Edit tour

Windows Analysis Report
https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve

Overview

General Information

Sample URL:	https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve
Analysis ID:	1650663
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Creates files inside the system directory

Deletes files inside the Windows folder

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2192,i,1542605103159018065,6947158532015609988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2240 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2192,i,1542605103159018065,6947158532015609988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5076 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: POST /recaptcha/api2/reload?k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 7601sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-protobuffersec-ch-ua-mobile: ?0Accept: */*Origin: https://www.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_HAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 21:14:19 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: chromecache_115.7.dr	String found in binary or memory: https://Pjk2.vamdyduebs.es/kT9ifrJ/
Source: chromecache_103.7.dr, chromecache_99.7.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_103.7.dr, chromecache_99.7.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_103.7.dr, chromecache_99.7.dr	String found in binary or memory: https://cloud.google.com/recaptcha/docs/troubleshoot-recaptcha-issues#automated-query-error
Source: chromecache_103.7.dr, chromecache_99.7.dr	String found in binary or memory: https://cloud.google.com/recaptcha/docs/troubleshoot-recaptcha-issues#localhost-error
Source: chromecache_103.7.dr, chromecache_99.7.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_101.7.dr	String found in binary or memory: https://dryneedleinstitute.org/874jsu9
Source: chromecache_99.7.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_99.7.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_103.7.dr, chromecache_99.7.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_103.7.dr, chromecache_99.7.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_103.7.dr, chromecache_99.7.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_115.7.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: chromecache_103.7.dr, chromecache_99.7.dr, chromecache_110.7.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_103.7.dr, chromecache_99.7.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__.
Source: chromecache_112.7.dr, chromecache_110.7.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 142.250.65.228:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.245.240.188:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.245.240.188:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.228:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.228:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.228:443 -> 192.168.2.5:49762 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6068_139948158

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6068_139948158

Jump to behavior

Source: classification engine

Classification label: mal48.win@25/39@21/3

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2192,i,1542605103159018065,6947158532015609988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2240 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2192,i,1542605103159018065,6947158532015609988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5076 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2192,i,1542605103159018065,6947158532015609988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2240 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2192,i,1542605103159018065,6947158532015609988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5076 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://Pjk2.vamdyduebs.es/kT9ifrJ/	100%	Avira URL Cloud	phishing
https://dryneedleinstitute.org/874jsu9	100%	Avira URL Cloud	malware
https://dryneedleinstitute.org/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
beacons-handoff.gcp.gvt2.com	142.251.116.94	true	false	high
www.google.com	142.250.65.228	true	false	high
dryneedleinstitute.org	104.245.240.188	true	false	unknown
beacons.gcp.gvt2.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/recaptcha/api2/bframe?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H	false		high
https://www.google.com/recaptcha/api2/reload?k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H	false		high
https://www.google.com/recaptcha/api.js	false		high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA5zLfzmt2tXhoe-TMIBecUea73PBNjshX5vlZ6LYYle8GHkle3x7gF6Yfs83DdQNUhjLofZDO7wGGdmM-ipMnJpscYBxAQsqFTWJY47pAOv9OW3MY2T7_4n1ZRqd1d92U2jPLLhioe1JX1SPpXwZa30T4gXRGlUC76TNj8qlTAV_BgGYotjQmRSsg6ZzhN9UNRZBrHP&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H	false		high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb	false		high
https://dryneedleinstitute.org/874jsu9/	false		unknown
https://dryneedleinstitute.org/874jsu9	false	Avira URL Cloud: malware	unknown
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H&co=aHR0cHM6Ly9kcnluZWVkbGVpbnN0aXR1dGUub3JnOjQ0Mw..&hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&size=normal&cb=fkm7w3z24vem	false		high
https://dryneedleinstitute.org/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/log?format=json&hasfast=true	chromecache_99.7.dr	false		high
https://cloud.google.com/recaptcha/docs/troubleshoot-recaptcha-issues#localhost-error	chromecache_103.7.dr, chromecache_99.7.dr	false		high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_103.7.dr, chromecache_99.7.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_103.7.dr, chromecache_99.7.dr	false		high
https://support.google.com/recaptcha#6262736	chromecache_103.7.dr, chromecache_99.7.dr	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_103.7.dr, chromecache_99.7.dr	false		high
https://Pjk2.vamdyduebs.es/kT9ifrJ/	chromecache_115.7.dr	false	Avira URL Cloud: phishing	unknown
https://cloud.google.com/recaptcha/docs/troubleshoot-recaptcha-issues#automated-query-error	chromecache_103.7.dr, chromecache_99.7.dr	false		high
https://www.google.com/recaptcha/api2/	chromecache_103.7.dr, chromecache_99.7.dr, chromecache_110.7.dr	false		high
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_103.7.dr, chromecache_99.7.dr	false		high
https://cloud.google.com/contact	chromecache_103.7.dr, chromecache_99.7.dr	false		high
https://support.google.com/recaptcha	chromecache_99.7.dr	false		high
https://www.gstatic.c..?/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__.	chromecache_103.7.dr, chromecache_99.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.65.228	www.google.com	United States		15169	GOOGLEUS	false
104.245.240.188	dryneedleinstitute.org	United States		8100	ASN-QUADRANET-GLOBALUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1650663
Start date and time:	2025-03-27 22:13:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@25/39@21/3

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.204.23.20, 142.251.40.227, 142.250.80.46, 142.251.167.84, 142.250.65.174, 142.251.40.131, 142.250.81.234, 142.251.32.106, 142.251.35.170, 142.251.40.106, 142.251.40.138, 142.251.40.170, 142.250.64.74, 142.250.64.106, 142.250.176.202, 142.251.40.202, 142.251.40.234, 142.251.41.10, 172.217.165.138, 142.250.65.170, 142.250.65.202, 142.250.65.234, 142.250.72.99, 199.232.90.172, 142.251.41.3, 34.104.35.123, 4.245.163.56, 20.69.140.28, 150.171.28.10, 23.57.90.162
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Source: https://Pjk2.vamdyduebs.es/kT9ifrJ/	Avira URL Cloud: Label: phishing
Source: https://dryneedleinstitute.org/874jsu9	Avira URL Cloud: Label: malware

Source: https://dryneedleinstitute.org/874jsu9/	HTTP Parser: No favicon
Source: https://dryneedleinstitute.org/874jsu9/	HTTP Parser: No favicon
Source: https://dryneedleinstitute.org/874jsu9/	HTTP Parser: No favicon
Source: https://dryneedleinstitute.org/874jsu9/	HTTP Parser: No favicon
Source: https://dryneedleinstitute.org/874jsu9/	HTTP Parser: No favicon
Source: https://dryneedleinstitute.org/874jsu9/	HTTP Parser: No favicon
Source: https://dryneedleinstitute.org/874jsu9/	HTTP Parser: No favicon
Source: https://dryneedleinstitute.org/874jsu9/	HTTP Parser: No favicon
Source: https://dryneedleinstitute.org/874jsu9/	HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.156
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI9s/OAQiA1s4BCNLgzgEIr+TOAQji5M4BCOfkzgEIi+XOAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /874jsu9 HTTP/1.1Host: dryneedleinstitute.orgConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /874jsu9/ HTTP/1.1Host: dryneedleinstitute.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://dryneedleinstitute.org/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H&co=aHR0cHM6Ly9kcnluZWVkbGVpbnN0aXR1dGUub3JnOjQ0Mw..&hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&size=normal&cb=fkm7w3z24vem HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://dryneedleinstitute.org/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb HTTP/1.1Host: www.google.comConnection: keep-aliveAccept: /X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI9s/OAQiA1s4BCNLgzgEIr+TOAQji5M4BCOfkzgEIi+XOAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerSec-Fetch-Storage-Access: activeReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H&co=aHR0cHM6Ly9kcnluZWVkbGVpbnN0aXR1dGUub3JnOjQ0Mw..&hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&size=normal&cb=fkm7w3z24vemUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://dryneedleinstitute.org/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dryneedleinstitute.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dryneedleinstitute.org/874jsu9/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA5zLfzmt2tXhoe-TMIBecUea73PBNjshX5vlZ6LYYle8GHkle3x7gF6Yfs83DdQNUhjLofZDO7wGGdmM-ipMnJpscYBxAQsqFTWJY47pAOv9OW3MY2T7_4n1ZRqd1d92U2jPLLhioe1JX1SPpXwZa30T4gXRGlUC76TNj8qlTAV_BgGYotjQmRSsg6ZzhN9UNRZBrHP&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_HAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALcxeyoS_lwAUydnwU18OSVt6KKV04DvZw1FlcP23RAXt7iibAhS5mqCNW-rHIXfuiGDhQiOMJjNNW8qXW6N8x0; NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALcxeyoS_lwAUydnwU18OSVt6KKV04DvZw1FlcP23RAXt7iibAhS5mqCNW-rHIXfuiGDhQiOMJjNNW8qXW6N8x0; NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA5zLfzmt2tXhoe-TMIBecUea73PBNjshX5vlZ6LYYle8GHkle3x7gF6Yfs83DdQNUhjLofZDO7wGGdmM-ipMnJpscYBxAQsqFTWJY47pAOv9OW3MY2T7_4n1ZRqd1d92U2jPLLhioe1JX1SPpXwZa30T4gXRGlUC76TNj8qlTAV_BgGYotjQmRSsg6ZzhN9UNRZBrHP&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALcxeyoS_lwAUydnwU18OSVt6KKV04DvZw1FlcP23RAXt7iibAhS5mqCNW-rHIXfuiGDhQiOMJjNNW8qXW6N8x0; NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: dryneedleinstitute.org
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2025 22:14:06.539081097 CET	53	52666	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:06.566489935 CET	53	56445	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:07.276856899 CET	53	59760	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:10.862797022 CET	56952	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:14:10.863023043 CET	63887	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:14:10.951431990 CET	53	56952	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:10.951495886 CET	53	63887	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:12.353904963 CET	51921	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:14:12.354273081 CET	62331	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:14:12.449404001 CET	53	62331	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:12.477559090 CET	53	51921	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:14.576169968 CET	62356	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:14:14.576303959 CET	49326	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:14:14.664566994 CET	53	62356	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:14.664599895 CET	53	49326	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:15.159324884 CET	53	60241	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:16.099096060 CET	52001	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:14:16.099487066 CET	65078	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:14:16.187381029 CET	53	52001	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:16.187608957 CET	53	65078	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:16.283967972 CET	53	61573	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:16.867212057 CET	53	54907	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:18.296330929 CET	53	61565	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:24.295202971 CET	53	53897	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:26.478598118 CET	59491	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:14:26.478717089 CET	59894	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:14:26.567845106 CET	53	59491	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:26.567892075 CET	53	59894	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:43.183970928 CET	53	49598	1.1.1.1	192.168.2.5
Mar 27, 2025 22:14:44.104763031 CET	53	62004	162.159.36.2	192.168.2.5
Mar 27, 2025 22:15:02.715770006 CET	138	138	192.168.2.5	192.168.2.255
Mar 27, 2025 22:15:05.967596054 CET	53	59104	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:06.346432924 CET	53	60709	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:18.856574059 CET	57881	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:18.856874943 CET	61041	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:18.944927931 CET	53	57881	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:18.944979906 CET	53	61041	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:19.879190922 CET	49893	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:19.883080006 CET	54697	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:19.967569113 CET	53	49893	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:19.971180916 CET	53	54697	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:21.909944057 CET	64292	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:21.998243093 CET	53	64292	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:22.925033092 CET	64292	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:23.013366938 CET	53	64292	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:23.924844027 CET	64292	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:24.013402939 CET	53	64292	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:25.925344944 CET	64292	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:26.014092922 CET	53	64292	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:28.850651979 CET	49256	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:28.852914095 CET	53517	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:28.938873053 CET	53	49256	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:28.941005945 CET	53	53517	1.1.1.1	192.168.2.5
Mar 27, 2025 22:15:29.925332069 CET	64292	53	192.168.2.5	1.1.1.1
Mar 27, 2025 22:15:30.013684034 CET	53	64292	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:12 UTC	1045	OUT	GET /url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI9s/OAQiA1s4BCNLgzgEIr+TOAQji5M4BCOfkzgEIi+XOAQ== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 21:14:12 UTC	819	IN	HTTP/1.1 200 OK Location: https://dryneedleinstitute.org/874jsu9 Cache-Control: private Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Thu, 27 Mar 2025 21:14:12 GMT Server: gws Content-Length: 370 X-XSS-Protection: 0 Expires: Thu, 27 Mar 2025 21:14:12 GMT Set-Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k; expires=Fri, 26-Sep-2025 21:14:12 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-27 21:14:12 UTC	178	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 54 49 54 4c 45 3e 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 64 72 79 6e 65 65 64 6c 65 69 6e 73 74 69 74 75 74 65 2e 6f Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>Redirecting</TITLE><META HTTP-EQUIV="refresh" content="1; url=https://dryneedleinstitute.o
2025-03-27 21:14:12 UTC	192	IN	Data Raw: 72 67 2f 38 37 34 6a 73 75 39 22 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 6f 6e 4c 6f 61 64 3d 22 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 73 3a 2f 2f 64 72 79 6e 65 65 64 6c 65 69 6e 73 74 69 74 75 74 65 2e 6f 72 67 2f 38 37 34 6a 73 75 39 27 2b 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 29 22 3e 0a 52 65 64 69 72 65 63 74 69 6e 67 20 79 6f 75 20 74 6f 20 68 74 74 70 73 3a 2f 2f 64 72 79 6e 65 65 64 6c 65 69 6e 73 74 69 74 75 74 65 2e 6f 72 67 2f 38 37 34 6a 73 75 39 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: rg/874jsu9"></HEAD><BODY onLoad="location.replace('https://dryneedleinstitute.org/874jsu9'+document.location.hash)">Redirecting you to https://dryneedleinstitute.org/874jsu9</BODY></HTML>

