2019 15:47:45 GMT ETag: "4a7-58e46ff432a40" Accept-Ranges: bytes Content-Length: 1191 Connection: close Content-Type: image/gif
2025-03-12 14:50:53 UTC	1191	IN	Data Raw: 47 49 46 38 39 61 16 00 16 00 f7 00 00 30 30 30 de de de ff ff ff ea ea ea ef ef ef f5 f5 f5 e7 e7 e7 d0 d0 d0 ee ee ee f0 f0 f0 fe fe fe fd fd fd fb fb fb fc fc fc 6c 6c 6c f9 f9 f9 fe fe fe fa fa fa ef ef ef ef ef ef 88 88 88 f3 f3 f3 f6 f6 f6 fe fe fe c7 c7 c7 53 53 53 fd fd fd f8 f8 f8 fd fd fd f8 f8 f8 45 45 45 f2 f2 f2 f7 f7 f7 f4 f4 f4 f1 f1 f1 f6 f6 f6 6b 6b 6b f3 f3 f3 38 38 38 f4 f4 f4 5b 5b 5b af af af f7 f7 f7 fc fc fc fb fb fb ac ac ac f7 f7 f7 ee ee ee ef ef ef c9 c9 c9 5d 5d 5d 9c 9c 9c d2 d2 d2 76 76 76 bd bd bd 97 97 97 7f 7f 7f 7c 7c 7c bf bf bf db db db 83 83 83 bc bc bc b7 b7 b7 eb eb eb 4d 4d 4d e6 e6 e6 93 93 93 f2 f2 f2 66 66 66 98 98 98 d7 d7 d7 a0 a0 a0 ab ab ab 8a 8a 8a c1 c1 c1 60 60 60 69 69 69 f3 f3 f3 47 47 47 b7 b7 b7 e2 e2 Data Ascii: GIF89a000lllSSSEEEkkk888[[[]]]vvv\|\|\|MMMfff```iiiGGG

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:53 UTC	1027	OUT	GET /online-download/img/pic1-1.svg HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:53 UTC	252	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:53 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Thu, 23 Dec 2021 13:49:00 GMT ETag: "1ca-5d3d080232b00" Accept-Ranges: bytes Content-Length: 458 Connection: close Content-Type: image/svg+xml
2025-03-12 14:50:53 UTC	458	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 21 2d 2d 20 47 65 6e 65 72 61 74 6f 72 3a 20 41 64 6f 62 65 20 49 6c 6c 75 73 74 72 61 74 6f 72 20 32 33 2e 30 2e 36 2c 20 53 56 47 20 45 78 70 6f 72 74 20 50 6c 75 67 2d 49 6e 20 2e 20 53 56 47 20 56 65 72 73 69 6f 6e 3a 20 36 2e 30 30 20 42 75 69 6c 64 20 30 29 20 20 2d 2d 3e 0d 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 d0 a1 d0 bb d0 be d0 b9 5f 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) --><svg version="1.1" id="_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:53 UTC	1027	OUT	GET /online-download/img/pic1-2.svg HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:53 UTC	252	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:53 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Thu, 23 Dec 2021 13:48:52 GMT ETag: "1c5-5d3d07fa91900" Accept-Ranges: bytes Content-Length: 453 Connection: close Content-Type: image/svg+xml
2025-03-12 14:50:53 UTC	453	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 21 2d 2d 20 47 65 6e 65 72 61 74 6f 72 3a 20 41 64 6f 62 65 20 49 6c 6c 75 73 74 72 61 74 6f 72 20 32 33 2e 30 2e 36 2c 20 53 56 47 20 45 78 70 6f 72 74 20 50 6c 75 67 2d 49 6e 20 2e 20 53 56 47 20 56 65 72 73 69 6f 6e 3a 20 36 2e 30 30 20 42 75 69 6c 64 20 30 29 20 20 2d 2d 3e 0d 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 d0 a1 d0 bb d0 be d0 b9 5f 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) --><svg version="1.1" id="_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:53 UTC	1027	OUT	GET /online-download/img/pic1-3.svg HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:53 UTC	252	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:53 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Thu, 23 Dec 2021 13:48:44 GMT ETag: "1c5-5d3d07f2f0700" Accept-Ranges: bytes Content-Length: 453 Connection: close Content-Type: image/svg+xml
2025-03-12 14:50:53 UTC	453	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 21 2d 2d 20 47 65 6e 65 72 61 74 6f 72 3a 20 41 64 6f 62 65 20 49 6c 6c 75 73 74 72 61 74 6f 72 20 32 33 2e 30 2e 36 2c 20 53 56 47 20 45 78 70 6f 72 74 20 50 6c 75 67 2d 49 6e 20 2e 20 53 56 47 20 56 65 72 73 69 6f 6e 3a 20 36 2e 30 30 20 42 75 69 6c 64 20 30 29 20 20 2d 2d 3e 0d 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 d0 a1 d0 bb d0 be d0 b9 5f 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) --><svg version="1.1" id="_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Windows Analysis Report