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:13 UTC	699	OUT	GET /874jsu9 HTTP/1.1 Host: dryneedleinstitute.org Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 21:14:14 UTC	223	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 27 Mar 2025 21:14:14 GMT Server: Apache Location: https://dryneedleinstitute.org/874jsu9/ Content-Length: 247 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-03-27 21:14:14 UTC	247	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 72 79 6e 65 65 64 6c 65 69 6e 73 74 69 74 75 74 65 2e 6f 72 67 2f 38 37 34 6a 73 75 39 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://dryneedleinstitute.org/874jsu9/">here</a>.</p></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:14 UTC	700	OUT	GET /874jsu9/ HTTP/1.1 Host: dryneedleinstitute.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 21:14:14 UTC	159	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 21:14:14 GMT Server: Apache Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2025-03-27 21:14:14 UTC	2541	IN	Data Raw: 39 65 31 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 27 20 61 73 79 6e 63 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d Data Ascii: 9e1<html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Redirect</title> <script src='https://www.google.com/recaptcha/api.js' async defer></script></head>

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:14 UTC	879	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://dryneedleinstitute.org/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
2025-03-27 21:14:15 UTC	749	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 27 Mar 2025 21:14:15 GMT Date: Thu, 27 Mar 2025 21:14:15 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-27 21:14:15 UTC	248	IN	Data Raw: 35 63 62 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a Data Ascii: 5cb/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https:
2025-03-27 21:14:15 UTC	997	IN	Data Raw: 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 32 2f 27 3b 28 63 66 67 5b 27 72 65 6e 64 65 72 27 5d 3d 63 66 67 5b 27 72 65 6e 64 65 72 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 27 6f 6e 6c 6f 61 64 27 29 3b 28 63 66 67 5b 27 63 6c 72 27 5d 3d 63 66 67 5b 27 63 6c 72 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 27 74 72 75 65 27 29 3b 77 5b 27 5f 5f 67 6f 6f 67 6c 65 5f 72 65 63 61 70 74 63 68 61 5f 63 6c 69 65 6e 74 27 5d 3d 74 72 75 65 3b 76 61 72 20 64 3d 64 6f 63 75 6d 65 6e 74 2c 70 6f 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 70 6f 2e 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3b 70 6f 2e 61 73 79 6e 63 3d 74 72 75 65 3b 20 70 6f 2e 63 68 61 72 73 65 74 Data Ascii: //www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');(cfg['clr']=cfg['clr']\|\|[]).push('true');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset
2025-03-27 21:14:15 UTC	245	IN	Data Raw: 55 35 77 63 6a 66 67 42 76 76 2f 31 71 2b 78 78 5a 4b 56 36 5a 68 42 48 34 69 6b 47 63 67 54 44 45 43 34 76 45 5a 50 54 74 33 6c 38 4f 27 3b 76 61 72 20 65 3d 64 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 73 63 72 69 70 74 5b 6e 6f 6e 63 65 5d 27 29 2c 6e 3d 65 26 26 28 65 5b 27 6e 6f 6e 63 65 27 5d 7c 7c 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 27 6e 6f 6e 63 65 27 29 29 3b 69 66 28 6e 29 7b 70 6f 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 6e 6f 6e 63 65 27 2c 6e 29 3b 7d 76 61 72 20 73 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 73 63 72 69 70 74 27 29 5b 30 5d 3b 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 70 6f 2c 20 73 29 3b 7d 29 28 29 3b 0d 0a Data Ascii: U5wcjfgBvv/1q+xxZKV6ZhBH4ikGcgTDEC4vEZPTt3l8O';var e=d.querySelector('script[nonce]'),n=e&&(e['nonce']\|\|e.getAttribute('nonce'));if(n){po.setAttribute('nonce',n);}var s=d.getElementsByTagName('script')[0];s.parentNode.insertBefore(po, s);})();
2025-03-27 21:14:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (594)
Category:	downloaded
Size (bytes):	561652
Entropy (8bit):	5.637398859811323
Encrypted:	false
SSDEEP:	12288:Cxh1RKtVFgp1RkOgInBLMueXl9JvpGEwmYb:e/RKNgpjDLMueXl9JvKt
MD5:	A3BA6F3831DFAC23271ED79DB3467B14
SHA1:	2F93EAE45276ABDCF26B684EF45036C7BF0D7F61
SHA-256:	9C60F375BB60B19DC9BB69D9F8ABC316D7652A2F088B26C42FCCBDFC15E6FF6A
SHA-512:	5583D01793029A9CC82260B74200812CBDB58CB715F20CCADD5AF76BCD7D561ACBABED018D3107951069AFFF11DC9A3D63A65F6AD17AC263FC0FFB8BECD9CFD1
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var T=function(){return[function(c,u,t,d,h,F){if(!(c-((c^(h=[7,40,5],h[1]))&3\|\|w.call(this,u),h[2])&h[0]))H[4](88,u,d,t);return F},function(c,u,t,d,h,F,Z,E,y,m,W,a,G){return((((((a=[33,"play",250],(c\|5)>>4)\|\|(u_.call(this,t),this.S=u\|\|""),(c\|80)==c)&&(m=["1","block","none"],h==(t.F==3)?G=k[38](5):h?(Z=t.F,y=t.f9(),E=H[7](3,u,t),t.mS()?E.add(k[39](54,null,!1,t)):E.add(V[3](74,"",t,y,Z,!1)),k[4](16,!1,m[0],m[1],t),d&&d.resolve(),W=H[6](61),J[16](15,null,J[28](58,t),E,u,El(function(){W.resolve()},t)),.t.p9(3),E[a[1]](),G=W.promise):(H[39](7,"0",m[2],a[2],!0,t,F),t.p9(1),G=k[38](9))),(c\|8)&6)==2&&(Z=d.eq,u[t]=function

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0
Category:	downloaded
Size (bytes):	15340
Entropy (8bit):	7.983406336508752
Encrypted:	false
SSDEEP:	384:F2gPJde0V2iGrQyD8b3k/tigCdeNqOUd47SH0tsGm:4gPVV2NQE8b3ldeNWH0Wb
MD5:	19B7A0ADFDD4F808B53AF7E2CE2AD4E5
SHA1:	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA
SHA-256:	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
SHA-512:	49DA16000687AC81FC4CA9E9112BDCA850BB9F32E0AF2FE751ABC57A8E9C3382451B50998CEB9DE56FC4196F1DC7EF46BBA47933FC47EB4538124870B7630036
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Preview:	wOF2......;........d..;..........................d..z..J.`..L.Z..<.....\..`..^...x.6.$..6. ..\|. ..8..z%......Q.{..q...FF.kd .8.(..d..).!C...Y.JA...r. ..GH8F......nW...".2&....2<..+C...p...b..SC.......J......z.-..Q..#6&1zUe../\...l.....<.....9s...E~.]B-..B.wY..o......Q..A.F..1j.......-.`P% .. ,..@1.0..~.....WWW.d.u<c{..^.R.+..w....&.........A......+C....(.N.....0.~..0.J.;.Nu..7....]..m.H.....[h.GL3....?)....c.H...2.3.}y........SXI\|..iVN'%E.D.W....r..<`....i....6;E$.....U.$j.@...._.......R2....WS...k.vz.R.'a9!^...N....h.._.....c.%."..S.2.16B...o.2}.pmU[.\|.LI....2.....OWQLO1-....s..8.(...".\|6...6R.. ..M-.zO.}w)..v..mXxX...c..3#.+.v....F`.Z;.zQ.......r,....Yo.....g.h....+.....O.3Y..)Y.8.!....elX......._.3.}k~u.{ C..H.z..FP........@...d..)T.R...L.H.J.j.@..............$...E......y...3.b...I.h u.+%.HA.\..9..8..X.!....gx...].:..V..C...._..X..!....6..)...GM:E.....O.Z.}k.;.T.k..D.k.O..D5.r..."......?..T.Q.A...CF...3g.5.Dn<.QPy..G..1.9..Q..0..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:16 UTC	1379	OUT	GET /recaptcha/api2/anchor?ar=1&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H&co=aHR0cHM6Ly9kcnluZWVkbGVpbnN0aXR1dGUub3JnOjQ0Mw..&hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&size=normal&cb=fkm7w3z24vem HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://dryneedleinstitute.org/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
2025-03-27 21:14:16 UTC	1161	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 27 Mar 2025 21:14:16 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-ZR-IN3EoUbyvOFBH0-khnA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-27 21:14:16 UTC	1161	IN	Data Raw: 37 31 37 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 717e<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2025-03-27 21:14:16 UTC	1161	IN	Data Raw: 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 Data Ascii: ('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92
2025-03-27 21:14:16 UTC	1161	IN	Data Raw: 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 52 63 34 45 73 41 2e 77 6f 66 66 32 Data Ascii: U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}/* cyrillic-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2
2025-03-27 21:14:16 UTC	1161	IN	Data Raw: 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d 30 31 36 39 2c 20 55 2b 30 31 41 30 2d 30 31 41 31 2c 20 55 2b 30 31 41 46 Data Ascii: e { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF
2025-03-27 21:14:16 UTC	1161	IN	Data Raw: 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 52 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 41 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 Data Ascii: -family: 'Roboto'; font-style: normal; font-weight: 900; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCRc4EsA.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyr
2025-03-27 21:14:16 UTC	1161	IN	Data Raw: 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d 30 31 36 39 2c 20 55 2b 30 31 41 30 2d 30 31 41 31 2c 20 55 2b 30 31 41 46 2d 30 31 42 30 2c 20 55 2b 30 33 30 30 2d 30 33 30 31 2c 20 55 2b 30 33 30 33 2d 30 33 30 34 2c 20 55 2b 30 33 30 38 2d 30 33 30 39 2c 20 55 2b 30 33 32 33 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 41 30 2d 31 45 46 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 Data Ascii: OlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}/* latin-ext */@font-face { f
2025-03-27 21:14:16 UTC	1161	IN	Data Raw: 22 5a 52 2d 49 4e 33 45 6f 55 62 79 76 4f 46 42 48 30 2d 6b 68 6e 41 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 32 2f 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 68 62 41 71 2d 59 68 4a 78 4f 6e 6c 55 2d 37 63 70 67 42 6f 41 4a 48 62 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d Data Ascii: "ZR-IN3EoUbyvOFBH0-khnA" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com/recaptcha/api2/';</script><script type="text/javascript" src="https://www.gstatic.com/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__en.js" nonce=
2025-03-27 21:14:16 UTC	1161	IN	Data Raw: 78 57 31 62 4a 59 6a 6b 74 6d 4b 35 57 4a 39 67 6c 61 31 32 50 61 79 70 31 59 6c 62 6f 64 7a 55 53 39 7a 4a 75 58 75 4d 30 47 42 74 50 4e 66 39 6c 70 2d 33 49 6a 6e 6e 39 45 78 76 37 47 65 39 35 64 63 76 47 6c 30 46 31 45 6e 30 61 36 48 7a 37 51 6b 45 68 30 73 75 54 5a 33 73 35 79 4e 45 77 4a 46 32 44 6c 4d 65 4b 57 72 65 4b 74 57 4a 56 33 6a 58 45 74 4e 56 34 4e 4c 71 53 41 57 70 79 72 76 47 6f 77 71 5f 79 39 42 6b 7a 63 33 59 69 46 44 58 71 76 50 54 5a 7a 5f 42 56 48 5f 4f 56 49 5f 6c 72 42 4c 71 67 33 4a 67 34 71 63 6e 4a 58 35 33 30 4a 31 4b 4c 73 44 76 31 31 42 47 47 37 6e 79 43 4c 50 4c 69 73 6b 5f 6a 54 68 4d 4d 67 4e 5a 51 4c 5f 2d 65 5a 47 74 36 6f 72 71 52 6e 6e 45 46 49 37 50 64 6f 42 35 5f 51 5f 42 7a 57 43 4c 35 75 6b 38 50 45 31 62 50 4a 6d Data Ascii: xW1bJYjktmK5WJ9gla12Payp1YlbodzUS9zJuXuM0GBtPNf9lp-3Ijnn9Exv7Ge95dcvGl0F1En0a6Hz7QkEh0suTZ3s5yNEwJF2DlMeKWreKtWJV3jXEtNV4NLqSAWpyrvGowq_y9Bkzc3YiFDXqvPTZz_BVH_OVI_lrBLqg3Jg4qcnJX530J1KLsDv11BGG7nyCLPLisk_jThMMgNZQL_-eZGt6orqRnnEFI7PdoB5_Q_BzWCL5uk8PE1bPJm
2025-03-27 21:14:16 UTC	1161	IN	Data Raw: 68 54 64 57 50 43 64 39 31 78 39 68 6b 39 67 6c 63 46 56 58 46 49 71 56 47 55 78 31 6b 6a 59 51 57 41 43 54 33 51 4f 55 41 6c 4b 48 70 62 4c 4c 4e 66 32 41 64 61 63 61 53 4b 4d 74 72 70 50 6c 67 62 4f 45 41 2d 57 42 56 67 6d 78 71 35 2d 41 66 39 70 43 65 56 44 66 66 4a 5f 71 52 4d 52 76 50 4b 6d 53 6a 4a 45 7a 72 6a 35 4c 31 6b 69 63 52 31 62 4b 57 7a 41 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 5a 52 2d 49 4e 33 45 6f 55 62 79 76 4f 46 42 48 30 2d 6b 68 6e 41 22 3e 0a 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 61 6e 63 68 6f 72 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 32 61 69 6e 70 75 74 5c 78 32 32 2c 5b 5c 78 32 32 62 67 64 61 74 61 5c 78 32 32 2c 5c 78 32 32 Data Ascii: hTdWPCd91x9hk9glcFVXFIqVGUx1kjYQWACT3QOUAlKHpbLLNf2AdacaSKMtrpPlgbOEA-WBVgmxq5-Af9pCeVDffJ_qRMRvPKmSjJEzrj5L1kicR1bKWzA"><script type="text/javascript" nonce="ZR-IN3EoUbyvOFBH0-khnA"> recaptcha.anchor.Main.init("[\x22ainput\x22,[\x22bgdata\x22,\x22
2025-03-27 21:14:16 UTC	1161	IN	Data Raw: 46 49 6d 4a 6c 4a 62 4d 46 30 39 50 54 31 47 4a 69 59 6f 54 44 31 53 57 7a 4a 64 4c 45 63 39 55 6c 73 78 58 53 78 53 50 58 5a 76 61 57 51 67 4d 43 6b 73 64 7a 31 6d 4b 47 73 73 4f 44 49 70 4c 48 63 75 62 47 56 75 5a 33 52 6f 50 54 30 77 4a 69 59 6f 54 6a 31 6d 4b 47 73 73 4d 7a 59 70 50 6a 34 7a 4c 48 63 75 63 48 56 7a 61 43 68 48 4c 45 34 2b 50 6a 67 6d 4d 6a 55 31 4c 45 34 6d 4d 6a 55 31 4b 53 78 4d 49 54 31 32 62 32 6c 6b 49 44 41 6d 4a 6e 63 75 63 48 56 7a 61 43 68 4d 4a 6a 49 31 4e 53 6b 70 4c 45 63 39 49 69 49 73 55 69 59 6d 4b 46 49 75 62 57 56 7a 63 32 46 6e 5a 53 59 6d 4b 45 63 72 50 56 49 75 62 57 56 7a 63 32 46 6e 5a 53 6b 73 55 69 35 7a 64 47 46 6a 61 79 59 6d 4b 45 63 72 50 53 49 36 49 69 74 53 4c 6e 4e 30 59 57 4e 72 4b 53 6b 73 55 6a 31 6d Data Ascii: FImJlJbMF09PT1GJiYoTD1SWzJdLEc9UlsxXSxSPXZvaWQgMCksdz1mKGssODIpLHcubGVuZ3RoPT0wJiYoTj1mKGssMzYpPj4zLHcucHVzaChHLE4+PjgmMjU1LE4mMjU1KSxMIT12b2lkIDAmJncucHVzaChMJjI1NSkpLEc9IiIsUiYmKFIubWVzc2FnZSYmKEcrPVIubWVzc2FnZSksUi5zdGFjayYmKEcrPSI6IitSLnN0YWNrKSksUj1m