https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:53 UTC	1024	OUT	GET /online-download/img/doc.jpg HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:54 UTC	253	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:54 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Tue, 11 Mar 2025 13:19:32 GMT ETag: "10df9-63010f073e100" Accept-Ranges: bytes Content-Length: 69113 Connection: close Content-Type: image/jpeg
2025-03-12 14:50:54 UTC	7939	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 00 16 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 00 00 00 00 00 ff e1 03 3e 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 0d 0a 09 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: JFIF``ExifMM*>http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?><x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "><rdf:RDF xm
2025-03-12 14:50:54 UTC	8000	IN	Data Raw: 32 a4 96 a7 b1 fb f5 04 91 55 9d 3e 1a 00 db d2 ff 00 ad 6a c7 59 ba 5c 55 ac 9d 68 02 09 22 a6 47 15 4d 25 11 7d fa 00 b3 67 15 5c 8e 2a 82 cf a5 5c a0 0a f2 f7 a6 a7 5a 91 fa 53 68 01 c9 d2 a4 8e 97 e6 f6 a7 a7 5a 00 d4 d1 fe fd 77 3e 1c fb c9 5c 36 8f f7 eb b9 f0 e7 de 4a 00 ef f4 2f f5 51 fd 6b 7a df ee 56 0e 85 fe aa 3f ad 6f 5b fd ca 00 9b fe 5a 51 e5 d3 a9 7c af a5 00 43 1c 55 64 7f cb 3a 86 3a b5 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 08 ff 00 70 fd 2a 0a 9d fe e1 fa 54 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 Data Ascii: 2U>jY\Uh"GM%}g\\ZShZw>\6J/QkzV?o[ZQ\|CUd::@Q@Q@Q@Q@Q@Q@Q@Q@pTQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE
2025-03-12 14:50:54 UTC	8000	IN	Data Raw: de 8a 00 6b f5 a6 d3 9f ad 36 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 6c 94 ea 8a e3 fa 50 05 6b 8b aa ca bd bf f2 aa ce a1 2d 73 da a5 d3 d0 03 ef 35 9f 2b f8 eb 2a f3 c4 7e 57 f1 d6 6e a9 7e f5 cd ea 9a a3 fe 94 01 d0 de 78 b7 fd ba af 27 8c bf db ae 17 50 d6 5e b2 a4 d6 5f cc a0 0f 4b 8f c6 ff 00 f4 d2 a6 8f c6 5f ed d7 97 47 ac 3d 59 b7 d6 5e 80 3d 3b fe 12 df f6 e8 ff 00 84 b7 fd ba f3 d8 f5 47 a7 7f 6a 3d 00 77 52 78 b7 fd aa a7 79 e2 8f f6 eb 8f fe d3 6f 4a 86 4b f7 a0 0d bd 53 59 f3 6b 9e d4 2f fc da 65 c5 d3 d5 3b 8f eb 40 01 97 cd a7 c1 55 fc 97 ab d6 71 50 04 d6 f1 55 af b2 d3 ad ed 6a e7 d9 68 03 2a e2 d6 a8 5e Data Ascii: k6((((((((((((((lPk-s5+~Wn~x'P^_K_G=Y^=;Gj=wRxyoJKSYk/e;@UqPUjh^
2025-03-12 14:50:54 UTC	8000	IN	Data Raw: 17 9d 2a a4 92 d0 06 bc 77 fc 53 64 ba f3 6b 2a 3b aa b3 1c b4 00 f9 22 f3 29 9f 66 ab 31 c3 e6 d5 9b 7b 5a 00 ca 92 d6 a1 93 f7 46 b7 e4 b0 e6 b3 ef 6c 28 03 36 39 6a cc 72 d3 3e c1 ed fa 55 cb 2b 0a 00 62 45 e6 d5 98 2c 2a e5 96 97 5a b6 7a 5d 00 56 d3 ec 2b 62 0b 0a b3 67 a5 d5 bf b2 d0 06 5d c4 5e 54 75 89 aa 7f 4a e9 35 08 ab 9b d6 3f ad 00 73 7a a7 f4 ac 7b 8f e9 5a b7 ff 00 eb 2b 36 48 68 00 b6 ab d6 7d 2a a5 bc 55 72 de 2a 00 d2 b7 97 14 f9 2e aa 9c 74 49 40 0f 92 ea a1 f3 7e b5 13 f5 a6 d0 04 fe 6f d6 99 24 95 1d 2f 95 f4 a0 07 c5 da ae 5b c5 55 ad e2 cd 69 59 da d0 04 d6 f1 66 ae 47 15 3e de d6 ae 47 69 40 14 24 8a b3 6f 2d 6b a3 92 c3 8a a3 79 61 40 1c dc b6 14 47 a5 56 df f6 5f cf 57 2d f4 ba 00 e6 e4 d2 eb 36 f2 c3 8a ee 6e 34 6f f6 2b 2f 50 Data Ascii: wSdk;")f1{ZFl(69jr>U+bE,Zz]V+bg]^TuJ5?sz{Z+6Hh}Ur*.tI@~o$/[UiYfG>Gi@$o-kya@GV_W-6n4o+/P
2025-03-12 14:50:54 UTC	8000	IN	Data Raw: 46 ae 86 e3 6d 50 92 54 a0 0c 7f ec 6a 7c 7a 5d 5f f3 52 9f 15 d2 50 05 68 f4 aa 9b fb 33 de a6 8e e9 2a 68 ee 92 80 32 ae 34 6a ad 26 83 5d 27 c9 2d 49 f6 58 e8 03 97 8f 41 a9 3f b1 ab a4 fb 2c 74 7d 96 3a 00 e5 24 d1 aa 9c 9a 35 75 57 16 a8 6a 84 91 25 00 62 47 a3 55 98 f4 0a d6 8e 24 ab d6 f1 25 00 60 ff 00 60 7f d3 3a 86 4d 02 ba af 29 3d 6a b5 c6 da 00 e6 bf b0 69 bf d8 d5 b7 71 2a 55 69 2e 92 80 28 47 a5 d5 98 2c 28 fb 72 53 e3 bf 40 28 02 cc 56 14 ff 00 ec bf ad 16 77 e9 57 e3 95 25 a0 0c 7b 8d 1a a9 dc 68 d5 d3 c9 b2 b3 6f 36 50 06 44 76 1e 55 5e d3 e2 f2 aa bc 97 29 14 94 96 fa a7 ef 28 03 ad d1 e5 ae b7 47 ba ce ca f3 dd 2f 54 ae 93 47 d6 68 03 bf b3 ba ab 91 dd 57 31 a7 ea 95 a5 1e a9 fb ba 00 d5 92 ea a1 92 fe b3 6e 35 4a cd bc d6 7c af e3 a0 Data Ascii: FmPTj\|z]_RPh3h24j&]'-IXA?,t}:$5uWj%bGU$%``:M)=jiqUi.(G,(rS@(VwW%{ho6PDvU^)(G/TGhW1n5J\|