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:18 UTC	1182	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb HTTP/1.1 Host: www.google.com Connection: keep-alive Accept: / X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI9s/OAQiA1s4BCNLgzgEIr+TOAQji5M4BCOfkzgEIi+XOAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Sec-Fetch-Storage-Access: active Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H&co=aHR0cHM6Ly9kcnluZWVkbGVpbnN0aXR1dGUub3JnOjQ0Mw..&hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&size=normal&cb=fkm7w3z24vem User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
2025-03-27 21:14:18 UTC	917	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Expires: Thu, 27 Mar 2025 21:14:18 GMT Date: Thu, 27 Mar 2025 21:14:18 GMT Cache-Control: private, max-age=300 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Cross-Origin-Resource-Policy: same-site Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-27 21:14:18 UTC	80	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 68 62 41 71 2d 59 68 4a 78 4f 6e 6c 55 2d 37 63 70 67 Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/hbAq-YhJxOnlU-7cpg
2025-03-27 21:14:18 UTC	28	IN	Data Raw: 42 6f 41 4a 48 62 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: BoAJHb/recaptcha__en.js');
2025-03-27 21:14:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:18 UTC	1294	OUT	GET /recaptcha/api2/bframe?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://dryneedleinstitute.org/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
2025-03-27 21:14:18 UTC	1161	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 27 Mar 2025 21:14:18 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-DADljJ7HFLd-RXCi8RA0jw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-27 21:14:18 UTC	1161	IN	Data Raw: 31 65 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 Data Ascii: 1e14<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face
2025-03-27 21:14:18 UTC	1161	IN	Data Raw: 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 Data Ascii: t('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu9
2025-03-27 21:14:18 UTC	1161	IN	Data Raw: 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 52 63 34 45 73 41 2e 77 6f 66 66 Data Ascii: U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}/* cyrillic-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff
2025-03-27 21:14:18 UTC	1161	IN	Data Raw: 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d 30 31 36 39 2c 20 55 2b 30 31 41 30 2d 30 31 41 31 2c 20 55 2b 30 31 41 Data Ascii: ce { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01A
2025-03-27 21:14:18 UTC	1161	IN	Data Raw: 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 52 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 41 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 Data Ascii: t-family: 'Roboto'; font-style: normal; font-weight: 900; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCRc4EsA.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cy
2025-03-27 21:14:18 UTC	1161	IN	Data Raw: 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d 30 31 36 39 2c 20 55 2b 30 31 41 30 2d 30 31 41 31 2c 20 55 2b 30 31 41 46 2d 30 31 42 30 2c 20 55 2b 30 33 30 30 2d 30 33 30 31 2c 20 55 2b 30 33 30 33 2d 30 33 30 34 2c 20 55 2b 30 33 30 38 2d 30 33 30 39 2c 20 55 2b 30 33 32 33 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 41 30 2d 31 45 46 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 Data Ascii: FOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}/* latin-ext */@font-face {
2025-03-27 21:14:18 UTC	742	IN	Data Raw: 3d 22 44 41 44 6c 6a 4a 37 48 46 4c 64 2d 52 58 43 69 38 52 41 30 6a 77 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 32 2f 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 68 62 41 71 2d 59 68 4a 78 4f 6e 6c 55 2d 37 63 70 67 42 6f 41 4a 48 62 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 Data Ascii: ="DADljJ7HFLd-RXCi8RA0jw" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com/recaptcha/api2/';</script><script type="text/javascript" src="https://www.gstatic.com/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__en.js" nonce
2025-03-27 21:14:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:18 UTC	615	OUT	GET /favicon.ico HTTP/1.1 Host: dryneedleinstitute.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dryneedleinstitute.org/874jsu9/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 21:14:19 UTC	164	IN	HTTP/1.1 404 Not Found Date: Thu, 27 Mar 2025 21:14:19 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-03-27 21:14:19 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:26 UTC	1109	OUT	POST /recaptcha/api2/reload?k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 7601 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-protobuffer sec-ch-ua-mobile: ?0 Accept: / Origin: https://www.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
2025-03-27 21:14:26 UTC	7601	OUT	Data Raw: 0a 18 68 62 41 71 2d 59 68 4a 78 4f 6e 6c 55 2d 37 63 70 67 42 6f 41 4a 48 62 12 e4 0f 30 33 41 46 63 57 65 41 37 4c 62 4f 4a 30 76 66 52 31 30 46 33 52 48 49 4e 67 49 75 73 67 31 47 41 6f 69 38 78 6c 6e 6a 7a 72 7a 42 2d 78 6b 59 39 4f 41 50 7a 69 67 71 5a 74 44 4d 56 6c 35 4d 76 62 46 51 6d 7a 59 72 62 52 59 78 59 31 76 39 64 6f 35 54 74 6c 45 55 43 36 65 34 79 4c 6e 49 7a 79 6f 30 38 4e 53 71 79 74 70 59 56 73 7a 72 78 67 4f 77 4f 65 46 6b 7a 76 59 43 45 66 69 35 46 52 30 30 75 78 6c 33 65 69 57 49 38 34 43 67 46 52 32 58 49 42 4b 58 33 49 33 53 5a 61 72 6f 77 62 5a 4c 55 33 7a 44 72 69 5f 43 6c 67 78 4c 34 56 39 45 52 45 64 45 56 52 77 4c 64 50 36 32 6d 53 6c 70 68 59 6e 49 4e 53 61 41 49 45 51 37 38 41 44 65 6a 7a 66 4d 39 72 78 75 6d 71 39 76 70 67 Data Ascii: hbAq-YhJxOnlU-7cpgBoAJHb03AFcWeA7LbOJ0vfR10F3RHINgIusg1GAoi8xlnjzrzB-xkY9OAPzigqZtDMVl5MvbFQmzYrbRYxY1v9do5TtlEUC6e4yLnIzyo08NSqytpYVszrxgOwOeFkzvYCEfi5FR00uxl3eiWI84CgFR2XIBKX3I3SZarowbZLU3zDri_ClgxL4V9EREdEVRwLdP62mSlphYnINSaAIEQ78ADejzfM9rxumq9vpg
2025-03-27 21:14:26 UTC	1000	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: same-site Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Date: Thu, 27 Mar 2025 21:14:26 GMT Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: _GRECAPTCHA=09ALcxeyoS_lwAUydnwU18OSVt6KKV04DvZw1FlcP23RAXt7iibAhS5mqCNW-rHIXfuiGDhQiOMJjNNW8qXW6N8x0; Expires=Tue, 23-Sep-2025 21:14:26 GMT; Path=/recaptcha; Secure; HttpOnly; Priority=HIGH; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Expires: Thu, 27 Mar 2025 21:14:26 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2025-03-27 21:14:26 UTC	1000	IN	Data Raw: 35 35 37 33 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 35 69 58 30 75 39 4f 75 74 6a 4b 49 45 5f 6d 30 31 6f 6e 6e 6f 70 42 31 79 50 4b 76 5f 31 74 4d 34 68 37 31 56 62 50 49 6e 51 62 4e 4f 67 51 71 6f 65 72 73 63 72 68 39 65 63 62 69 39 6b 30 49 62 6d 50 52 39 6b 72 70 30 51 53 73 59 61 46 30 37 36 2d 35 76 4c 62 77 51 32 55 74 4c 74 2d 6a 33 6f 34 35 4c 63 6c 61 67 50 43 47 50 6f 50 32 52 76 4c 32 4c 64 32 69 4f 47 71 63 6c 7a 37 61 63 66 2d 6a 72 64 57 6e 5f 52 50 39 35 4a 5a 4a 4d 77 6a 73 35 2d 78 74 61 55 53 6c 68 7a 54 71 61 65 6d 30 4a 4b 48 77 2d 6a 41 6f 50 59 57 51 53 48 79 65 32 66 46 6e 77 4c 6d 70 63 69 46 30 78 69 38 41 6d 41 5a 6a 4e 63 54 6a 77 4d 57 41 43 44 34 4a 4d 74 46 62 34 62 45 6c 6b 4a 42 78 56 4d Data Ascii: 5573)]}'["rresp","03AFcWeA5iX0u9OutjKIE_m01onnopB1yPKv_1tM4h71VbPInQbNOgQqoerscrh9ecbi9k0IbmPR9krp0QSsYaF076-5vLbwQ2UtLt-j3o45LclagPCGPoP2RvL2Ld2iOGqclz7acf-jrdWn_RP95JZJMwjs5-xtaUSlhzTqaem0JKHw-jAoPYWQSHye2fFnwLmpciF0xi8AmAZjNcTjwMWACD4JMtFb4bElkJBxVM
2025-03-27 21:14:26 UTC	1000	IN	Data Raw: 6e 77 53 30 71 4b 33 5a 41 76 2d 64 65 4a 46 65 6f 5f 5f 61 36 6c 4e 48 35 35 45 69 65 47 75 69 79 56 37 78 48 4a 64 49 6f 73 74 4d 79 76 4d 5a 78 6c 5f 52 70 72 6f 6a 68 48 58 45 45 62 44 34 54 6e 6b 55 78 67 36 74 77 7a 58 47 72 63 55 39 32 4a 37 66 77 57 44 4d 58 54 53 49 34 35 66 64 76 61 59 45 6a 72 71 4a 7a 59 36 49 5a 77 6d 35 33 50 39 55 58 7a 56 2d 51 66 67 6b 32 43 41 4c 74 46 73 6b 6c 6c 49 39 38 64 42 69 63 61 64 47 56 6a 65 4b 47 66 71 30 67 52 66 55 53 48 6f 6a 57 4d 51 53 4a 69 35 32 77 42 56 39 41 76 50 45 4c 6e 78 39 70 34 37 67 34 62 6b 4a 6d 72 38 62 67 6b 5f 61 52 46 49 7a 5f 54 2d 4c 75 62 30 66 4d 6b 35 4d 61 68 39 50 62 44 72 78 76 32 75 63 4d 71 31 6c 6d 36 6d 61 50 66 7a 58 71 53 35 58 39 32 6f 6e 77 57 72 57 50 31 61 56 46 37 58 Data Ascii: nwS0qK3ZAv-deJFeo__a6lNH55EieGuiyV7xHJdIostMyvMZxl_RprojhHXEEbD4TnkUxg6twzXGrcU92J7fwWDMXTSI45fdvaYEjrqJzY6IZwm53P9UXzV-Qfgk2CALtFskllI98dBicadGVjeKGfq0gRfUSHojWMQSJi52wBV9AvPELnx9p47g4bkJmr8bgk_aRFIz_T-Lub0fMk5Mah9PbDrxv2ucMq1lm6maPfzXqS5X92onwWrWP1aVF7X
2025-03-27 21:14:26 UTC	1000	IN	Data Raw: 6c 64 5f 57 35 6b 2d 48 66 68 54 72 52 68 42 39 37 69 6b 37 69 79 55 71 77 4f 7a 33 71 42 33 78 63 6d 72 4e 35 75 61 44 6c 54 6e 64 37 63 5a 68 68 45 33 52 55 38 37 75 50 74 4f 71 6d 4b 59 31 78 35 30 39 35 7a 5f 37 4f 77 53 6e 4a 56 5f 63 76 62 7a 77 33 45 54 55 4e 69 35 57 4f 76 71 6e 4d 49 56 33 5f 2d 69 68 4e 37 54 56 4f 7a 63 78 49 2d 65 4d 7a 43 47 54 54 54 51 65 46 33 34 58 39 72 67 5a 56 67 4e 37 4d 33 6d 4b 37 7a 50 6a 4d 47 61 6c 76 71 66 79 75 51 47 49 44 41 33 54 5a 73 4a 49 47 67 66 52 6d 30 59 4f 46 58 38 48 58 70 30 5f 73 36 35 53 49 59 78 41 4f 76 4a 5f 7a 54 66 67 70 5f 47 74 41 66 75 53 4a 66 61 6c 56 32 4a 49 53 32 4e 43 69 6c 49 2d 74 68 6e 51 6a 63 74 6e 4f 47 76 6f 4a 51 31 61 53 6a 41 6a 59 71 34 53 59 6c 47 51 64 4a 4d 51 2d 48 51 Data Ascii: ld_W5k-HfhTrRhB97ik7iyUqwOz3qB3xcmrN5uaDlTnd7cZhhE3RU87uPtOqmKY1x5095z_7OwSnJV_cvbzw3ETUNi5WOvqnMIV3_-ihN7TVOzcxI-eMzCGTTTQeF34X9rgZVgN7M3mK7zPjMGalvqfyuQGIDA3TZsJIGgfRm0YOFX8HXp0_s65SIYxAOvJ_zTfgp_GtAfuSJfalV2JIS2NCilI-thnQjctnOGvoJQ1aSjAjYq4SYlGQdJMQ-HQ
2025-03-27 21:14:26 UTC	1000	IN	Data Raw: 64 5f 45 4c 4e 78 37 55 4d 79 35 5a 52 72 52 4b 41 56 66 37 6d 76 6a 59 47 47 71 66 79 31 42 6c 31 47 75 46 35 2d 68 51 37 64 42 74 5a 44 5f 30 39 79 46 69 68 7a 6e 75 50 33 6c 36 51 39 63 68 64 4a 52 70 41 63 67 59 4d 78 77 32 49 39 76 4e 56 30 71 52 49 69 6f 6b 43 36 31 52 6b 63 34 2d 43 32 48 50 34 33 76 33 61 59 38 72 4b 47 49 38 6c 64 56 63 34 53 77 49 32 49 53 77 54 42 41 4b 71 30 4d 48 46 6a 35 57 51 78 61 76 47 58 36 36 68 76 64 77 50 4c 38 67 68 69 4a 4d 44 54 47 35 62 33 55 6c 6c 66 30 79 30 75 6a 65 34 6b 50 6f 52 55 41 56 68 46 33 7a 53 5a 63 70 45 44 72 62 42 67 4c 69 75 67 50 66 44 66 54 48 77 58 49 54 4e 34 70 44 66 4a 44 51 5a 32 32 79 6f 4a 74 79 6e 78 48 4e 4a 30 38 7a 70 51 71 35 49 6b 67 71 49 79 53 6e 46 4a 5f 43 53 56 6c 6d 7a 43 53 Data Ascii: d_ELNx7UMy5ZRrRKAVf7mvjYGGqfy1Bl1GuF5-hQ7dBtZD_09yFihznuP3l6Q9chdJRpAcgYMxw2I9vNV0qRIiokC61Rkc4-C2HP43v3aY8rKGI8ldVc4SwI2ISwTBAKq0MHFj5WQxavGX66hvdwPL8ghiJMDTG5b3Ullf0y0uje4kPoRUAVhF3zSZcpEDrbBgLiugPfDfTHwXITN4pDfJDQZ22yoJtynxHNJ08zpQq5IkgqIySnFJ_CSVlmzCS
2025-03-27 21:14:26 UTC	1000	IN	Data Raw: 4b 5a 54 51 73 48 2d 70 7a 31 47 54 62 4a 53 5f 62 62 42 65 6a 45 71 59 4f 54 69 54 56 34 42 79 4c 71 4a 58 6c 64 68 4b 4a 59 48 38 58 51 5f 66 55 53 5f 70 34 2d 5f 71 6e 4b 33 33 39 71 44 53 75 61 37 62 53 68 49 51 75 63 4b 44 74 6b 69 67 64 67 6b 77 42 42 72 56 52 7a 72 75 6f 47 72 30 58 32 5a 4f 44 73 73 34 33 51 76 6e 54 42 31 43 67 62 58 4e 38 64 46 71 67 52 4d 77 31 44 70 38 49 69 4f 66 63 4d 5a 55 47 79 54 52 7a 75 53 4b 4e 4e 43 6c 2d 54 47 45 55 52 46 4c 51 5f 43 61 49 50 5f 48 4b 4f 6a 52 52 62 45 52 74 4d 57 57 66 47 42 38 79 73 49 37 6f 79 4d 4c 67 73 59 4c 4c 34 5a 50 6f 51 55 69 34 73 72 69 79 50 73 38 46 77 66 70 46 74 30 6c 51 46 57 73 64 47 6f 76 6e 52 56 36 31 43 4f 44 71 49 79 43 43 34 68 5a 74 6d 47 61 5a 7a 55 4d 73 6c 72 54 67 66 59 Data Ascii: KZTQsH-pz1GTbJS_bbBejEqYOTiTV4ByLqJXldhKJYH8XQ_fUS_p4-_qnK339qDSua7bShIQucKDtkigdgkwBBrVRzruoGr0X2ZODss43QvnTB1CgbXN8dFqgRMw1Dp8IiOfcMZUGyTRzuSKNNCl-TGEURFLQ_CaIP_HKOjRRbERtMWWfGB8ysI7oyMLgsYLL4ZPoQUi4sriyPs8FwfpFt0lQFWsdGovnRV61CODqIyCC4hZtmGaZzUMslrTgfY
2025-03-27 21:14:26 UTC	1000	IN	Data Raw: 52 73 70 51 6e 64 72 78 72 35 67 5f 4d 4d 6e 70 74 33 77 6c 49 4c 72 36 7a 43 51 4e 56 58 6a 48 6c 7a 61 39 6c 39 4b 68 4c 35 4a 76 64 5a 2d 30 4a 70 45 77 4b 6d 4c 61 45 43 79 6f 53 44 30 66 33 64 7a 35 69 39 33 6f 69 44 5a 78 36 65 62 33 36 56 37 38 68 47 34 56 30 6b 31 4b 73 6f 76 63 37 52 71 75 4f 44 63 46 6d 55 5f 4f 54 68 6d 48 48 32 4b 73 6f 35 32 71 4c 6c 5f 4a 75 77 74 50 4a 6c 69 42 58 46 33 39 4f 47 59 5f 35 69 45 69 30 6e 54 5f 71 69 4a 35 6c 33 6b 5a 65 6f 36 33 2d 65 77 74 6f 43 4c 5a 68 53 58 37 4b 57 4e 72 71 62 78 41 45 6b 52 32 36 58 4f 66 48 33 51 69 64 45 31 69 51 68 77 64 6e 70 50 39 63 6f 6a 37 58 6e 68 34 6a 72 4d 6c 61 6b 42 66 50 68 70 6d 4f 34 48 35 67 4e 31 44 77 58 67 54 39 4f 57 72 77 44 6a 38 71 6f 43 77 6f 4c 2d 4d 51 31 4f Data Ascii: RspQndrxr5g_MMnpt3wlILr6zCQNVXjHlza9l9KhL5JvdZ-0JpEwKmLaECyoSD0f3dz5i93oiDZx6eb36V78hG4V0k1Ksovc7RquODcFmU_OThmHH2Kso52qLl_JuwtPJliBXF39OGY_5iEi0nT_qiJ5l3kZeo63-ewtoCLZhSX7KWNrqbxAEkR26XOfH3QidE1iQhwdnpP9coj7Xnh4jrMlakBfPhpmO4H5gN1DwXgT9OWrwDj8qoCwoL-MQ1O
2025-03-27 21:14:26 UTC	1000	IN	Data Raw: 31 62 6d 4e 30 61 57 39 75 4b 45 63 70 65 33 4a 6c 64 48 56 79 62 69 42 53 4c 6d 4e 79 5a 57 46 30 5a 56 4e 6a 63 6d 6c 77 64 43 68 48 4b 58 30 36 5a 6e 56 75 59 33 52 70 62 32 34 6f 52 79 6c 37 63 6d 56 30 64 58 4a 75 49 69 49 72 52 33 31 39 4b 48 67 70 4b 45 46 79 63 6d 46 35 4b 45 31 68 64 47 67 75 63 6d 46 75 5a 47 39 74 4b 43 6b 71 4e 7a 67 79 4e 48 77 77 4b 53 35 71 62 32 6c 75 4b 43 4a 63 62 69 49 70 4b 31 73 6e 4b 47 5a 31 62 6d 4e 30 61 57 39 75 4b 43 6c 37 4c 79 6f 6e 4c 41 6f 6e 4a 79 77 4b 4a 79 42 44 62 33 42 35 63 6d 6c 6e 61 48 51 67 52 32 39 76 5a 32 78 6c 49 45 78 4d 51 79 63 73 43 69 63 67 55 31 42 45 57 43 31 4d 61 57 4e 6c 62 6e 4e 6c 4c 55 6c 6b 5a 57 35 30 61 57 5a 70 5a 58 49 36 49 45 46 77 59 57 4e 6f 5a 53 30 79 4c 6a 41 6e 4c 41 Data Ascii: 1bmN0aW9uKEcpe3JldHVybiBSLmNyZWF0ZVNjcmlwdChHKX06ZnVuY3Rpb24oRyl7cmV0dXJuIiIrR319KHgpKEFycmF5KE1hdGgucmFuZG9tKCkqNzgyNHwwKS5qb2luKCJcbiIpK1snKGZ1bmN0aW9uKCl7LyonLAonJywKJyBDb3B5cmlnaHQgR29vZ2xlIExMQycsCicgU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAnLA
2025-03-27 21:14:26 UTC	1000	IN	Data Raw: 70 4b 53 78 4c 4b 53 35 51 52 54 31 6e 4b 47 73 70 4c 45 73 70 4c 6c 59 39 57 31 30 73 61 79 35 7a 50 54 31 72 50 79 68 78 4b 47 73 70 66 44 41 70 4c 54 45 36 4d 53 6b 73 5a 79 68 72 4b 53 6b 73 4d 43 6b 37 65 54 78 33 4f 33 6b 72 4b 79 6c 4c 4c 6c 59 75 63 48 56 7a 61 43 68 6e 4b 47 73 70 4b 54 74 6d 62 33 49 6f 4f 33 63 74 4c 54 73 70 53 79 35 57 57 33 64 64 50 57 59 6f 61 79 78 4c 4c 6c 5a 62 64 31 30 70 4f 33 4a 6c 64 48 56 79 62 69 42 4c 4c 6e 4a 36 50 57 59 6f 61 79 78 53 4b 53 78 4c 4c 6d 74 49 50 57 59 6f 61 79 78 48 4b 53 78 4c 66 53 78 4a 50 57 5a 31 62 6d 4e 30 61 57 39 75 4b 47 73 73 52 79 78 53 4c 45 73 73 65 53 78 33 4b 58 74 70 5a 69 68 72 4c 6e 4d 39 50 57 73 70 5a 6d 39 79 4b 48 6b 39 5a 69 68 72 4c 46 49 70 4c 46 49 39 50 54 49 30 4d 48 Data Ascii: pKSxLKS5QRT1nKGspLEspLlY9W10say5zPT1rPyhxKGspfDApLTE6MSksZyhrKSksMCk7eTx3O3krKylLLlYucHVzaChnKGspKTtmb3IoO3ctLTspSy5WW3ddPWYoayxLLlZbd10pO3JldHVybiBLLnJ6PWYoayxSKSxLLmtIPWYoayxHKSxLfSxJPWZ1bmN0aW9uKGssRyxSLEsseSx3KXtpZihrLnM9PWspZm9yKHk9ZihrLFIpLFI9PTI0MH
2025-03-27 21:14:26 UTC	1000	IN	Data Raw: 2b 50 6a 45 79 4a 6a 59 7a 66 44 45 79 4f 43 6b 36 53 31 74 48 4b 79 74 64 50 56 49 2b 50 6a 45 79 66 44 49 79 4e 43 78 4c 57 30 63 72 4b 31 30 39 55 6a 34 2b 4e 69 59 32 4d 33 77 78 4d 6a 67 70 4c 45 74 62 52 79 73 72 58 54 31 53 4a 6a 59 7a 66 44 45 79 4f 43 6b 37 63 6d 56 30 64 58 4a 75 49 45 74 39 4c 47 6b 35 50 57 5a 31 62 6d 4e 30 61 57 39 75 4b 47 73 73 52 79 78 53 4c 45 73 70 65 30 6b 6f 61 79 77 6f 55 6a 31 6e 4b 43 68 4c 50 57 63 6f 61 79 6b 73 61 79 6b 70 4c 46 41 70 4b 47 59 6f 61 79 78 4c 4b 53 78 48 4b 53 78 53 4b 58 30 73 64 30 59 39 5a 6e 56 75 59 33 52 70 62 32 34 6f 61 79 78 48 4c 46 49 73 53 79 78 35 4b 58 74 6d 64 57 35 6a 64 47 6c 76 62 69 42 33 4b 43 6c 37 66 58 4a 6c 64 48 56 79 62 6e 74 70 62 6e 5a 76 61 32 55 36 5a 6e 56 75 59 33 Data Ascii: +PjEyJjYzfDEyOCk6S1tHKytdPVI+PjEyfDIyNCxLW0crK109Uj4+NiY2M3wxMjgpLEtbRysrXT1SJjYzfDEyOCk7cmV0dXJuIEt9LGk5PWZ1bmN0aW9uKGssRyxSLEspe0koaywoUj1nKChLPWcoayksaykpLFApKGYoayxLKSxHKSxSKX0sd0Y9ZnVuY3Rpb24oayxHLFIsSyx5KXtmdW5jdGlvbiB3KCl7fXJldHVybntpbnZva2U6ZnVuY3