2025-03-12 14:50:54 UTC	8000	IN	Data Raw: b6 ff 00 eb 0d 74 3a 27 f8 d0 07 55 61 fe ae ac cf fe ac d5 6b 0f f5 75 35 c4 bf bb a0 0c ad 53 fa d6 06 a3 d6 b6 75 49 6b 12 f2 5c c9 40 15 bc af ad 3e 38 69 b5 62 38 a8 02 6b 6a b0 9d 2a 34 eb 52 f9 bf 5a 00 7c 94 47 2d 43 24 94 df b5 50 06 bd 9c b5 7e de ea b9 eb 7b aa b9 6f 7f 40 1a b3 d6 6d c4 55 67 ed 5e 6d 32 5e f4 01 9b 24 34 bf 37 b5 58 b8 fe 95 4e 49 68 02 4f 9b da a2 7e 94 df 37 de 8f 37 de 80 19 71 fd 6a b4 bd ea 6b 89 6a bb f5 a0 07 45 da a6 8e a9 c7 2d 5c b6 a0 0b 96 d5 72 da a9 db 55 98 e5 a0 0d 5b 79 6a 6f b4 d6 3f da bc aa 6c 97 fc d0 06 8d c5 d5 53 92 5a ad f6 ff 00 7f d6 9b f6 aa 00 bd 1c 95 7e ce ea b0 63 ba ab 96 f7 54 01 d0 c7 2d 56 b8 fe b5 5a de ea ac f9 bf 4a 00 a7 24 54 a9 d6 a5 b8 fe 95 5b cc a0 0b f1 cb 4c b9 aa 71 dd 54 de 6f Data Ascii: t:'Uaku5SuIk\@>8ib8kj*4RZ\|G-C$P~{o@mUg^m2^$47XNIhO~77qjkjE-\rU[yjo?lSZ~cT-VZJ$T[LqTo
2025-03-12 14:50:54 UTC	8000	IN	Data Raw: ad 43 1c 55 72 de 2c d0 05 98 2a e4 72 54 36 f1 54 d4 00 cb 89 6b 36 f2 ea ae 5c 7f 4a cc bc e9 40 14 6e 2e aa 1f b5 53 ee 3f a5 33 c9 a0 0b 96 f2 d6 ae 9f 2d 62 5b 55 fb 39 68 03 aa d2 e5 ae 93 4b 96 b8 8d 3e ff 00 9a e8 b4 fd 56 80 3b 0b 79 6a cc 72 a6 2b 9e b7 d5 3f 77 53 7f 6c 50 06 f7 9a 9e 94 79 a9 e9 5c ff 00 f6 cd 58 b7 d6 68 03 6f e4 f6 a6 49 12 55 38 ef e8 92 fe 80 26 92 24 a8 64 d9 54 ef 35 4f 2a a8 5c 6b d4 01 b7 e6 a7 a5 3b ce 4a e6 ff 00 b7 7f db a9 e3 d7 a8 03 7b e4 f6 a6 79 49 eb 58 ff 00 db 35 27 f6 cd 00 6b 79 29 52 79 49 58 7f db d5 27 f6 ef fb 74 01 bd 1e ca 3e 5a c1 fe dd ff 00 6e a4 fe dd ff 00 6e 80 36 be 5a 64 9b 2b 23 fb 77 fd ba 8f fb 75 3f e7 a7 e9 40 1b 1e 52 54 7e 4a 56 5f f6 ea 7f cf 4f d2 8f ed d4 ff 00 9e 9f a5 00 6b 47 12 Data Ascii: CUr,rT6Tk6\J@n.S?3-b[U9hK>V;yjr+?wSlPy\XhoIU8&$dT5O\k;J{yIX5'ky)RyIX't>Znn6Zd+#wu?@RT~JV_OkG
2025-03-12 14:50:54 UTC	8000	IN	Data Raw: 15 60 de 6b d5 ab ae da bf cf 5c c6 a1 6a fe 65 00 4d ff 00 09 23 7f 7e 9f 1f 88 df fe 7a 56 24 b6 af 44 56 af 40 1d 0c 7e 23 7f ef d3 bf e1 23 ac 28 ed 5e 9f 25 ab d0 06 ac 9e 23 7f ef d3 3f e1 27 7a c5 92 27 a8 7c 97 a0 0e 8e 3f 11 bf f7 ea 5f f8 48 e4 ae 76 38 9e a6 f2 5e 80 37 63 f1 1b d5 cd 3f 5e fd e5 73 11 c4 f5 a1 a7 c4 f4 01 dd e8 fa a7 9b 5d 56 8f 75 e6 d7 07 e1 f8 ab b3 d1 a8 03 a6 b3 e9 56 a3 aa 16 72 d5 c8 e5 a0 09 68 a6 f9 94 79 94 00 ea 29 be 65 33 cd fa d0 04 b4 54 5e 6f d6 99 f6 aa 00 b1 45 57 fb 55 1f 6a a0 0b 14 55 7f b5 53 fc df ad 00 4b 45 45 e6 fd 69 fe 65 00 3a 8a 6f 99 47 99 40 0e a2 9b e6 51 e6 50 03 a8 a6 f9 94 79 94 00 ea 29 be 65 1e 65 00 3a 8a 6f 99 47 99 40 0e a2 9b e6 51 e6 50 03 a8 a6 f9 94 79 94 00 ea 2a 2f 37 eb 47 9b f5 Data Ascii: `k\jeM#~zV$DV@~##(^%#?'z'\|?_Hv8^7c?^s]VuVrhy)e3T^oEWUjUSKEEie:oG@QPy)ee:oG@QPy*/7G
2025-03-12 14:50:54 UTC	5174	IN	Data Raw: 00 db c9 47 f6 ef fb 74 01 d0 7d aa 99 e6 fd 2b 9e ff 00 84 91 3f bd 47 fc 24 89 fd ea 00 e8 7c df a5 27 9c 95 87 fd bc 94 ef ed f4 a0 0d bf 93 da 8f 93 da b1 3f b7 ff 00 e9 a5 37 fb 79 28 03 6b e5 a3 cd 4f 4a c1 93 5e 4f ef d4 3f f0 92 d0 07 49 e6 a7 a5 1e 6a 7a 57 37 fd bf 53 47 af 25 00 6f 7c b4 7c b5 8b fd bb fe dd 47 26 bc 9f df a0 0d ef 35 3d 28 f9 6b 07 fb 79 28 8f 5e 4f ef d0 06 ff 00 cd ed 4b 58 7f db bf ed d3 bf b7 d3 fe 7a 50 06 cf cd ed 47 cd ed 58 df db e9 ff 00 3d 28 8b 59 a0 0d bf 93 da 8f 2b e9 59 b6 fa a7 9b 57 e0 ba f3 68 02 6f b2 d1 f6 5a 72 74 a9 a8 02 1f b2 d2 f9 5f 5a 96 8a 00 8b ca fa d1 e5 7d 6a 5a 28 02 2f 2b eb 47 95 f5 a9 68 a0 08 bc af ad 3f cb a7 51 40 0d f2 e9 9e 57 d6 a5 a2 80 21 fb 2d 37 ec b5 62 8a 00 af f6 5a 7f 95 f5 a9 Data Ascii: Gt}+?G$\|'?7y(kOJ^O?IjzW7SG%o\|\|G&5=(ky(^OKXzPGX=(Y+YWhoZrt_Z}jZ(/+Gh?Q@W!-7bZ

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:54 UTC	738	OUT	GET /online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010 HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:55 UTC	314	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:55 GMT Server: Apache/2.4.56 (Debian) Expires: -1 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Close Accept-Ranges: none X-Robots-Tag: noindex, nofollow, noarchive, nosnippet Content-Length: 3868 Content-Type: image/jpeg