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:26 UTC	1390	OUT	GET /recaptcha/api2/payload?p=06AFcWeA5zLfzmt2tXhoe-TMIBecUea73PBNjshX5vlZ6LYYle8GHkle3x7gF6Yfs83DdQNUhjLofZDO7wGGdmM-ipMnJpscYBxAQsqFTWJY47pAOv9OW3MY2T7_4n1ZRqd1d92U2jPLLhioe1JX1SPpXwZa30T4gXRGlUC76TNj8qlTAV_BgGYotjQmRSsg6ZzhN9UNRZBrHP&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09ALcxeyoS_lwAUydnwU18OSVt6KKV04DvZw1FlcP23RAXt7iibAhS5mqCNW-rHIXfuiGDhQiOMJjNNW8qXW6N8x0; NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
2025-03-27 21:14:26 UTC	681	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 27 Mar 2025 21:14:26 GMT Date: Thu, 27 Mar 2025 21:14:26 GMT Cache-Control: private, max-age=30 Cross-Origin-Resource-Policy: same-site Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-27 21:14:26 UTC	316	IN	Data Raw: 37 66 36 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7f67JFIFC!"$"$C,,"}!1AQa"q
2025-03-27 21:14:26 UTC	997	IN	Data Raw: 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 Data Ascii: ijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2025-03-27 21:14:26 UTC	997	IN	Data Raw: d1 a3 b0 5b d2 f2 5a fc c5 ed d3 2d b7 86 8d 4b 60 80 3e 63 91 c1 e3 9e c6 bc bc ca 3c dc bf 3f d0 0e 73 c4 7a 4d fd ad 94 91 89 64 b8 8a 25 47 f3 36 e5 15 98 67 0d d7 9e d9 f6 ac bf 86 06 e2 3d 5d 64 82 65 5b b7 6c a0 8c ed 65 e4 9d c3 f2 35 b5 17 8c 34 9d 46 d9 b4 f9 e7 36 f7 e8 e6 28 42 ab 00 c9 b8 ee 56 1d 07 19 ce 4f 76 a8 7c 05 63 73 2e b8 b2 da da 86 91 6e 16 25 65 fb 87 ea 7a 83 fa f3 5c b4 e3 27 0e 57 a1 94 da 5b 1f 5d 78 3a 2b 71 a2 c5 2c 4b 18 99 d4 7d a0 a7 00 c9 8c 9e be a4 e7 f1 ad 72 b5 4f c3 50 2c 5a 2d b3 2c 61 1e 58 d6 49 3d 49 20 72 7f 4a d0 db cd 7d 0b 7e 66 11 5a 10 15 e7 a5 1b 3d aa 72 94 9b 39 a5 71 d8 80 a7 b5 1b 3d aa c6 ca 36 52 e6 1d 8a e5 3d a9 02 7b 55 92 bd a8 d8 68 b8 58 af b2 80 9c 55 8d b4 f1 0f 1f 33 00 7d e9 39 02 8d ce Data Ascii: [Z-K`>c<?szMd%G6g=]de[le54F6(BVOv\|cs.n%ez\'W[]x:+q,K}rOP,Z-,aXI=I rJ}~fZ=r9q=6R={UhXU3}9
2025-03-27 21:14:26 UTC	997	IN	Data Raw: 3b f9 0f 5e fc 01 5a dc 8b 18 c3 b1 24 92 73 9e 69 72 36 af f2 06 b5 4e b7 a4 27 fa bf 0a d8 1f 79 2e 26 6f fd 98 52 af 88 6d 94 ed 8f c3 ba 20 c9 e8 d1 c8 c7 f5 7a 39 82 c6 41 70 0e 01 a8 7c 2e 24 8e 4b 95 bf 8d da e6 7f f4 67 24 e1 7a 9e 84 70 4f 00 e7 9a de 1e 26 90 0f dd 69 1a 32 71 da c9 5b f5 39 ab b3 59 4d 73 73 14 69 69 24 2a d1 89 1d 63 1e 52 82 a3 1c 73 c8 e8 7d eb c8 cd 27 65 15 eb fa 0e c7 99 78 87 4e d0 ac 35 dd 90 5b 14 bd 6c 4a 00 66 6c 36 f3 9e fd c6 46 31 d4 76 ef df f8 72 f2 0b 09 22 d4 ac ae 65 b6 de cc d1 85 c1 59 18 29 23 9c 67 39 e3 fc 9a e4 ff 00 e1 1e f1 0f 89 3c 51 2e bd e2 0d 2e 58 ed 50 30 90 a3 a8 3d 4e 38 fc ce 31 e8 2b d0 74 ed 37 fb 3b 49 16 72 79 53 02 a8 23 89 81 1c 1c 9c 9c 67 07 3b 70 7a 83 cf 6a e1 95 65 1b 24 c5 c9 73 Data Ascii: ;^Z$sir6N'y.&oRm z9Ap\|.$Kg$zpO&i2q[9YMssii$*cRs}'exN5[lJfl6F1vr"eY)#g9<Q..XP0=N81+t7;IryS#g;pzje$s
2025-03-27 21:14:26 UTC	997	IN	Data Raw: 9f 51 d4 fa f3 52 ea 45 34 ae 4b 83 5b 9e 8f a9 ac 7e 17 ba 9c 68 3a fd b5 b2 c3 18 73 a5 5f 4a 5e 26 27 27 08 c4 ee 8f 8c 70 32 39 e8 2a 0f 16 f8 ca ca 6f 05 eb 5a 7e ad 04 ba 3e a5 36 9b 30 8a 1b 82 0a 4d 98 c8 1e 5c 83 e5 70 72 3f 3a f9 c3 c7 3e 38 d7 75 0f 13 6a b7 91 de b6 c9 2f 25 f2 d5 5b e5 58 c1 f9 40 ee 40 5c 0f a5 77 be 2d f8 b1 63 ae f8 2a 3f 0f dd d9 09 e6 16 91 66 79 5b 6b 19 c6 01 65 03 8c f7 c6 7d 6b 6e 68 d9 10 a3 3e a7 bc f8 52 58 e2 f0 56 91 2b 38 09 1e 9d 09 63 9e 98 8d 73 56 5b 54 d3 83 46 ad 7f 6e ad 24 7e 6a 03 20 04 a7 a8 f6 af 90 26 f8 85 e2 08 2c ae 34 b5 bc 97 ec 6e d8 08 e0 30 00 02 bc 7a 71 c5 73 ff 00 db b7 9f 6a 56 4b 89 b7 81 f2 9d e7 20 67 3e be a2 b3 75 75 d8 ae 43 e8 3f da 52 e6 27 b7 d1 7e ce c2 79 e3 69 e4 8d 51 86 58 Data Ascii: QRE4K[~h:s_J^&''p29oZ~>60M\pr?:>8uj/%[X@@\w-c?fy[ke}knh>RXV+8csV[TFn$~j &,4n0zqsjVK g>uuC?R'~yiQX
2025-03-27 21:14:26 UTC	997	IN	Data Raw: e7 20 dd 09 21 89 e5 08 84 7c bb 36 85 eb f4 ce 7f 5e 68 f8 65 76 1e d9 52 5b 84 9e 4d 8c 3c b0 30 50 7c a7 8f 4f ba 7e a3 35 6a 3e ee c5 76 1b e2 e9 6e 2e b4 4d 40 5c 5b 32 5c ca a8 63 11 9d de 6c 43 1c 1e b8 3b 86 ee bd c8 a8 ac e6 8f 53 d7 12 50 e0 c1 61 16 d5 1d 8c a4 0c 9f c0 7f 3a bf e3 09 85 a8 86 d7 2b 25 ba 2b e1 63 7d e1 8e ec 85 1c 8c 8e 9e bd ce 6b 89 d5 34 8f 2b 12 d8 ea 97 16 e9 3b 79 9e 5e e6 f9 81 24 31 1c 8c 9d c2 bb f0 35 e2 ef 4e 5a 0d b7 72 ec 57 f6 f3 5a 26 90 65 da 1e e6 56 9f 1c 9d 8a e7 8c 7b 9c 56 4e b7 7c b3 78 8e 21 08 23 f7 4b 8c 1c 10 46 ee dd ba d6 04 d6 b1 45 33 27 9c e6 73 cb 1c 75 cf f3 eb fa d4 ab 61 10 58 a5 81 f6 4c 24 db 90 17 95 3e 83 19 15 ea a9 c3 9a e4 3b b4 ce b3 c1 d7 56 44 dc c3 73 2c 41 1e 34 0c 1d 80 07 e5 20 Data Ascii: !\|6^hevR[M<0P\|O~5j>vn.M@\[2\clC;SPa:+%+c}k4+;y^$15NZrWZ&eV{VN\|x!#KFE3'suaXL$>;VDs,A4
2025-03-27 21:14:26 UTC	997	IN	Data Raw: e6 4a 31 52 72 ea ce 2a ee ed 92 e2 68 64 85 7c c5 62 ae 3d 0e 79 1f ce b1 ef 27 f2 af 70 b9 0b 81 91 8c 7e 55 df 0f 84 5e 37 d4 a3 82 4b 28 96 e2 39 93 7f 9f 92 4b 6e 24 82 d8 07 1c 11 d4 d5 cb 9f 81 3a e5 b4 84 5c 6b 50 bc 8a 40 75 5b 49 99 b9 ee 38 e4 7b d6 6a 94 93 d8 d5 cd 59 26 ca 1f 0c 6f da 2d 3f 57 8a da 4d b2 48 21 8d 49 19 c6 ef 30 13 9f 4e 7f 5a e8 75 ad 36 e7 c3 f0 c3 71 25 c1 12 dc 43 21 b2 b4 12 04 b8 97 62 e5 88 18 e4 1c 01 b8 f4 ed de 99 e1 fd 03 41 f0 6c f7 b7 b7 7a 9f db 5b 4a 8c cd 7b 18 89 a2 db 20 ce c5 2a c3 ae 32 31 eb c1 ce 6b 14 db eb 7e 20 9c f8 ae ec ab ea d3 ca b3 2a b9 23 c8 81 72 56 28 c7 a6 38 3f 89 e6 b8 6b 52 fd ed e4 f4 ec 6b 4e 37 39 91 a2 ea 5e 25 d4 9f 51 ba ba 8a c4 4a d8 50 e8 5a 53 ec 4b 70 38 03 8e 3b 57 46 fe 0d Data Ascii: J1Rrhd\|b=y'p~U^7K(9Kn$:\kP@u[I8{jY&o-?WMH!I0NZu6q%C!bAlz[J{ 21k~ *#rV(8?kRkN79^%QJPZSKp8;WF
2025-03-27 21:14:26 UTC	997	IN	Data Raw: f3 0e 06 08 c9 fb bf 4c 01 eb 5d 7e ab 6d a0 c9 27 da ac 75 3b 3b 87 78 63 73 17 47 88 b0 2c 15 bd c6 30 48 e3 a7 a8 ac ed 7f c2 70 d9 69 33 6a 0a cc 92 c7 22 2c 2a 7e e9 05 80 fc f9 af 52 15 6f 38 a9 2b 17 3a 16 8b 71 77 38 6f 1b df da a5 d2 c1 05 d3 bb 34 4c e4 2c 5b 7c 99 33 90 a3 d7 d0 9f d2 b3 bc 3f ae bd ad bd de f9 e4 32 00 4a 0c 6f 52 c7 d4 1f e7 da ba 3f 89 9a 1d 95 88 17 af 6b 33 a3 44 8d 24 80 e3 32 15 fe 13 d9 79 19 fa 57 9f 42 d1 4a 18 a0 68 c3 30 04 93 9c 1e 6b aa d0 a8 9d b6 39 9c 65 0d ce 83 4f d6 35 3b 9b df 32 59 86 d5 52 0a b3 61 48 cf ff 00 5e a6 b2 d4 ed ae ef e3 8b 54 40 8b 11 65 2c a3 2d 8e 06 d2 7d 06 3e b4 cf 03 e8 f0 de df cd f6 ab 94 81 62 18 60 58 64 b1 38 c2 f3 d7 bf e1 5d 65 cf 83 3c 3b a4 c4 d7 a9 ad 49 73 30 20 c6 81 14 ed Data Ascii: L]~m'u;;xcsG,0Hpi3j",*~Ro8+:qw8o4L,[\|3?2JoR?k3D$2yWBJh0k9eO5;2YRaH^T@e,-}>b`Xd8]e<;Is0
2025-03-27 21:14:26 UTC	997	IN	Data Raw: cc 91 ea 17 72 5c 89 ad b2 d1 cc 09 dc 83 d8 2d 29 56 5b 5d 9a d3 72 83 bd 97 cc f0 bb 9d 5b fb 62 d7 ec 39 80 cb a8 6a 36 e9 74 f1 c7 b5 a5 19 77 25 8f f1 1c 81 cd 7a ba 41 6a 36 a9 86 42 14 70 07 1d 3f 1a e1 fc 7d 69 e1 fd 13 56 d2 2e ac d7 53 94 7f 68 22 c9 25 cb 94 04 61 b0 54 1c 9c 72 73 d0 d7 70 f1 ae ec 84 56 1c 75 6c fd 08 35 c7 36 a5 a9 d1 19 f3 6b 62 29 c5 b5 9e e2 27 db 6f 2f df 5d c4 b4 4e 78 dd 8f 43 dc 7e 23 d0 bd 62 f2 ee 99 01 8e 50 51 48 2b 20 60 47 38 3f 95 36 f8 a4 f6 8e 92 41 1b c6 aa 72 73 83 d3 3d 01 ac fd 27 4d 8e 0b f9 67 92 ed 8b ce 3f 76 0a 2a aa f4 e9 81 50 3b bb 9a 21 61 f3 36 bc 2b ed fb cc d7 3b e2 58 d2 df c6 9e 1e bf 80 03 e6 4c 6d d8 29 eb b9 18 73 9f f8 0d 74 f1 c6 c7 e4 72 73 d3 68 e7 f2 ac bd 7f 48 d5 b5 2f 13 e8 09 67 Data Ascii: r\-)V[]r[b9j6tw%zAj6Bp?}iV.Sh"%aTrspVul56kb)'o/]NxC~#bPQH+ `G8?6Ars='Mg?v*P;!a6+;XLm)strshH/g
2025-03-27 21:14:26 UTC	997	IN	Data Raw: 55 a9 f3 a4 be 04 d6 f4 3b d5 67 99 0d ba 67 6c e8 37 29 fa 8e df 8d 68 da 5c eb 37 b2 f9 11 df 65 1d 42 cc 43 61 48 1c 60 0c 73 d7 bd 7b 35 fd ab 17 31 a4 9b 72 a7 07 86 5a e5 75 9d 18 af 98 1e 18 96 39 3e f7 92 9b 47 d7 02 ba e9 e3 ae fd ed ce 4a b8 25 17 78 9c f7 84 56 d5 2f a3 b5 d5 35 68 ed f0 44 81 1b 9f 98 f5 07 1d 32 00 e6 ab eb 7a 84 16 7a 9c d0 89 e1 62 1b 27 04 1e 7b f3 c7 f2 ad 5b 3f 0e 69 56 d2 82 e9 3e d3 c9 61 8c 01 f9 56 a1 f0 ee 9f 22 46 f1 5c 08 d0 a0 20 14 0f db d7 35 b7 34 1c af 26 12 8a e5 b4 63 af a9 97 6f f1 43 c0 97 d2 66 e3 c3 b7 f6 cc 4e 77 c5 c6 0f d0 10 2a d8 d7 34 1d 58 11 a0 5e 5d ac b1 fc cf 0c a3 1f 21 3c 11 f4 e8 45 78 9e 9a a1 50 89 58 73 83 d3 91 56 ed b5 d8 ec f5 68 a1 8e e1 ed dc 83 13 94 e1 82 38 fb c3 b6 41 03 1f 5a Data Ascii: U;ggl7)h\7eBCaH`s{51rZu9>GJ%xV/5hD2zzb'{[?iV>aV"F\ 54&coCfNw*4X^]!<ExPXsVh8AZ

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:26 UTC	847	OUT	GET /recaptcha/api2/reload?k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09ALcxeyoS_lwAUydnwU18OSVt6KKV04DvZw1FlcP23RAXt7iibAhS5mqCNW-rHIXfuiGDhQiOMJjNNW8qXW6N8x0; NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
2025-03-27 21:14:26 UTC	743	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 27 Mar 2025 21:14:26 GMT Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Allow: POST Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-27 21:14:26 UTC	254	IN	Data Raw: 36 38 30 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 Data Ascii: 680<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 405 (Bad Request)!!1</title><style>*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{backgr
2025-03-27 21:14:26 UTC	997	IN	Data Raw: 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 3b 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 Data Ascii: ound:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11p
2025-03-27 21:14:26 UTC	420	IN	Data Raw: 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 61 69 6e 20 69 64 3d 22 61 66 2d 65 72 72 6f 72 2d 63 6f 6e 74 61 69 6e 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 3e 3c 73 70 61 6e 20 69 64 3d 6c 6f 67 6f 20 61 72 69 61 2d 6c 61 62 65 6c 3d 47 6f 6f 67 6c 65 20 72 6f 6c 65 3d 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 35 2e 3c 2f Data Ascii: color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}</style><main id="af-error-container" role="main"><a href=//www.google.com><span id=logo aria-label=Google role=img></span></a><p><b>405.</
2025-03-27 21:14:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-27 21:14:27 UTC	1057	OUT	GET /recaptcha/api2/payload?p=06AFcWeA5zLfzmt2tXhoe-TMIBecUea73PBNjshX5vlZ6LYYle8GHkle3x7gF6Yfs83DdQNUhjLofZDO7wGGdmM-ipMnJpscYBxAQsqFTWJY47pAOv9OW3MY2T7_4n1ZRqd1d92U2jPLLhioe1JX1SPpXwZa30T4gXRGlUC76TNj8qlTAV_BgGYotjQmRSsg6ZzhN9UNRZBrHP&k=6Lc2rv8qAAAAACfkQkt3Nwlp5Vf_td4s9He3nU_H HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI5+TOAQ== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09ALcxeyoS_lwAUydnwU18OSVt6KKV04DvZw1FlcP23RAXt7iibAhS5mqCNW-rHIXfuiGDhQiOMJjNNW8qXW6N8x0; NID=522=RblzzbgXItBXAcO4XMyj2NrogNw6Mc7ypJH0By9pC0bWMuuTBpS0P182Yj42DoK8gXWih1NpSwyekWM9ZUHSkYCr3s13y3xWTzyy6nD1jg7b7mEihDyn0Sr4lfvUWv3Jzv5WRlDPE7IgA_wfqm4lAz28B8Jdxvsf0O5uK2eollijaCl3KP6jCVZeZp1B4GjNajCDL8pz6zArDutOd6k
2025-03-27 21:14:27 UTC	681	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Expires: Thu, 27 Mar 2025 21:14:27 GMT Date: Thu, 27 Mar 2025 21:14:27 GMT Cache-Control: private, max-age=30 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Cross-Origin-Resource-Policy: same-site Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-27 21:14:27 UTC	316	IN	Data Raw: 37 66 36 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 11 18 21 18 1a 1c 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7f67JFIFC!"$"$C,,"}!1AQa"q
2025-03-27 21:14:27 UTC	997	IN	Data Raw: 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 Data Ascii: ijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2025-03-27 21:14:27 UTC	997	IN	Data Raw: d1 a3 b0 5b d2 f2 5a fc c5 ed d3 2d b7 86 8d 4b 60 80 3e 63 91 c1 e3 9e c6 bc bc ca 3c dc bf 3f d0 0e 73 c4 7a 4d fd ad 94 91 89 64 b8 8a 25 47 f3 36 e5 15 98 67 0d d7 9e d9 f6 ac bf 86 06 e2 3d 5d 64 82 65 5b b7 6c a0 8c ed 65 e4 9d c3 f2 35 b5 17 8c 34 9d 46 d9 b4 f9 e7 36 f7 e8 e6 28 42 ab 00 c9 b8 ee 56 1d 07 19 ce 4f 76 a8 7c 05 63 73 2e b8 b2 da da 86 91 6e 16 25 65 fb 87 ea 7a 83 fa f3 5c b4 e3 27 0e 57 a1 94 da 5b 1f 5d 78 3a 2b 71 a2 c5 2c 4b 18 99 d4 7d a0 a7 00 c9 8c 9e be a4 e7 f1 ad 72 b5 4f c3 50 2c 5a 2d b3 2c 61 1e 58 d6 49 3d 49 20 72 7f 4a d0 db cd 7d 0b 7e 66 11 5a 10 15 e7 a5 1b 3d aa 72 94 9b 39 a5 71 d8 80 a7 b5 1b 3d aa c6 ca 36 52 e6 1d 8a e5 3d a9 02 7b 55 92 bd a8 d8 68 b8 58 af b2 80 9c 55 8d b4 f1 0f 1f 33 00 7d e9 39 02 8d ce Data Ascii: [Z-K`>c<?szMd%G6g=]de[le54F6(BVOv\|cs.n%ez\'W[]x:+q,K}rOP,Z-,aXI=I rJ}~fZ=r9q=6R={UhXU3}9
2025-03-27 21:14:27 UTC	997	IN	Data Raw: 3b f9 0f 5e fc 01 5a dc 8b 18 c3 b1 24 92 73 9e 69 72 36 af f2 06 b5 4e b7 a4 27 fa bf 0a d8 1f 79 2e 26 6f fd 98 52 af 88 6d 94 ed 8f c3 ba 20 c9 e8 d1 c8 c7 f5 7a 39 82 c6 41 70 0e 01 a8 7c 2e 24 8e 4b 95 bf 8d da e6 7f f4 67 24 e1 7a 9e 84 70 4f 00 e7 9a de 1e 26 90 0f dd 69 1a 32 71 da c9 5b f5 39 ab b3 59 4d 73 73 14 69 69 24 2a d1 89 1d 63 1e 52 82 a3 1c 73 c8 e8 7d eb c8 cd 27 65 15 eb fa 0e c7 99 78 87 4e d0 ac 35 dd 90 5b 14 bd 6c 4a 00 66 6c 36 f3 9e fd c6 46 31 d4 76 ef df f8 72 f2 0b 09 22 d4 ac ae 65 b6 de cc d1 85 c1 59 18 29 23 9c 67 39 e3 fc 9a e4 ff 00 e1 1e f1 0f 89 3c 51 2e bd e2 0d 2e 58 ed 50 30 90 a3 a8 3d 4e 38 fc ce 31 e8 2b d0 74 ed 37 fb 3b 49 16 72 79 53 02 a8 23 89 81 1c 1c 9c 9c 67 07 3b 70 7a 83 cf 6a e1 95 65 1b 24 c5 c9 73 Data Ascii: ;^Z$sir6N'y.&oRm z9Ap\|.$Kg$zpO&i2q[9YMssii$*cRs}'exN5[lJfl6F1vr"eY)#g9<Q..XP0=N81+t7;IryS#g;pzje$s
2025-03-27 21:14:27 UTC	997	IN	Data Raw: 9f 51 d4 fa f3 52 ea 45 34 ae 4b 83 5b 9e 8f a9 ac 7e 17 ba 9c 68 3a fd b5 b2 c3 18 73 a5 5f 4a 5e 26 27 27 08 c4 ee 8f 8c 70 32 39 e8 2a 0f 16 f8 ca ca 6f 05 eb 5a 7e ad 04 ba 3e a5 36 9b 30 8a 1b 82 0a 4d 98 c8 1e 5c 83 e5 70 72 3f 3a f9 c3 c7 3e 38 d7 75 0f 13 6a b7 91 de b6 c9 2f 25 f2 d5 5b e5 58 c1 f9 40 ee 40 5c 0f a5 77 be 2d f8 b1 63 ae f8 2a 3f 0f dd d9 09 e6 16 91 66 79 5b 6b 19 c6 01 65 03 8c f7 c6 7d 6b 6e 68 d9 10 a3 3e a7 bc f8 52 58 e2 f0 56 91 2b 38 09 1e 9d 09 63 9e 98 8d 73 56 5b 54 d3 83 46 ad 7f 6e ad 24 7e 6a 03 20 04 a7 a8 f6 af 90 26 f8 85 e2 08 2c ae 34 b5 bc 97 ec 6e d8 08 e0 30 00 02 bc 7a 71 c5 73 ff 00 db b7 9f 6a 56 4b 89 b7 81 f2 9d e7 20 67 3e be a2 b3 75 75 d8 ae 43 e8 3f da 52 e6 27 b7 d1 7e ce c2 79 e3 69 e4 8d 51 86 58 Data Ascii: QRE4K[~h:s_J^&''p29oZ~>60M\pr?:>8uj/%[X@@\w-c?fy[ke}knh>RXV+8csV[TFn$~j &,4n0zqsjVK g>uuC?R'~yiQX