2025-03-12 14:50:55 UTC	3868	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3e 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 64 65 66 61 75 6c 74 20 71 75 61 6c 69 74 79 0a ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 28 00 fa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 Data Ascii: JFIF``>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default qualityC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222("

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:54 UTC	1040	OUT	GET /online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010 HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:55 UTC	368	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:55 GMT Server: Apache/2.4.56 (Debian) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Robots-Tag: noindex, nofollow, noarchive, nosnippet Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked Content-Type: text/javascript;charset=UTF-8
2025-03-12 14:50:55 UTC	7824	IN	Data Raw: 37 34 65 66 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 61 3f 28 6c 5b 30 5d 3d 6c 5b 31 36 5d 3d 6c 5b 31 5d 3d 6c 5b 32 5d 3d 6c 5b 33 5d 3d 6c 5b 34 5d 3d 6c 5b 35 5d 3d 6c 5b 36 5d 3d 6c 5b 37 5d 3d 6c 5b 38 5d 3d 6c 5b 39 5d 3d 6c 5b 31 30 5d 3d 6c 5b 31 31 5d 3d 6c 5b 31 32 5d 3d 6c 5b 31 33 5d 3d 6c 5b 31 34 5d 3d 6c 5b 31 35 5d 3d 30 2c 74 68 69 73 2e 62 6c 6f 63 6b 73 3d 6c 29 3a 74 68 69 73 2e 62 6c 6f 63 6b 73 3d 5b 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 5d 3b 74 68 69 73 2e 68 30 3d 31 37 33 32 35 38 34 31 39 33 3b 74 68 69 73 2e 68 31 3d 34 30 32 33 32 33 33 34 31 37 3b 74 68 69 73 2e 68 32 3d 32 35 36 32 33 38 33 31 30 32 3b 74 68 69 73 2e 68 Data Ascii: 74ef(function(){function a(a){a?(l[0]=l[16]=l[1]=l[2]=l[3]=l[4]=l[5]=l[6]=l[7]=l[8]=l[9]=l[10]=l[11]=l[12]=l[13]=l[14]=l[15]=0,this.blocks=l):this.blocks=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0];this.h0=1732584193;this.h1=4023233417;this.h2=2562383102;this.h
2025-03-12 14:50:55 UTC	16384	IN	Data Raw: 6f 72 6d 3d 6d 3f 22 75 70 70 65 72 63 61 73 65 22 3a 22 6c 6f 77 65 72 63 61 73 65 22 29 7d 2c 42 6f 74 44 65 74 65 63 74 2e 49 6e 69 74 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 6d 2c 64 2c 6e 2c 6c 2c 71 2c 72 2c 70 2c 74 2c 75 2c 66 2c 65 29 7b 76 61 72 20 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 2b 22 5f 43 61 70 74 63 68 61 49 6d 61 67 65 22 29 26 26 28 77 69 6e 64 6f 77 5b 61 5d 3d 6e 65 77 20 42 6f 74 44 65 74 65 63 74 28 61 2c 62 2c 63 2c 6d 2c 64 2c 6e 2c 6c 2c 71 2c 0a 72 2c 70 2c 74 2c 75 2c 66 2c 65 29 2c 77 69 6e 64 6f 77 5b 61 5d 2e 50 6f 73 74 49 6e 69 74 28 29 2c 77 69 6e 64 6f 77 5b 61 5d 2e 49 6e 69 74 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 29 7d 3b Data Ascii: orm=m?"uppercase":"lowercase")},BotDetect.Init=function(a,b,c,m,d,n,l,q,r,p,t,u,f,e){var h=function(){document.getElementById(a+"_CaptchaImage")&&(window[a]=new BotDetect(a,b,c,m,d,n,l,q,r,p,t,u,f,e),window[a].PostInit(),window[a].InitEventListeners())};
2025-03-12 14:50:55 UTC	5733	IN	Data Raw: 64 28 29 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 73 77 69 74 63 68 28 74 68 69 73 2e 49 6d 61 67 65 43 6f 6c 6f 72 4d 6f 64 65 29 7b 63 61 73 65 20 22 63 6f 6c 6f 72 22 3a 74 68 69 73 2e 43 6f 6e 76 65 72 74 49 6d 61 67 65 54 6f 42 61 73 65 36 34 49 6d 61 67 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 61 2e 53 68 6f 77 49 6d 61 67 65 28 29 3b 61 2e 52 65 67 69 73 74 65 72 49 6d 61 67 65 48 6f 76 65 72 48 61 6e 64 6c 65 72 28 29 7d 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 67 72 61 79 73 63 61 6c 65 22 3a 74 68 69 73 2e 43 6f 6e 76 65 72 74 49 6d 61 67 65 54 6f 42 61 73 65 36 34 49 6d 61 67 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 61 2e 43 6f 6e 76 65 72 74 43 6f 6c 6f 72 49 6d 61 67 65 54 6f 47 72 61 79 73 63 61 6c 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 61 2e 53 Data Ascii: d()){var a=this;switch(this.ImageColorMode){case "color":this.ConvertImageToBase64Image(function(){a.ShowImage();a.RegisterImageHoverHandler()});break;case "grayscale":this.ConvertImageToBase64Image(function(){a.ConvertColorImageToGrayscale(function(){a.S
2025-03-12 14:50:55 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-03-12 14:50:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:56 UTC	674	OUT	GET /online-download/img/pic1-1.svg HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:56 UTC	252	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:56 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Thu, 23 Dec 2021 13:49:00 GMT ETag: "1ca-5d3d080232b00" Accept-Ranges: bytes Content-Length: 458 Connection: close Content-Type: image/svg+xml
2025-03-12 14:50:56 UTC	458	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 21 2d 2d 20 47 65 6e 65 72 61 74 6f 72 3a 20 41 64 6f 62 65 20 49 6c 6c 75 73 74 72 61 74 6f 72 20 32 33 2e 30 2e 36 2c 20 53 56 47 20 45 78 70 6f 72 74 20 50 6c 75 67 2d 49 6e 20 2e 20 53 56 47 20 56 65 72 73 69 6f 6e 3a 20 36 2e 30 30 20 42 75 69 6c 64 20 30 29 20 20 2d 2d 3e 0d 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 d0 a1 d0 bb d0 be d0 b9 5f 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) --><svg version="1.1" id="_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:56 UTC	1049	OUT	GET /online-download/botdetect/public/bdc-reload-icon.gif HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:57 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:56 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Mon, 22 Jul 2019 15:47:45 GMT ETag: "492-58e46ff432a40" Accept-Ranges: bytes Content-Length: 1170 Connection: close Content-Type: image/gif
2025-03-12 14:50:57 UTC	1170	IN	Data Raw: 47 49 46 38 39 61 16 00 16 00 f7 00 00 30 30 30 df df df eb eb eb ff ff ff 36 36 36 f6 f6 f6 d1 d1 d1 ef ef ef e7 e7 e7 f1 f1 f1 fb fb fb 53 53 53 fc fc fc ff ff ff f9 f9 f9 ef ef ef fa fa fa fd fd fd fe fe fe f4 f4 f4 fe fe fe f3 f3 f3 44 44 44 fe fe fe fa fa fa f0 f0 f0 4a 4a 4a f0 f0 f0 fd fd fd fd fd fd 51 51 51 fb fb fb f2 f2 f2 f2 f2 f2 fc fc fc f4 f4 f4 f6 f6 f6 f5 f5 f5 4e 4e 4e f8 f8 f8 f8 f8 f8 3e 3e 3e 5d 5d 5d f2 f2 f2 e3 e3 e3 f5 f5 f5 bf bf bf c0 c0 c0 eb eb eb d3 d3 d3 71 71 71 6a 6a 6a e3 e3 e3 5c 5c 5c da da da ff ff ff fc fc fc e7 e7 e7 72 72 72 f8 f8 f8 ef ef ef a2 a2 a2 2f 2f 2f 83 83 83 56 56 56 40 40 40 ce ce ce 63 63 63 52 52 52 ef ef ef 51 51 51 ff ff ff fd fd fd f5 f5 f5 79 79 79 73 73 73 86 86 86 ec ec ec 90 90 90 45 45 45 6a 6a Data Ascii: GIF89a000666SSSDDDJJJQQQNNN>>>]]]qqqjjj\\\rrr///VVV@@@cccRRRQQQyyysssEEEjj

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:57 UTC	671	OUT	GET /online-download/img/doc.jpg HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:58 UTC	253	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:58 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Tue, 11 Mar 2025 13:19:32 GMT ETag: "10df9-63010f073e100" Accept-Ranges: bytes Content-Length: 69113 Connection: close Content-Type: image/jpeg
2025-03-12 14:50:58 UTC	7939	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 00 16 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 00 00 00 00 00 ff e1 03 3e 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 0d 0a 09 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: JFIF``ExifMM*>http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?><x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "><rdf:RDF xm
2025-03-12 14:50:58 UTC	8000	IN	Data Raw: 32 a4 96 a7 b1 fb f5 04 91 55 9d 3e 1a 00 db d2 ff 00 ad 6a c7 59 ba 5c 55 ac 9d 68 02 09 22 a6 47 15 4d 25 11 7d fa 00 b3 67 15 5c 8e 2a 82 cf a5 5c a0 0a f2 f7 a6 a7 5a 91 fa 53 68 01 c9 d2 a4 8e 97 e6 f6 a7 a7 5a 00 d4 d1 fe fd 77 3e 1c fb c9 5c 36 8f f7 eb b9 f0 e7 de 4a 00 ef f4 2f f5 51 fd 6b 7a df ee 56 0e 85 fe aa 3f ad 6f 5b fd ca 00 9b fe 5a 51 e5 d3 a9 7c af a5 00 43 1c 55 64 7f cb 3a 86 3a b5 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 08 ff 00 70 fd 2a 0a 9d fe e1 fa 54 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 Data Ascii: 2U>jY\Uh"GM%}g\\ZShZw>\6J/QkzV?o[ZQ\|CUd::@Q@Q@Q@Q@Q@Q@Q@Q@pTQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE
2025-03-12 14:50:58 UTC	8000	IN	Data Raw: de 8a 00 6b f5 a6 d3 9f ad 36 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 6c 94 ea 8a e3 fa 50 05 6b 8b aa ca bd bf f2 aa ce a1 2d 73 da a5 d3 d0 03 ef 35 9f 2b f8 eb 2a f3 c4 7e 57 f1 d6 6e a9 7e f5 cd ea 9a a3 fe 94 01 d0 de 78 b7 fd ba af 27 8c bf db ae 17 50 d6 5e b2 a4 d6 5f cc a0 0f 4b 8f c6 ff 00 f4 d2 a6 8f c6 5f ed d7 97 47 ac 3d 59 b7 d6 5e 80 3d 3b fe 12 df f6 e8 ff 00 84 b7 fd ba f3 d8 f5 47 a7 7f 6a 3d 00 77 52 78 b7 fd aa a7 79 e2 8f f6 eb 8f fe d3 6f 4a 86 4b f7 a0 0d bd 53 59 f3 6b 9e d4 2f fc da 65 c5 d3 d5 3b 8f eb 40 01 97 cd a7 c1 55 fc 97 ab d6 71 50 04 d6 f1 55 af b2 d3 ad ed 6a e7 d9 68 03 2a e2 d6 a8 5e Data Ascii: k6((((((((((((((lPk-s5+~Wn~x'P^_K_G=Y^=;Gj=wRxyoJKSYk/e;@UqPUjh^
2025-03-12 14:50:58 UTC	8000	IN	Data Raw: 17 9d 2a a4 92 d0 06 bc 77 fc 53 64 ba f3 6b 2a 3b aa b3 1c b4 00 f9 22 f3 29 9f 66 ab 31 c3 e6 d5 9b 7b 5a 00 ca 92 d6 a1 93 f7 46 b7 e4 b0 e6 b3 ef 6c 28 03 36 39 6a cc 72 d3 3e c1 ed fa 55 cb 2b 0a 00 62 45 e6 d5 98 2c 2a e5 96 97 5a b6 7a 5d 00 56 d3 ec 2b 62 0b 0a b3 67 a5 d5 bf b2 d0 06 5d c4 5e 54 75 89 aa 7f 4a e9 35 08 ab 9b d6 3f ad 00 73 7a a7 f4 ac 7b 8f e9 5a b7 ff 00 eb 2b 36 48 68 00 b6 ab d6 7d 2a a5 bc 55 72 de 2a 00 d2 b7 97 14 f9 2e aa 9c 74 49 40 0f 92 ea a1 f3 7e b5 13 f5 a6 d0 04 fe 6f d6 99 24 95 1d 2f 95 f4 a0 07 c5 da ae 5b c5 55 ad e2 cd 69 59 da d0 04 d6 f1 66 ae 47 15 3e de d6 ae 47 69 40 14 24 8a b3 6f 2d 6b a3 92 c3 8a a3 79 61 40 1c dc b6 14 47 a5 56 df f6 5f cf 57 2d f4 ba 00 e6 e4 d2 eb 36 f2 c3 8a ee 6e 34 6f f6 2b 2f 50 Data Ascii: wSdk;")f1{ZFl(69jr>U+bE,Zz]V+bg]^TuJ5?sz{Z+6Hh}Ur*.tI@~o$/[UiYfG>Gi@$o-kya@GV_W-6n4o+/P
2025-03-12 14:50:58 UTC	8000	IN	Data Raw: 46 ae 86 e3 6d 50 92 54 a0 0c 7f ec 6a 7c 7a 5d 5f f3 52 9f 15 d2 50 05 68 f4 aa 9b fb 33 de a6 8e e9 2a 68 ee 92 80 32 ae 34 6a ad 26 83 5d 27 c9 2d 49 f6 58 e8 03 97 8f 41 a9 3f b1 ab a4 fb 2c 74 7d 96 3a 00 e5 24 d1 aa 9c 9a 35 75 57 16 a8 6a 84 91 25 00 62 47 a3 55 98 f4 0a d6 8e 24 ab d6 f1 25 00 60 ff 00 60 7f d3 3a 86 4d 02 ba af 29 3d 6a b5 c6 da 00 e6 bf b0 69 bf d8 d5 b7 71 2a 55 69 2e 92 80 28 47 a5 d5 98 2c 28 fb 72 53 e3 bf 40 28 02 cc 56 14 ff 00 ec bf ad 16 77 e9 57 e3 95 25 a0 0c 7b 8d 1a a9 dc 68 d5 d3 c9 b2 b3 6f 36 50 06 44 76 1e 55 5e d3 e2 f2 aa bc 97 29 14 94 96 fa a7 ef 28 03 ad d1 e5 ae b7 47 ba ce ca f3 dd 2f 54 ae 93 47 d6 68 03 bf b3 ba ab 91 dd 57 31 a7 ea 95 a5 1e a9 fb ba 00 d5 92 ea a1 92 fe b3 6e 35 4a cd bc d6 7c af e3 a0 Data Ascii: FmPTj\|z]_RPh3h24j&]'-IXA?,t}:$5uWj%bGU$%``:M)=jiqUi.(G,(rS@(VwW%{ho6PDvU^)(G/TGhW1n5J\|
2025-03-12 14:50:58 UTC	8000	IN	Data Raw: b6 ff 00 eb 0d 74 3a 27 f8 d0 07 55 61 fe ae ac cf fe ac d5 6b 0f f5 75 35 c4 bf bb a0 0c ad 53 fa d6 06 a3 d6 b6 75 49 6b 12 f2 5c c9 40 15 bc af ad 3e 38 69 b5 62 38 a8 02 6b 6a b0 9d 2a 34 eb 52 f9 bf 5a 00 7c 94 47 2d 43 24 94 df b5 50 06 bd 9c b5 7e de ea b9 eb 7b aa b9 6f 7f 40 1a b3 d6 6d c4 55 67 ed 5e 6d 32 5e f4 01 9b 24 34 bf 37 b5 58 b8 fe 95 4e 49 68 02 4f 9b da a2 7e 94 df 37 de 8f 37 de 80 19 71 fd 6a b4 bd ea 6b 89 6a bb f5 a0 07 45 da a6 8e a9 c7 2d 5c b6 a0 0b 96 d5 72 da a9 db 55 98 e5 a0 0d 5b 79 6a 6f b4 d6 3f da bc aa 6c 97 fc d0 06 8d c5 d5 53 92 5a ad f6 ff 00 7f d6 9b f6 aa 00 bd 1c 95 7e ce ea b0 63 ba ab 96 f7 54 01 d0 c7 2d 56 b8 fe b5 5a de ea ac f9 bf 4a 00 a7 24 54 a9 d6 a5 b8 fe 95 5b cc a0 0b f1 cb 4c b9 aa 71 dd 54 de 6f Data Ascii: t:'Uaku5SuIk\@>8ib8kj*4RZ\|G-C$P~{o@mUg^m2^$47XNIhO~77qjkjE-\rU[yjo?lSZ~cT-VZJ$T[LqTo
2025-03-12 14:50:58 UTC	8000	IN	Data Raw: ad 43 1c 55 72 de 2c d0 05 98 2a e4 72 54 36 f1 54 d4 00 cb 89 6b 36 f2 ea ae 5c 7f 4a cc bc e9 40 14 6e 2e aa 1f b5 53 ee 3f a5 33 c9 a0 0b 96 f2 d6 ae 9f 2d 62 5b 55 fb 39 68 03 aa d2 e5 ae 93 4b 96 b8 8d 3e ff 00 9a e8 b4 fd 56 80 3b 0b 79 6a cc 72 a6 2b 9e b7 d5 3f 77 53 7f 6c 50 06 f7 9a 9e 94 79 a9 e9 5c ff 00 f6 cd 58 b7 d6 68 03 6f e4 f6 a6 49 12 55 38 ef e8 92 fe 80 26 92 24 a8 64 d9 54 ef 35 4f 2a a8 5c 6b d4 01 b7 e6 a7 a5 3b ce 4a e6 ff 00 b7 7f db a9 e3 d7 a8 03 7b e4 f6 a6 79 49 eb 58 ff 00 db 35 27 f6 cd 00 6b 79 29 52 79 49 58 7f db d5 27 f6 ef fb 74 01 bd 1e ca 3e 5a c1 fe dd ff 00 6e a4 fe dd ff 00 6e 80 36 be 5a 64 9b 2b 23 fb 77 fd ba 8f fb 75 3f e7 a7 e9 40 1b 1e 52 54 7e 4a 56 5f f6 ea 7f cf 4f d2 8f ed d4 ff 00 9e 9f a5 00 6b 47 12 Data Ascii: CUr,rT6Tk6\J@n.S?3-b[U9hK>V;yjr+?wSlPy\XhoIU8&$dT5O\k;J{yIX5'ky)RyIX't>Znn6Zd+#wu?@RT~JV_OkG
2025-03-12 14:50:58 UTC	8000	IN	Data Raw: 15 60 de 6b d5 ab ae da bf cf 5c c6 a1 6a fe 65 00 4d ff 00 09 23 7f 7e 9f 1f 88 df fe 7a 56 24 b6 af 44 56 af 40 1d 0c 7e 23 7f ef d3 bf e1 23 ac 28 ed 5e 9f 25 ab d0 06 ac 9e 23 7f ef d3 3f e1 27 7a c5 92 27 a8 7c 97 a0 0e 8e 3f 11 bf f7 ea 5f f8 48 e4 ae 76 38 9e a6 f2 5e 80 37 63 f1 1b d5 cd 3f 5e fd e5 73 11 c4 f5 a1 a7 c4 f4 01 dd e8 fa a7 9b 5d 56 8f 75 e6 d7 07 e1 f8 ab b3 d1 a8 03 a6 b3 e9 56 a3 aa 16 72 d5 c8 e5 a0 09 68 a6 f9 94 79 94 00 ea 29 be 65 33 cd fa d0 04 b4 54 5e 6f d6 99 f6 aa 00 b1 45 57 fb 55 1f 6a a0 0b 14 55 7f b5 53 fc df ad 00 4b 45 45 e6 fd 69 fe 65 00 3a 8a 6f 99 47 99 40 0e a2 9b e6 51 e6 50 03 a8 a6 f9 94 79 94 00 ea 29 be 65 1e 65 00 3a 8a 6f 99 47 99 40 0e a2 9b e6 51 e6 50 03 a8 a6 f9 94 79 94 00 ea 2a 2f 37 eb 47 9b f5 Data Ascii: `k\jeM#~zV$DV@~##(^%#?'z'\|?_Hv8^7c?^s]VuVrhy)e3T^oEWUjUSKEEie:oG@QPy)ee:oG@QPy*/7G
2025-03-12 14:50:58 UTC	5174	IN	Data Raw: 00 db c9 47 f6 ef fb 74 01 d0 7d aa 99 e6 fd 2b 9e ff 00 84 91 3f bd 47 fc 24 89 fd ea 00 e8 7c df a5 27 9c 95 87 fd bc 94 ef ed f4 a0 0d bf 93 da 8f 93 da b1 3f b7 ff 00 e9 a5 37 fb 79 28 03 6b e5 a3 cd 4f 4a c1 93 5e 4f ef d4 3f f0 92 d0 07 49 e6 a7 a5 1e 6a 7a 57 37 fd bf 53 47 af 25 00 6f 7c b4 7c b5 8b fd bb fe dd 47 26 bc 9f df a0 0d ef 35 3d 28 f9 6b 07 fb 79 28 8f 5e 4f ef d0 06 ff 00 cd ed 4b 58 7f db bf ed d3 bf b7 d3 fe 7a 50 06 cf cd ed 47 cd ed 58 df db e9 ff 00 3d 28 8b 59 a0 0d bf 93 da 8f 2b e9 59 b6 fa a7 9b 57 e0 ba f3 68 02 6f b2 d1 f6 5a 72 74 a9 a8 02 1f b2 d2 f9 5f 5a 96 8a 00 8b ca fa d1 e5 7d 6a 5a 28 02 2f 2b eb 47 95 f5 a9 68 a0 08 bc af ad 3f cb a7 51 40 0d f2 e9 9e 57 d6 a5 a2 80 21 fb 2d 37 ec b5 62 8a 00 af f6 5a 7f 95 f5 a9 Data Ascii: Gt}+?G$\|'?7y(kOJ^O?IjzW7SG%o\|\|G&5=(ky(^OKXzPGX=(Y+YWhoZrt_Z}jZ(/+Gh?Q@W!-7bZ

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:58 UTC	871	OUT	GET /include.js?i=DSdFLpCLdukM1CE-jgQNC9zKESlcuxRZL05PWRsxoiIEK5O6IDlOSonnabb6CIaPI0SQU2TD3hRFtbVG0F2e0LkY-4b0bUxJsHpBJNEYq8p7PiQwDijt4l1tF9-x032A8Cszdz0JwcaLphSFsKwwbmn2sHLgZzCnJfC4m34lBHVT_dlOGsYT6e4rF07wNLO57f30Wmcau9ZG-rT_WrkKx772e-_P1cJFAZ_6UDQBdcmSzzFx98VlF_jM2-A HTTP/1.1 Host: remote.captcha.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 14:50:58 UTC	365	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:58 GMT Server: Apache/2.4.38 (Debian) Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 14 Aug 2016 07:44:41 GMT Content-Length: 1046 ETag: "416-53a0349d706b8" Vary: Accept-Encoding X-Robots-Tag: noindex, noarchive, nosnippet, noimageindex, noodp, nofollow Content-Type: application/javascript
2025-03-12 14:50:58 UTC	1046	IN	Data Raw: 2f 2a 0a 0a 47 6f 6f 67 6c 65 20 77 61 73 20 69 6e 64 65 78 69 6e 67 20 74 68 69 73 20 66 69 6c 65 20 77 68 69 6c 65 20 69 74 20 77 61 73 20 65 6d 70 74 79 20 2d 2d 20 70 72 6f 62 61 62 6c 79 20 62 65 63 61 75 73 65 20 69 74 20 63 6f 75 6c 64 6e 27 74 20 66 69 67 75 72 65 20 6f 75 74 20 74 68 61 74 20 61 6e 20 65 6d 70 74 79 20 66 69 6c 65 20 63 61 6e 20 62 65 20 69 6e 74 65 6e 74 69 6f 6e 61 6c 6c 79 20 65 6d 70 74 79 20 4a 61 76 61 53 63 72 69 70 74 20 66 69 6c 65 20 2d 2d 20 64 65 73 70 69 74 65 20 62 65 69 6e 67 20 69 6e 76 6f 6b 65 64 20 61 73 20 73 75 63 68 2e 0a 53 6f 20 4f 4b 2c 20 68 6f 70 65 66 75 6c 6c 79 20 47 6f 6f 67 6c 65 20 77 69 6c 6c 20 62 65 20 73 6d 61 72 74 65 72 20 77 69 74 68 20 74 68 69 73 20 76 65 72 73 69 6f 6e 20 6f 66 20 69 74 Data Ascii: /*Google was indexing this file while it was empty -- probably because it couldn't figure out that an empty file can be intentionally empty JavaScript file -- despite being invoked as such.So OK, hopefully Google will be smarter with this version of it

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:58 UTC	1058	OUT	GET /online-download/botdetect/public/bdc-reload-disabled-icon.gif HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:59 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:58 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Mon, 22 Jul 2019 15:47:45 GMT ETag: "43b-58e46ff432a40" Accept-Ranges: bytes Content-Length: 1083 Connection: close Content-Type: image/gif
2025-03-12 14:50:59 UTC	1083	IN	Data Raw: 47 49 46 38 39 61 16 00 16 00 f7 00 00 00 00 00 01 01 01 02 02 02 03 03 03 04 04 04 05 05 05 06 06 06 07 07 07 08 08 08 09 09 09 0a 0a 0a 0b 0b 0b 0c 0c 0c 0d 0d 0d 0e 0e 0e 0f 0f 0f 10 10 10 11 11 11 12 12 12 13 13 13 14 14 14 15 15 15 16 16 16 17 17 17 18 18 18 19 19 19 1a 1a 1a 1b 1b 1b 1c 1c 1c 1d 1d 1d 1e 1e 1e 1f 1f 1f 20 20 20 21 21 21 22 22 22 23 23 23 24 24 24 25 25 25 26 26 26 27 27 27 28 28 28 29 29 29 2a 2a 2a 2b 2b 2b 2c 2c 2c 2d 2d 2d 2e 2e 2e 2f 2f 2f 30 30 30 31 31 31 32 32 32 33 33 33 34 34 34 35 35 35 36 36 36 37 37 37 38 38 38 39 39 39 3a 3a 3a 3b 3b 3b 3c 3c 3c 3d 3d 3d 3e 3e 3e 3f 3f 3f 40 40 40 41 41 41 42 42 42 43 43 43 44 44 44 45 45 45 46 46 46 47 47 47 48 48 48 49 49 49 4a 4a 4a 4b 4b 4b 4c 4c 4c 4d 4d 4d 4e 4e 4e 4f 4f 4f 50 50 Data Ascii: GIF89a !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPP

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:50:58 UTC	1057	OUT	GET /online-download/botdetect/public/bdc-sound-disabled-icon.gif HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:50:59 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:50:58 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Mon, 22 Jul 2019 15:47:45 GMT ETag: "42f-58e46ff432a40" Accept-Ranges: bytes Content-Length: 1071 Connection: close Content-Type: image/gif
2025-03-12 14:50:59 UTC	1071	IN	Data Raw: 47 49 46 38 39 61 16 00 16 00 f7 00 00 04 02 04 b4 b2 b4 dc da dc c4 c6 c4 ec ee ec bc be bc e4 e6 e4 d4 d2 d4 f4 f6 f4 bc ba bc e4 e2 e4 cc ce cc bc b6 bc e4 de e4 cc ca cc fc f6 fc b4 b6 b4 dc de dc c4 ca c4 f4 f2 f4 c4 c2 c4 ec ea ec d4 d6 d4 fc fa fc 00 00 18 00 00 ee 00 22 12 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 50 d0 2d e8 80 00 12 22 00 00 00 00 01 78 5a 00 7d 00 00 22 5c 00 00 00 65 00 30 f6 00 2a 61 00 23 7d 00 00 c8 7e 65 80 00 32 22 00 4e 00 c0 7d 30 00 5a e9 00 00 12 00 00 00 00 00 f1 00 5a f5 00 00 61 00 08 7d 00 02 48 00 f4 16 00 ea 22 00 12 00 00 00 0d ff 52 f6 ff 65 61 ff 70 7d ff 6c 00 ff 61 00 ff 63 00 ff 65 00 ff 20 d0 00 66 80 00 69 22 00 6c 00 00 65 00 a4 00 00 e9 eb 00 12 12 00 00 00 00 00 03 00 00 00 00 22 00 00 00 00 00 00 Data Ascii: GIF89a"P-"xZ}"\e0*a#}~e2"N}0ZZa}H"Reap}lace fi"le"

Timestamp	Bytes transferred	Direction	Data
2025-03-12 14:51:00 UTC	696	OUT	GET /online-download/botdetect/public/bdc-reload-icon.gif HTTP/1.1 Host: cityofmarion.in.gov.marion-police-department.reference-check.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D
2025-03-12 14:51:01 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 12 Mar 2025 14:51:00 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Mon, 22 Jul 2019 15:47:45 GMT ETag: "492-58e46ff432a40" Accept-Ranges: bytes Content-Length: 1170 Connection: close Content-Type: image/gif
2025-03-12 14:51:01 UTC	1170	IN	Data Raw: 47 49 46 38 39 61 16 00 16 00 f7 00 00 30 30 30 df df df eb eb eb ff ff ff 36 36 36 f6 f6 f6 d1 d1 d1 ef ef ef e7 e7 e7 f1 f1 f1 fb fb fb 53 53 53 fc fc fc ff ff ff f9 f9 f9 ef ef ef fa fa fa fd fd fd fe fe fe f4 f4 f4 fe fe fe f3 f3 f3 44 44 44 fe fe fe fa fa fa f0 f0 f0 4a 4a 4a f0 f0 f0 fd fd fd fd fd fd 51 51 51 fb fb fb f2 f2 f2 f2 f2 f2 fc fc fc f4 f4 f4 f6 f6 f6 f5 f5 f5 4e 4e 4e f8 f8 f8 f8 f8 f8 3e 3e 3e 5d 5d 5d f2 f2 f2 e3 e3 e3 f5 f5 f5 bf bf bf c0 c0 c0 eb eb eb d3 d3 d3 71 71 71 6a 6a 6a e3 e3 e3 5c 5c 5c da da da ff ff ff fc fc fc e7 e7 e7 72 72 72 f8 f8 f8 ef ef ef a2 a2 a2 2f 2f 2f 83 83 83 56 56 56 40 40 40 ce ce ce 63 63 63 52 52 52 ef ef ef 51 51 51 ff ff ff fd fd fd f5 f5 f5 79 79 79 73 73 73 86 86 86 ec ec ec 90 90 90 45 45 45 6a 6a Data Ascii: GIF89a000666SSSDDDJJJQQQNNN>>>]]]qqqjjj\\\rrr///VVV@@@cccRRRQQQyyysssEEEjj