2025-03-27 21:14:27 UTC	997	IN	Data Raw: e7 20 dd 09 21 89 e5 08 84 7c bb 36 85 eb f4 ce 7f 5e 68 f8 65 76 1e d9 52 5b 84 9e 4d 8c 3c b0 30 50 7c a7 8f 4f ba 7e a3 35 6a 3e ee c5 76 1b e2 e9 6e 2e b4 4d 40 5c 5b 32 5c ca a8 63 11 9d de 6c 43 1c 1e b8 3b 86 ee bd c8 a8 ac e6 8f 53 d7 12 50 e0 c1 61 16 d5 1d 8c a4 0c 9f c0 7f 3a bf e3 09 85 a8 86 d7 2b 25 ba 2b e1 63 7d e1 8e ec 85 1c 8c 8e 9e bd ce 6b 89 d5 34 8f 2b 12 d8 ea 97 16 e9 3b 79 9e 5e e6 f9 81 24 31 1c 8c 9d c2 bb f0 35 e2 ef 4e 5a 0d b7 72 ec 57 f6 f3 5a 26 90 65 da 1e e6 56 9f 1c 9d 8a e7 8c 7b 9c 56 4e b7 7c b3 78 8e 21 08 23 f7 4b 8c 1c 10 46 ee dd ba d6 04 d6 b1 45 33 27 9c e6 73 cb 1c 75 cf f3 eb fa d4 ab 61 10 58 a5 81 f6 4c 24 db 90 17 95 3e 83 19 15 ea a9 c3 9a e4 3b b4 ce b3 c1 d7 56 44 dc c3 73 2c 41 1e 34 0c 1d 80 07 e5 20 Data Ascii: !\|6^hevR[M<0P\|O~5j>vn.M@\[2\clC;SPa:+%+c}k4+;y^$15NZrWZ&eV{VN\|x!#KFE3'suaXL$>;VDs,A4
2025-03-27 21:14:27 UTC	997	IN	Data Raw: e6 4a 31 52 72 ea ce 2a ee ed 92 e2 68 64 85 7c c5 62 ae 3d 0e 79 1f ce b1 ef 27 f2 af 70 b9 0b 81 91 8c 7e 55 df 0f 84 5e 37 d4 a3 82 4b 28 96 e2 39 93 7f 9f 92 4b 6e 24 82 d8 07 1c 11 d4 d5 cb 9f 81 3a e5 b4 84 5c 6b 50 bc 8a 40 75 5b 49 99 b9 ee 38 e4 7b d6 6a 94 93 d8 d5 cd 59 26 ca 1f 0c 6f da 2d 3f 57 8a da 4d b2 48 21 8d 49 19 c6 ef 30 13 9f 4e 7f 5a e8 75 ad 36 e7 c3 f0 c3 71 25 c1 12 dc 43 21 b2 b4 12 04 b8 97 62 e5 88 18 e4 1c 01 b8 f4 ed de 99 e1 fd 03 41 f0 6c f7 b7 b7 7a 9f db 5b 4a 8c cd 7b 18 89 a2 db 20 ce c5 2a c3 ae 32 31 eb c1 ce 6b 14 db eb 7e 20 9c f8 ae ec ab ea d3 ca b3 2a b9 23 c8 81 72 56 28 c7 a6 38 3f 89 e6 b8 6b 52 fd ed e4 f4 ec 6b 4e 37 39 91 a2 ea 5e 25 d4 9f 51 ba ba 8a c4 4a d8 50 e8 5a 53 ec 4b 70 38 03 8e 3b 57 46 fe 0d Data Ascii: J1Rrhd\|b=y'p~U^7K(9Kn$:\kP@u[I8{jY&o-?WMH!I0NZu6q%C!bAlz[J{ 21k~ *#rV(8?kRkN79^%QJPZSKp8;WF
2025-03-27 21:14:27 UTC	997	IN	Data Raw: f3 0e 06 08 c9 fb bf 4c 01 eb 5d 7e ab 6d a0 c9 27 da ac 75 3b 3b 87 78 63 73 17 47 88 b0 2c 15 bd c6 30 48 e3 a7 a8 ac ed 7f c2 70 d9 69 33 6a 0a cc 92 c7 22 2c 2a 7e e9 05 80 fc f9 af 52 15 6f 38 a9 2b 17 3a 16 8b 71 77 38 6f 1b df da a5 d2 c1 05 d3 bb 34 4c e4 2c 5b 7c 99 33 90 a3 d7 d0 9f d2 b3 bc 3f ae bd ad bd de f9 e4 32 00 4a 0c 6f 52 c7 d4 1f e7 da ba 3f 89 9a 1d 95 88 17 af 6b 33 a3 44 8d 24 80 e3 32 15 fe 13 d9 79 19 fa 57 9f 42 d1 4a 18 a0 68 c3 30 04 93 9c 1e 6b aa d0 a8 9d b6 39 9c 65 0d ce 83 4f d6 35 3b 9b df 32 59 86 d5 52 0a b3 61 48 cf ff 00 5e a6 b2 d4 ed ae ef e3 8b 54 40 8b 11 65 2c a3 2d 8e 06 d2 7d 06 3e b4 cf 03 e8 f0 de df cd f6 ab 94 81 62 18 60 58 64 b1 38 c2 f3 d7 bf e1 5d 65 cf 83 3c 3b a4 c4 d7 a9 ad 49 73 30 20 c6 81 14 ed Data Ascii: L]~m'u;;xcsG,0Hpi3j",*~Ro8+:qw8o4L,[\|3?2JoR?k3D$2yWBJh0k9eO5;2YRaH^T@e,-}>b`Xd8]e<;Is0
2025-03-27 21:14:27 UTC	997	IN	Data Raw: cc 91 ea 17 72 5c 89 ad b2 d1 cc 09 dc 83 d8 2d 29 56 5b 5d 9a d3 72 83 bd 97 cc f0 bb 9d 5b fb 62 d7 ec 39 80 cb a8 6a 36 e9 74 f1 c7 b5 a5 19 77 25 8f f1 1c 81 cd 7a ba 41 6a 36 a9 86 42 14 70 07 1d 3f 1a e1 fc 7d 69 e1 fd 13 56 d2 2e ac d7 53 94 7f 68 22 c9 25 cb 94 04 61 b0 54 1c 9c 72 73 d0 d7 70 f1 ae ec 84 56 1c 75 6c fd 08 35 c7 36 a5 a9 d1 19 f3 6b 62 29 c5 b5 9e e2 27 db 6f 2f df 5d c4 b4 4e 78 dd 8f 43 dc 7e 23 d0 bd 62 f2 ee 99 01 8e 50 51 48 2b 20 60 47 38 3f 95 36 f8 a4 f6 8e 92 41 1b c6 aa 72 73 83 d3 3d 01 ac fd 27 4d 8e 0b f9 67 92 ed 8b ce 3f 76 0a 2a aa f4 e9 81 50 3b bb 9a 21 61 f3 36 bc 2b ed fb cc d7 3b e2 58 d2 df c6 9e 1e bf 80 03 e6 4c 6d d8 29 eb b9 18 73 9f f8 0d 74 f1 c6 c7 e4 72 73 d3 68 e7 f2 ac bd 7f 48 d5 b5 2f 13 e8 09 67 Data Ascii: r\-)V[]r[b9j6tw%zAj6Bp?}iV.Sh"%aTrspVul56kb)'o/]NxC~#bPQH+ `G8?6Ars='Mg?v*P;!a6+;XLm)strshH/g
2025-03-27 21:14:27 UTC	997	IN	Data Raw: 55 a9 f3 a4 be 04 d6 f4 3b d5 67 99 0d ba 67 6c e8 37 29 fa 8e df 8d 68 da 5c eb 37 b2 f9 11 df 65 1d 42 cc 43 61 48 1c 60 0c 73 d7 bd 7b 35 fd ab 17 31 a4 9b 72 a7 07 86 5a e5 75 9d 18 af 98 1e 18 96 39 3e f7 92 9b 47 d7 02 ba e9 e3 ae fd ed ce 4a b8 25 17 78 9c f7 84 56 d5 2f a3 b5 d5 35 68 ed f0 44 81 1b 9f 98 f5 07 1d 32 00 e6 ab eb 7a 84 16 7a 9c d0 89 e1 62 1b 27 04 1e 7b f3 c7 f2 ad 5b 3f 0e 69 56 d2 82 e9 3e d3 c9 61 8c 01 f9 56 a1 f0 ee 9f 22 46 f1 5c 08 d0 a0 20 14 0f db d7 35 b7 34 1c af 26 12 8a e5 b4 63 af a9 97 6f f1 43 c0 97 d2 66 e3 c3 b7 f6 cc 4e 77 c5 c6 0f d0 10 2a d8 d7 34 1d 58 11 a0 5e 5d ac b1 fc cf 0c a3 1f 21 3c 11 f4 e8 45 78 9e 9a a1 50 89 58 73 83 d3 91 56 ed b5 d8 ec f5 68 a1 8e e1 ed dc 83 13 94 e1 82 38 fb c3 b6 41 03 1f 5a Data Ascii: U;ggl7)h\7eBCaH`s{51rZu9>GJ%xV/5hD2zzb'{[?iV>aV"F\ 54&coCfNw*4X^]!<ExPXsVh8AZ

Target ID:	6
Start time:	17:13:59
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7d6010000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	7
Start time:	17:14:04
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2192,i,1542605103159018065,6947158532015609988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2240 /prefetch:3
Imagebase:	0x7ff7d6010000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 99

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve

Target ID:	8
Start time:	17:14:07
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2192,i,1542605103159018065,6947158532015609988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5076 /prefetch:8
Imagebase:	0x7ff7d6010000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	11
Start time:	17:14:10
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257Uzve"
Imagebase:	0x7ff7d6010000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre