Edit tour

Windows Analysis Report
https://td.doubleclick.net/td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1>m=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~10310

Overview

General Information

Sample URL:	https://td.doubleclick.net/td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1>m=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag
Analysis ID:	1670607
Infos:

Detection

Score:	0
Range:	0 - 100
Confidence:	80%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,13100426057217993000,2118561166014208890,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://td.doubleclick.net/td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&ptag_exp=101509156~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&u_w=1920&u_h=1080&url=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2Fwinside%2F00Windbndktw0win11advance%2Findex.html&ref=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2F%3Fgad_source%3D5%26gclid%3DEAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&gclaw_src=4_3&label=YQ2CCPTxy8UZEOnR5fA9&hn=www.google.com&frm=0&tiba=Windows%20page&gtm_ee=1&npa=0&gclaw=EAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&pscdl=noapi&auid=126878994.1745256914&uaa=x86&uab=64&uafvl=Microsoft%2520Edge%3B131.0.2903.112%7CChromium%3B131.0.6778.205%7CNot_A%2520Brand%3B24.0.0.0&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1572Date: Mon, 21 Apr 2025 21:10:40 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: unknown	HTTPS traffic detected: 142.250.69.2:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.2:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.2:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.178.49.193:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.178.49.193:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.178.49.193:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.178.49.193:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.178.49.193:443 -> 192.168.2.16:49756 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.221.22
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.221.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.195
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.234.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.195
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.234.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&ptag_exp=101509156~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&u_w=1920&u_h=1080&url=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2Fwinside%2F00Windbndktw0win11advance%2Findex.html&ref=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2F%3Fgad_source%3D5%26gclid%3DEAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&gclaw_src=4_3&label=YQ2CCPTxy8UZEOnR5fA9&hn=www.google.com&frm=0&tiba=Windows%20page&gtm_ee=1&npa=0&gclaw=EAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&pscdl=noapi&auid=126878994.1745256914&uaa=x86&uab=64&uafvl=Microsoft%2520Edge%3B131.0.2903.112%7CChromium%3B131.0.6778.205%7CNot_A%2520Brand%3B24.0.0.0&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://td.doubleclick.net/td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&ptag_exp=101509156~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&u_w=1920&u_h=1080&url=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2Fwinside%2F00Windbndktw0win11advance%2Findex.html&ref=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2F%3Fgad_source%3D5%26gclid%3DEAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&gclaw_src=4_3&label=YQ2CCPTxy8UZEOnR5fA9&hn=www.google.com&frm=0&tiba=Windows%20page&gtm_ee=1&npa=0&gclaw=EAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&pscdl=noapi&auid=126878994.1745256914&uaa=x86&uab=64&uafvl=Microsoft%2520Edge%3B131.0.2903.112%7CChromium%3B131.0.6778.205%7CNot_A%2520Brand%3B24.0.0.0&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&ptag_exp=101509156~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&u_w=1920&u_h=1080&url=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2Fwinside%2F00Windbndktw0win11advance%2Findex.html&ref=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2F%3Fgad_source%3D5%26gclid%3DEAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&gclaw_src=4_3&label=YQ2CCPTxy8UZEOnR5fA9&hn=www.google.com&frm=0&tiba=Windows%20page&gtm_ee=1&npa=0&gclaw=EAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&pscdl=noapi&auid=126878994.1745256914&uaa=x86&uab=64&uafvl=Microsoft%2520Edge%3B131.0.2903.112%7CChromium%3B131.0.6778.205%7CNot_A%2520Brand%3B24.0.0.0&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0 HTTP/1.1Host: td.doubleclick.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=sk&oit=1&cp=2&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=sku&oit=1&cp=3&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/AF1QipPZLyo0Ea6BhHoKU5RFUgg8ecRIe5XnFASmf9jO=w92-h92-n-k-no HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skur&oit=1&cp=4&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/AF1QipOwr6CvD2KEz83f-aDDKQbfQzv0Xeli6wYcDbky=w92-h92-n-k-no HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/AF1QipNpeiPk6wjU4a3R8sPLntbxf9sKstVHlbTu2QFo=w92-h92-n-k-no HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=sk&oit=1&cp=2&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skc&oit=1&cp=3&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/AF1QipOmr7r4r2OkPRKl8qLAsxl2FcHLYBZKL-ddVnIM=w92-h92-n-k-no HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/AF1QipOEBE5_JZekxC28qP3rRzCxxfDnbxloG-lM1mms=w92-h92-n-k-no HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcr&oit=1&cp=4&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/AF1QipOIgPrwEvvRIpzC-2Pd8GaQzShZC9U-zRUNlOTv=w92-h92-n-k-no HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/AF1QipMUHoFviYARFYuXqZTxzX_A4b7QBl7eW2EhnvXX=w92-h92-n-k-no HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skc&oit=1&cp=3&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcur&oit=1&cp=5&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcurt&oit=1&cp=6&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcurti&oit=1&cp=7&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,13100426057217993000,2118561166014208890,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://td.doubleclick.net/td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&ptag_exp=101509156~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&u_w=1920&u_h=1080&url=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2Fwinside%2F00Windbndktw0win11advance%2Findex.html&ref=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2F%3Fgad_source%3D5%26gclid%3DEAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&gclaw_src=4_3&label=YQ2CCPTxy8UZEOnR5fA9&hn=www.google.com&frm=0&tiba=Windows%20page&gtm_ee=1&npa=0&gclaw=EAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&pscdl=noapi&auid=126878994.1745256914&uaa=x86&uab=64&uafvl=Microsoft%2520Edge%3B131.0.2903.112%7CChromium%3B131.0.6778.205%7CNot_A%2520Brand%3B24.0.0.0&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,13100426057217993000,2118561166014208890,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
beacons3.gvt2.com	192.178.49.163	true	false	high
beacons-handoff.gcp.gvt2.com	74.125.138.94	true	false	high
td.doubleclick.net	142.250.69.2	true	false	high
www.google.com	142.250.69.4	true	false	high
beacons2.gvt2.com	172.217.16.67	true	false	high
beacons.gvt2.com	142.250.113.94	true	false	high
googlehosted.l.googleusercontent.com	192.178.49.193	true	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
lh3.googleusercontent.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skc&oit=1&cp=3&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=sk&oit=1&cp=2&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high
https://lh3.googleusercontent.com/p/AF1QipPZLyo0Ea6BhHoKU5RFUgg8ecRIe5XnFASmf9jO=w92-h92-n-k-no	false	high
https://lh3.googleusercontent.com/p/AF1QipNpeiPk6wjU4a3R8sPLntbxf9sKstVHlbTu2QFo=w92-h92-n-k-no	false	high
https://lh3.googleusercontent.com/p/AF1QipOwr6CvD2KEz83f-aDDKQbfQzv0Xeli6wYcDbky=w92-h92-n-k-no	false	high
https://lh3.googleusercontent.com/p/AF1QipOIgPrwEvvRIpzC-2Pd8GaQzShZC9U-zRUNlOTv=w92-h92-n-k-no	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skur&oit=1&cp=4&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcurti&oit=1&cp=7&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high
https://lh3.googleusercontent.com/p/AF1QipOEBE5_JZekxC28qP3rRzCxxfDnbxloG-lM1mms=w92-h92-n-k-no	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=sku&oit=1&cp=3&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high
https://lh3.googleusercontent.com/p/AF1QipOmr7r4r2OkPRKl8qLAsxl2FcHLYBZKL-ddVnIM=w92-h92-n-k-no	false	high
https://lh3.googleusercontent.com/p/AF1QipMUHoFviYARFYuXqZTxzX_A4b7QBl7eW2EhnvXX=w92-h92-n-k-no	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcurt&oit=1&cp=6&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high
https://td.doubleclick.net/favicon.ico	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcur&oit=1&cp=5&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcr&oit=1&cp=4&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
192.178.49.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
142.250.69.2	td.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.68.226	unknown	United States	15169	GOOGLEUS	false

IP
192.168.2.16
192.168.2.4

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1670607
Start date and time:	2025-04-21 23:10:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://td.doubleclick.net/td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1>m=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&ptag_exp=101509156~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&u_w=1920&u_h=1080&url=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2Fwinside%2F00Windbndktw0win11advance%2Findex.html&ref=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2F%3Fgad_source%3D5%26gclid%3DEAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&gclaw_src=4_3&label=YQ2CCPTxy8UZEOnR5fA9&hn=www.google.com&frm=0&tiba=Windows page>m_ee=1&npa=0&gclaw=EAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&pscdl=noapi&auid=126878994.1745256914&uaa=x86&uab=64&uafvl=Microsoft%20Edge%3B131.0.2903.112\|Chromium%3B131.0.6778.205\|Not_A%20Brand%3B24.0.0.0&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@23/56@41/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 92x92, components 3
Category:	downloaded
Size (bytes):	2677
Entropy (8bit):	7.734406622706779
Encrypted:	false
SSDEEP:	48:UA74N8FHNn1+Fwlk/o/TOJOqRbCLTYOrej4CC3ZTINvAnxdxgddrvRmZvQhDlMc:UAXd1CtAb3keXYhtCMv7rmZIZlh
MD5:	732525451813140F73EFB6633D94C47A
SHA1:	FB4EBD114C7F5233196737581D2420777B08CE98
SHA-256:	6EF9668602A5EE8DE71F0E9529BABA51C95709816063B0F67AC4CB0899D74AB2
SHA-512:	E97C2CF2ACE1E9F73495CEE66E4D8387090611CBD434E543486AC9956DF68641C7130727023C2DC4A9B3F0704305D0F406EDA2EA9E6FFFAA3A40C6F0A5C6AED0
Malicious:	false
Reputation:	low
URL:	https://lh3.googleusercontent.com/p/AF1QipOEBE5_JZekxC28qP3rRzCxxfDnbxloG-lM1mms=w92-h92-n-k-no
Preview:	......JFIF.............\Exif..II.......1.......&...i...............Google............0220........L.......oplus_0.............................................................................................................................................\.\...........................................>.........................!.1A..."Qaq...2...#B....Cbr...$Rcs.................................1.......................!...1AQaq.."......2..r..............?..vJ.....l.H....l...6..L,...Xb..a.T.V..Hv..@...^.R].{.",...&.U.6JB.D..Y{-. .Z.... ..@.!Rn.a.T......,C..^.T.".T....,./c..."Q..L:V..:V..:V..t....).B......U..Q.TM..a........El4f..3 ..Tf....0. Q....Y.D.)f......=Y..uW.....G....6....{:.......'#,a.q.#.8m>)Y....qJP..>.!Y....)D{..qb.C...B.>).iXOi..J)....o...\b..M.O8..C.Y.K.Z.......e...T,........3+5..e......V..E..\u.O..6..I(. .E.=d.!..Zn....[.p.%V...}.w9.e.W_!.......I........X.t/.u^.......hB.F.O...a'...B...m>8pY~.....O..yA .7....W'.\|..O.M...gkg....\|KIt..7h<....X....w.j..*.V.q.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 92x92, components 3
Category:	downloaded
Size (bytes):	5306
Entropy (8bit):	5.992392239153564
Encrypted:	false
SSDEEP:	96:bUrgAwbIVByPW0foJSO6w+X/bCT9JO7FqHNEsTz4:/Aw0VGfQJ4ATH6Fq+S4
MD5:	7A455B0942C9086D3DA1EAC404968AB1
SHA1:	2237EBD6FDD7AC2F35270ADCA8A94E33E906FDDF
SHA-256:	83698E815BC1161B91796E8B9032C38BFBE37E4B0313A078364D659B689C44A4
SHA-512:	1128246A9F76FB698993B21CA8F999344EBA9B8550E215EFA9B384D6AA775EF57FBC9474F24118DBD27FCC371CD21CCCEC238CF33C6CEA4681DFB411C23D3ACA
Malicious:	false
Reputation:	low
URL:	https://lh3.googleusercontent.com/p/AF1QipNpeiPk6wjU4a3R8sPLntbxf9sKstVHlbTu2QFo=w92-h92-n-k-no
Preview:	......JFIF..............Exif..II*.......1.......&...i...............Google............0220....T...L.......ASCII.......ALCSIIF5p...."..............X,.......................^...........l...j..kl.._j...._......n.l........UjVl.j.lQ................................................n..A.......9......................................................................................ALCE..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2025 23:10:38.147773027 CEST	53	49974	1.1.1.1	192.168.2.16
Apr 21, 2025 23:10:38.165524006 CEST	53	65117	1.1.1.1	192.168.2.16
Apr 21, 2025 23:10:39.158608913 CEST	56330	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:10:39.158834934 CEST	62100	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:10:39.298808098 CEST	53	56330	1.1.1.1	192.168.2.16
Apr 21, 2025 23:10:39.299168110 CEST	53	62100	1.1.1.1	192.168.2.16
Apr 21, 2025 23:10:39.331257105 CEST	53	52795	1.1.1.1	192.168.2.16
Apr 21, 2025 23:10:39.597886086 CEST	53	54980	1.1.1.1	192.168.2.16
Apr 21, 2025 23:10:42.726243973 CEST	60674	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:10:42.726289988 CEST	49741	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:10:42.868805885 CEST	53	60674	1.1.1.1	192.168.2.16
Apr 21, 2025 23:10:42.868829012 CEST	53	49741	1.1.1.1	192.168.2.16
Apr 21, 2025 23:10:56.517460108 CEST	53	50178	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:15.412753105 CEST	53	54663	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:38.047117949 CEST	53	55993	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:38.085022926 CEST	53	62790	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:41.182986021 CEST	60559	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:41.183043957 CEST	64618	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:41.323307037 CEST	53	64618	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:41.323793888 CEST	53	60559	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:41.448323965 CEST	53	55550	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:42.202478886 CEST	59926	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:42.202646971 CEST	56515	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:42.342761993 CEST	53	56515	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:42.342871904 CEST	53	59926	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:44.231895924 CEST	61533	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:44.372164011 CEST	53	61533	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:45.236263037 CEST	61533	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:45.376718044 CEST	53	61533	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:46.244216919 CEST	61533	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:46.384413958 CEST	53	61533	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:48.257205963 CEST	61533	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:48.398636103 CEST	53	61533	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:52.262280941 CEST	61533	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:52.403275013 CEST	53	61533	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:53.897861004 CEST	50494	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:53.897929907 CEST	50005	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:54.040183067 CEST	53	50494	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:54.040241957 CEST	53	50005	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:55.744707108 CEST	138	138	192.168.2.16	192.168.2.255
Apr 21, 2025 23:11:57.194695950 CEST	64860	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:57.194833994 CEST	62601	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:57.334974051 CEST	53	64860	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:57.335025072 CEST	53	62601	1.1.1.1	192.168.2.16
Apr 21, 2025 23:11:58.212570906 CEST	49358	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:11:58.353714943 CEST	53	49358	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:00.241048098 CEST	62341	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:00.381303072 CEST	53	62341	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:01.246304035 CEST	62341	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:01.394766092 CEST	53	62341	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:02.253408909 CEST	62341	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:02.393826008 CEST	53	62341	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:04.262403011 CEST	62341	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:04.402828932 CEST	53	62341	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:08.264364958 CEST	62341	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:08.404721975 CEST	53	62341	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:08.529198885 CEST	53	65439	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:13.187907934 CEST	63686	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:13.188316107 CEST	55481	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:13.364876986 CEST	53	63686	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:13.395550966 CEST	53	55481	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:14.203597069 CEST	59215	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:14.344192028 CEST	53	59215	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:16.231007099 CEST	52443	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:16.373929977 CEST	53	52443	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:17.245452881 CEST	52443	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:17.385719061 CEST	53	52443	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:18.246469975 CEST	52443	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:18.387115955 CEST	53	52443	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:20.253436089 CEST	52443	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:20.393687963 CEST	53	52443	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:24.263812065 CEST	52443	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:24.404623032 CEST	53	52443	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:29.191243887 CEST	63608	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:29.191396952 CEST	53959	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:29.331490040 CEST	53	63608	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:29.331888914 CEST	53	53959	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:29.517633915 CEST	64310	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:29.517797947 CEST	52370	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:29.657804966 CEST	53	64310	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:29.657891989 CEST	53	52370	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:29.658617020 CEST	53	60919	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:30.206656933 CEST	53684	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:30.347696066 CEST	53	53684	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:32.234896898 CEST	61636	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:32.375231981 CEST	53	61636	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:33.240447044 CEST	61636	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:33.380935907 CEST	53	61636	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:34.246448040 CEST	61636	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:34.387304068 CEST	53	61636	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:36.257462025 CEST	61636	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:36.397730112 CEST	53	61636	1.1.1.1	192.168.2.16
Apr 21, 2025 23:12:40.271595955 CEST	61636	53	192.168.2.16	1.1.1.1
Apr 21, 2025 23:12:40.412688017 CEST	53	61636	1.1.1.1	192.168.2.16

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:10:39 UTC	1989	OUT	GET /td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&ptag_exp=101509156~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&u_w=1920&u_h=1080&url=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2Fwinside%2F00Windbndktw0win11advance%2Findex.html&ref=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2F%3Fgad_source%3D5%26gclid%3DEAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&gclaw_src=4_3&label=YQ2CCPTxy8UZEOnR5fA9&hn=www.google.com&frm=0&tiba=Windows%20page&gtm_ee=1&npa=0&gclaw=EAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&pscdl=noapi&auid=126878994.1745256914&uaa=x86&uab=64&uafvl=Microsoft%2520Edge%3B131.0.2903.112%7CChromium%3B131.0.6778.205%7CNot_A%2520Brand%3B24.0.0.0&uamb=0&uam=&u [TRUNCATED] Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CLbgygE= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:10:40 UTC	785	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 21 Apr 2025 21:10:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Mon, 21-Apr-2025 21:25:40 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-21 21:10:40 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2025-04-21 21:10:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:10:40 UTC	1789	OUT	GET /favicon.ico HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CLbgygE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://td.doubleclick.net/td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&ptag_exp=101509156~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&u_w=1920&u_h=1080&url=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2Fwinside%2F00Windbndktw0win11advance%2Findex.html&ref=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2F%3Fgad_source%3D5%26gclid%3DEAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&gclaw_src=4_3&label=YQ2CCPTxy8UZEOnR5fA9&hn=www.google.com&frm=0&tiba=Windows%20page&gtm_ee=1&npa=0&gclaw=EAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&pscdl=noapi&auid=126878994.1745256914&uaa=x86&uab=64&uafvl=Microsoft%2520Edge%3B131.0.2903.112%7CChromium%3B131.0.6778.205%7CNot_A%252 [TRUNCATED] Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2025-04-21 21:10:40 UTC	231	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1572 Date: Mon, 21 Apr 2025 21:10:40 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-21 21:10:40 UTC	1093	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2025-04-21 21:10:40 UTC	479	IN	Data Raw: 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 Data Ascii: and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a hre

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:11:54 UTC	2055	OUT	GET /td/rul/16611109097?random=1745256913907&cv=11&fst=1745256913907&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be54h0v9214610611za200zb9218220448&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&ptag_exp=101509156~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&u_w=1920&u_h=1080&url=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2Fwinside%2F00Windbndktw0win11advance%2Findex.html&ref=https%3A%2F%2Fskcuritu095.z13.web.core.windows.net%2F%3Fgad_source%3D5%26gclid%3DEAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&gclaw_src=4_3&label=YQ2CCPTxy8UZEOnR5fA9&hn=www.google.com&frm=0&tiba=Windows%20page&gtm_ee=1&npa=0&gclaw=EAIaIQobChMI2rS0v9TpjAMVfTpECB2iPwcMEAEYASAAEgJS5_D_BwE&pscdl=noapi&auid=126878994.1745256914&uaa=x86&uab=64&uafvl=Microsoft%2520Edge%3B131.0.2903.112%7CChromium%3B131.0.6778.205%7CNot_A%2520Brand%3B24.0.0.0&uamb=0&uam=&u [TRUNCATED] Host: td.doubleclick.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CLbgygE= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2025-04-21 21:11:54 UTC	954	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 21 Apr 2025 21:11:54 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUmRW_dkNjIrvdmibIqlRT9nYK4NN9OShzRaBqJ4KIn2FDIi577VnalPgqZu; expires=Wed, 21-Apr-2027 21:11:54 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-21 21:11:54 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2025-04-21 21:11:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:02 UTC	487	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CLbgygE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:03 UTC	1303	IN	HTTP/1.1 200 OK Date: Mon, 21 Apr 2025 21:12:02 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-D0TBBlg4yb4P5U-EO9Qorg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-21 21:12:03 UTC	21	IN	Data Raw: 33 37 66 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 61 6c 6c 61 Data Ascii: 37f)]}'["",["dalla
2025-04-21 21:12:03 UTC	881	IN	Data Raw: 73 20 73 74 61 72 73 20 63 6f 6c 6f 72 61 64 6f 20 61 76 61 6c 61 6e 63 68 65 22 2c 22 61 70 72 69 6c 20 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 70 61 79 6d 65 6e 74 73 22 2c 22 72 65 6e 74 61 6c 20 61 73 73 69 73 74 61 6e 63 65 22 2c 22 74 6f 64 61 79 20 77 6f 72 64 6c 65 20 61 6e 73 77 65 72 73 22 2c 22 6c 79 72 69 64 20 6d 65 74 65 6f 72 20 73 68 6f 77 65 72 73 22 2c 22 73 61 6d 73 75 6e 67 20 6f 6e 65 20 75 69 20 37 20 72 65 6c 65 61 73 65 20 64 61 74 65 22 2c 22 62 65 6e 20 77 68 69 74 74 61 6b 65 72 20 76 73 20 6c 69 61 6d 20 63 61 6d 65 72 6f 6e 20 66 69 67 68 74 22 2c 22 67 65 6e 65 72 61 6c 20 6d 6f 74 6f 72 73 20 69 6e 6a 65 63 74 69 6f 6e 20 73 79 73 74 65 6d 20 73 65 74 74 6c 65 6d 65 6e 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 Data Ascii: s stars colorado avalanche","april social security payments","rental assistance","today wordle answers","lyrid meteor showers","samsung one ui 7 release date","ben whittaker vs liam cameron fight","general motors injection system settlement"],["","","",""
2025-04-21 21:12:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:29 UTC	522	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=sk&oit=1&cp=2&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CLbgygE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:29 UTC	1303	IN	HTTP/1.1 200 OK Date: Mon, 21 Apr 2025 21:12:29 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ox2mVRBdKyAXm_Mr2ba85w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-21 21:12:29 UTC	21	IN	Data Raw: 39 35 39 0d 0a 29 5d 7d 27 0a 5b 22 73 6b 22 2c 5b 22 73 6b 79 Data Ascii: 959)]}'["sk",["sky
2025-04-21 21:12:29 UTC	1324	IN	Data Raw: 20 68 61 72 62 6f 72 22 2c 22 73 6b 79 20 68 61 72 62 6f 72 22 2c 22 73 6b 69 6d 73 22 2c 22 73 6b 79 73 63 61 6e 6e 65 72 22 2c 22 73 6b 65 63 68 65 72 73 22 2c 22 73 6b 79 20 68 61 72 62 6f 72 20 70 61 72 6b 69 6e 67 22 2c 22 73 6b 69 6e 73 22 2c 22 73 6b 69 6e 64 65 78 22 2c 22 73 6b 79 70 65 22 2c 22 73 6b 65 74 63 68 75 70 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 67 76 62 53 38 77 63 33 6c Data Ascii: harbor","sky harbor","skims","skyscanner","skechers","sky harbor parking","skins","skindex","skype","sketchup"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"CggvbS8wc3l
2025-04-21 21:12:29 UTC	1055	IN	Data Raw: 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 6b 76 62 53 38 77 4e 58 67 79 61 32 63 53 45 45 5a 76 62 33 52 33 5a 57 46 79 49 47 4e 76 62 58 42 68 62 6e 6b 79 5a 47 68 30 64 48 42 7a 4f 69 38 76 5a 57 35 6a 63 6e 6c 77 64 47 56 6b 4c 58 52 69 62 6a 41 75 5a 33 4e 30 59 58 52 70 59 79 35 6a 62 32 30 76 61 57 31 68 5a 32 56 7a 50 33 45 39 64 47 4a 75 4f 6b 46 4f 5a 44 6c 48 59 31 52 78 52 47 31 32 55 47 55 32 63 44 5a 51 4e 30 74 36 62 55 4a 43 61 58 4e 78 55 32 64 36 56 47 70 75 4e 57 70 48 54 6a 5a 32 63 44 42 6c 56 47 4e 51 53 44 6c 76 4a 6e 4d 39 4d 54 41 36 43 46 4e 4c 52 55 4e 49 52 56 4a 54 53 67 63 6a 4d 57 51 31 4d 44 63 31 55 6a 5a 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 46 41 78 56 47 4e 33 63 6c 52 45 53 31 52 73 5a 47 64 4f Data Ascii: e:entityinfo":"CgkvbS8wNXgya2cSEEZvb3R3ZWFyIGNvbXBhbnkyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1RxRG12UGU2cDZQN0t6bUJCaXNxU2d6VGpuNWpHTjZ2cDBlVGNQSDlvJnM9MTA6CFNLRUNIRVJTSgcjMWQ1MDc1UjZnc19zc3A9ZUp6ajR0VFAxVGN3clRES1RsZGdO
2025-04-21 21:12:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:29 UTC	446	OUT	GET /p/AF1QipPZLyo0Ea6BhHoKU5RFUgg8ecRIe5XnFASmf9jO=w92-h92-n-k-no HTTP/1.1 Host: lh3.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:30 UTC	539	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="2021-07-11.jpg" X-Content-Type-Options: nosniff Server: fife Content-Length: 6256 X-XSS-Protection: 0 Date: Mon, 21 Apr 2025 20:23:38 GMT Expires: Tue, 22 Apr 2025 20:23:38 GMT Cache-Control: public, max-age=86400, no-transform Age: 2932 ETag: "v2bcbe" Content-Type: image/jpeg Vary: Origin Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-21 21:12:30 UTC	785	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 2a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 31 01 02 00 07 00 00 00 1a 00 00 00 00 00 00 00 47 6f 6f 67 6c 65 00 00 ff db 00 84 00 03 02 02 0f 02 09 0a 0b 0a 0b 10 0f 0d 0b 0b 0d 10 0d 0a 08 0f 0d 0b 0d 0d 0b 0a 0a 0a 10 0b 0d 0d 0a 0a 0d 0d 0a 0d 0a 10 0b 0d 0e 0a 0d 0d 0b 0a 0a 09 0d 0a 0a 0b 0b 0d 0a 0e 0e 0e 0b 0b 0e 01 03 04 04 06 05 06 0a 06 06 0a 10 0e 0b 0e 0f 0f 10 0f 0f 0f 12 10 10 10 10 10 0d 0f 0d 0f 10 10 0d 0f 10 0d 10 12 10 0f 10 0d 0d 0d 0f 0f 0d 10 10 0f 10 0f 0f 0f 0d 0d 10 0d 0d 0f 0e 0f 0d 0d ff c0 00 11 08 00 5c 00 5c 03 01 11 00 02 11 01 03 11 01 ff c4 00 1d 00 00 02 03 01 01 01 01 01 00 00 00 00 00 00 00 00 06 07 04 05 08 03 02 09 01 00 ff c4 00 41 10 00 02 Data Ascii: JFIFExifII1Google\\A
2025-04-21 21:12:30 UTC	1324	IN	Data Raw: 33 88 f3 99 19 eb 77 36 42 0d 02 cf 9a 51 40 59 dc d7 b9 27 86 98 d0 d6 81 3c d0 49 93 2a ff 00 20 cc 63 67 55 aa b3 5a 9f 70 3f 5f 24 ff 00 70 e0 75 5f 61 a5 d1 3e 08 b4 9a 1c e0 dc 11 3b f3 47 dc 92 3c 45 69 91 88 3a 68 03 5e 08 20 6e 8c 29 94 d5 32 10 de fc 55 a1 95 5a 1c 2f 04 4a 92 e7 53 24 60 42 e5 98 f3 0f de 55 a9 35 57 8d 66 ea fe 96 0d 7f 1c 5d 8c 6b 2e 68 03 c1 43 9c e7 f7 af 52 70 39 0a e2 f0 d8 8c 43 9d 0b 15 05 08 01 d7 23 78 5f 6a 1e 01 23 c1 61 74 2c f0 95 5d b0 b7 68 66 ce c6 c9 32 49 d0 04 d3 76 61 b9 75 57 18 8b 87 12 bc f2 1f 29 b7 35 1b 6d 87 fa fa ed fa fe dc 33 5e bb 29 34 b9 d8 04 1a 34 9c f2 1a 33 47 ff 00 f6 3b 16 63 5a 99 f4 81 e2 c2 ea db 76 ed 50 55 07 b6 a2 4b 0d f6 15 79 fb 2e d1 5a af 6d ed 01 bf ea 2f 93 c4 df e9 1f 6e 6d Data Ascii: 3w6BQ@Y'<I* cgUZp?_$pu_a>;G<Ei:h^ n)2UZ/JS$`BU5Wf]k.hCRp9C#x_j#at,]hf2IvauW)5m3^)443G;cZvPUKy.Zm/nm
2025-04-21 21:12:30 UTC	1324	IN	Data Raw: cc cd d9 a5 86 e0 2d 75 1b e6 07 db 77 5b b2 c8 92 52 a6 bd f0 02 d2 19 5f c1 b6 55 83 5d 3d 14 3a 4d 13 27 44 9f 03 dd 90 b1 1f b9 27 f5 e0 82 83 34 53 bc 29 1b 85 f5 1b ee 9c 3b 0f b6 eb 89 9e a4 90 c9 2b 1d e3 d2 45 06 3b da 81 4c c0 10 e2 8f b1 ae f0 9b ef eb 54 21 b3 43 6d 40 8c ce 9f da cf 45 17 2d c4 4b 32 cf 23 f5 1e 5b d4 f5 1c 29 88 8a 30 19 35 b0 29 a5 b5 80 50 b3 33 8d 80 ed a1 3c e8 20 dd e3 c7 25 2d 00 67 d6 4b 4d 7a 17 cf d0 e7 13 aa 99 14 b3 a5 15 4d d4 08 d0 02 35 10 07 85 35 f5 00 9f 63 42 6b da 2b d9 ce 27 92 52 a0 86 40 48 9c db d5 45 cc cc ab 10 25 51 98 37 49 19 cb e9 20 fc a8 ca 55 88 ec 3d fd cd 6c a7 c8 15 aa 69 92 7b 06 6e be 07 b9 f0 e4 99 a6 d7 b6 23 0d 17 5f 51 fd 6b 5c 99 e3 31 02 c1 70 cb 64 39 55 0e f1 80 55 95 58 be a5 a3 Data Ascii: -uw[R_U]=:M'D'4S);+E;LT!Cm@E-K2#[)05)P3< %-gKMzM55cBk+'R@HE%Q7I U=li{n#_Qk\1pd9UUX
2025-04-21 21:12:30 UTC	1324	IN	Data Raw: 9d cc f0 9f 77 28 57 03 6b 04 c8 80 fe 23 8a 50 4e d4 81 14 15 bf 0d 64 6d b7 07 6b 4e 20 df f8 41 2e 02 e4 f7 f8 37 c2 40 b8 8c 46 1b 17 1c 4f d7 54 2a d3 c7 1c 94 14 b0 04 09 d5 8a 80 ce 16 43 4a 34 c8 ae 58 e8 e1 c6 55 12 27 0c 0a 42 a3 0d f1 8e 4b 73 60 f0 0f c9 30 88 f0 f4 55 24 d7 d1 94 2d 16 00 8a 0c 00 65 20 12 16 ed 45 d1 1e 08 dd 61 2c 10 df 55 87 50 07 1e df a2 a9 42 bc ef 8e c1 e8 ba 89 29 95 c6 97 47 2c 03 2b 0f 1a a9 54 d8 25 4a 95 60 48 23 81 38 8a 95 5b 19 22 34 6e e9 3a 73 4d bc f3 96 e0 e7 5f b5 1c 6e 05 27 8c ce ea 24 40 13 13 18 88 2c 7d 92 d8 24 69 41 41 5e 16 04 90 19 8e fc 12 b6 ca 2a 8b fa f0 28 34 b6 ad d9 85 96 bd 4d f4 02 18 71 2c 32 f9 98 c3 42 d7 14 29 d2 42 4e a4 a7 e9 b8 55 14 a3 57 51 ac 12 65 6f 6c e1 b0 9d 61 68 fe ec 69 Data Ascii: w(Wk#PNdmkN A.7@FOTCJ4XU'BKs`0U$-e Ea,UPB)G,+T%J`H#8["4n:sM_n'$@,}$iAA^(4Mq,2B)BNUWQeolahi
2025-04-21 21:12:30 UTC	1324	IN	Data Raw: 2b 2c 7a 8e e4 6b 61 1b 16 de ce a4 0d 44 12 6c 9e 0c da d7 76 88 27 cf f0 97 7e cf 26 5b 20 78 2c 7a 71 3d 6d 97 c0 d8 b7 b0 af 65 1e 09 1e 0f e5 07 6d cd a8 f9 f6 17 95 f4 b9 9b 9a b8 24 ba f6 5f 03 fc 7d c5 f9 3b fc cc 6c dd fb dd 78 dd 79 c5 47 01 82 d5 9f 0f 5e 98 47 e9 ee 15 f3 8c cc 84 8a 24 d5 1a bd 0a 46 14 8d bf 89 65 27 44 63 c8 8c ea dc be 95 7e 8d 3d d3 77 ae ef 1c 35 03 5f 13 80 18 f3 20 64 ed 35 b7 8e dd 30 f6 46 27 53 a7 80 c4 9f c0 9c cd 9e f3 a6 2b d6 fc cf 1b 8e 49 3a 69 3e 95 13 95 1a e2 c3 c5 ac c7 0e 1c 3e 9e 9a 95 b6 6d 54 7b 0c ee f1 28 76 57 d8 c3 51 a0 3c 5c 39 7d c6 be 2b 39 d5 1b 4c 92 c3 27 af 7d 11 b7 2f f2 12 f2 c0 a0 97 31 f1 d5 ef 70 e7 cc 93 33 80 cd 37 96 08 ca 04 43 77 8c 4a cf 14 66 75 41 4f b2 d1 7f b7 df b7 8d c1 6b Data Ascii: +,zkaDlv'~&[ x,zq=mem$_};lxyG^G$Fe'Dc~=w5_ d50F'S+I:i>>mT{(vWQ<\9}+9L'}/1p37CwJfuAOk
2025-04-21 21:12:30 UTC	175	IN	Data Raw: 58 14 1f c0 4b 03 df b9 b7 de b8 1e db fe 83 f9 7f e1 eb d4 33 3c 3e 42 21 9f 36 65 23 7f 6e 11 4d 85 41 9a bf da 94 d8 07 cf 90 3e 9f 5f 3c 4a f2 56 24 bf 73 e6 51 84 d8 4f 1e a7 1f 57 0e e3 50 fa 1a 02 ff 00 6f d4 f1 a3 fa 5d 47 32 a5 96 e1 36 63 81 68 3e f8 24 36 b6 07 b6 4f 8f 98 5b 37 94 33 13 cc b9 77 52 5d da 26 d2 0f d5 0a 46 74 b5 f9 16 db 78 22 81 bb df 8d 17 88 79 6e 49 21 84 a6 5f a7 6d d1 7d 1e d6 a2 8f d3 50 e1 67 05 2e 4f 4e 48 cb d7 15 00 24 7b 91 e4 fb 7f 3c 67 6d 35 1c d7 c0 29 9d 9d a0 b2 48 5f ff d9 Data Ascii: XK3<>B!6e#nMA>_<JV$sQOWPo]G26ch>$6O[73wR]&Ftx"ynI!_m}Pg.ONH${<gm5)H_

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:30 UTC	446	OUT	GET /p/AF1QipOwr6CvD2KEz83f-aDDKQbfQzv0Xeli6wYcDbky=w92-h92-n-k-no HTTP/1.1 Host: lh3.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:31 UTC	532	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="2020-10-15.jpg" X-Content-Type-Options: nosniff Server: fife Content-Length: 5539 X-XSS-Protection: 0 Date: Mon, 21 Apr 2025 21:12:30 GMT Expires: Tue, 22 Apr 2025 21:12:30 GMT Cache-Control: public, max-age=86400, no-transform ETag: "ve" Content-Type: image/jpeg Vary: Origin Age: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-21 21:12:31 UTC	792	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 66 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 03 00 31 01 02 00 07 00 00 00 32 00 00 00 3b 01 02 00 0f 00 00 00 39 00 00 00 98 82 02 00 15 00 00 00 48 00 00 00 00 00 00 00 47 6f 6f 67 6c 65 00 44 75 72 73 74 6f 6e 20 53 61 79 6c 6f 72 00 c2 a9 44 75 72 73 74 6f 6e 20 53 61 79 6c 6f 72 20 27 31 34 00 00 ff db 00 84 00 03 02 02 03 09 0a 0f 0e 0a 03 0b 0d 09 0b 0a 0a 0b 0b 0a 0c 0b 0d 0a 0f 0a 0d 08 0b 0a 0b 0d 0d 0e 0e 0b 0a 0b 08 0e 08 09 0a 0b 08 0e 0b 0e 0f 0b 0a 0d 0b 0e 08 0a 0b 0e 0a 0d 0d 0a 0a 0d 0a 01 03 04 04 06 05 06 0a 06 06 0a 10 0d 0b 0d 0d 0f 10 0d 0e 0f 10 0f 0f 10 10 0f 10 0d 0f 0d 0f 0f 0f 0f 10 0d 0e 10 0f 0f 0d 0f 0d 0f 0d 0d 0d 0f 0f 0f 0d 0f 0f 0d 0d 0d 0d 0d 0d 0f 0d Data Ascii: JFIFfExifII*12;9HGoogleDurston SaylorDurston Saylor '14
2025-04-21 21:12:31 UTC	1324	IN	Data Raw: 6d 6f 8f 1a 30 08 58 b1 90 65 6b 61 9c 9f c5 d8 5d 59 42 9e c4 b8 b6 ff 00 22 df c0 71 97 14 2d f8 01 57 67 e5 0d 72 8f f8 a4 24 fb 89 3f c5 43 1b fe a8 f9 f0 37 a1 2e ec ac 8f ff 00 2f 5b 1b 0d 74 dd d8 00 41 52 09 36 00 0d c1 b9 da db 03 bf 6e 08 78 39 2e c0 42 73 52 45 8a 24 20 8a 72 bb 0f aa 08 ef 6f 8a f1 c4 f0 44 42 ca 9e 7c 59 ff 00 ad 6f bb 6f e1 61 c2 89 4c a0 19 6a bd bb a1 f9 9e 1a 10 c4 15 a8 32 7c dd cc a0 0f 32 48 16 ff 00 4e 01 01 15 9f 9d 6b 70 76 a4 9a 9c 67 7a 54 9a 7a 79 63 89 5a 74 2d 76 42 bd 94 b4 fa 01 20 36 90 6c 0e c3 82 33 09 0c 42 51 f2 47 90 10 d0 54 99 a5 c6 9e a0 34 12 46 61 a7 a1 aa 60 7a 8f 1b 06 eb 32 2c 3e 12 9d ad be ab dc 69 b1 d0 e7 4d 96 66 8c 26 65 3b 24 9f 10 df 46 40 9d 57 ca 4a 89 a9 69 d0 fc 7f a4 3c d6 f9 c6 38 Data Ascii: mo0Xeka]YB"q-Wgr$?C7./[tAR6nx9.BsRE$ roDB\|YooaLj2\|2HNkpvgzTzycZt-vB 6l3BQGT4Fa`z2,>iMf&e;$F@WJi<8
2025-04-21 21:12:31 UTC	1324	IN	Data Raw: 26 e3 a8 aa 4b 1b 10 6d b1 16 3d 82 0e 39 72 22 6c 6e 7f b5 c0 5c bf 7f 3b 4b f6 b8 e5 ca 58 f1 09 0f 9f 1c b9 20 b9 97 9a a1 86 b6 60 cd bb 34 4d ed 20 fe cf 0a fd 67 53 f5 7d d6 f8 f7 e3 97 24 35 3d 26 0e ab 28 a9 a5 49 60 ea 01 d3 64 ea a9 0a b1 b2 0d 2d a8 59 0e 92 3c 94 a8 61 6f 2c 7b 39 c6 01 57 7c b1 c6 10 37 30 28 72 8b 45 7a 5c bb 0a b2 2a 36 a8 e1 58 98 31 a9 a7 8c ee a8 18 9d 0c eb df 60 48 f3 db 43 9b 6b 2b ec f5 1c 5e 03 89 f3 ee 28 5b 27 54 e2 11 d4 c5 fc 9d 9a e6 b3 0e 5d ac b7 8d e5 a8 59 08 2c 85 6c 54 da d6 bb 1b 05 21 88 e2 6c 0b 66 d4 7b 3e 3e cb e9 b6 15 88 4b 2c aa 64 cb 52 53 49 d5 d2 12 45 55 d4 a2 2a ef 10 29 1c 6b 69 4d 98 2d b5 1d 24 93 b1 b5 da 57 90 e5 a5 9d aa 62 a7 81 dd c1 b0 46 20 29 0a 5a c3 b2 92 42 87 dc 69 dc 6f e7 c7 Data Ascii: &Km=9r"ln\;KX `4M gS}$5=&(I`d-Y<ao,{9W\|70(rEz\6X1`HCk+^(['T]Y,lT!lf{>>K,dRSIEU)kiM-$WbF )ZBio
2025-04-21 21:12:31 UTC	1324	IN	Data Raw: 5b 86 3a c5 69 1b 75 56 f6 84 ca d4 a2 e6 23 47 7e 9d 78 50 da 46 99 a2 0c f1 e9 21 8f 4a 44 fa 16 62 41 17 74 a6 2c 3c 21 57 53 71 3f a4 a7 a0 55 1f ca 3c fd c7 e1 1d 50 73 de ad 45 97 1e a8 04 58 f8 c1 89 4d bb 8d 50 4f 24 80 b0 d8 1e 83 db 6d 8e fc 13 b2 f0 71 f3 29 3f ec 01 fb 98 0f 80 3e ca d4 fe 95 7c c1 46 3d 3c 4e 45 5d 47 4f 4e a6 49 15 41 37 00 b1 94 9d 86 de 35 56 36 b9 5e fc 0d c1 07 ee 2a ad ad 49 e3 ec 6c f2 84 75 81 fa 62 e7 75 8d bf 97 84 d4 02 34 2e b2 8a 47 d6 d5 25 44 09 10 6f b3 e2 20 db da df 62 68 bc 64 ef 40 a3 bf d9 9c 60 b2 06 b7 3f 3d 68 b5 e1 f4 e4 e6 8c 62 cf 89 b6 e4 05 0c 91 b8 7d c5 b4 95 89 43 02 4a d8 ab 30 37 16 3c 2e 07 c4 7b 2a 6e f6 67 5e 0f 81 3e e8 bb 0f f4 df e6 72 c6 a4 e1 4a ee ec da a2 14 32 3b 46 ab 6b 33 db 4a Data Ascii: [:iuV#G~xPF!JDbAt,<!WSq?U<PsEXMPO$mq)?>\|F=<NE]GONIA75V6^Ilubu4.G%Do bhd@`?=hb}CJ07<.{ng^>rJ2;Fk3J
2025-04-21 21:12:31 UTC	775	IN	Data Raw: ac 5e 63 e5 45 78 e3 58 b1 02 da 23 90 32 95 d6 58 bc f2 b8 06 eb d2 b0 57 51 7f 70 f2 22 dc 7a 2c 7d 26 80 25 79 e5 b5 0b 89 23 38 57 72 ce 05 9d 23 47 11 e3 93 ac 62 86 a5 63 54 aa 9b 4c 45 69 24 e9 59 12 53 4e 8c a4 26 8d 28 85 4d 88 17 bf 16 63 9c 60 95 0a 8d a6 2d d7 c7 a2 04 c4 33 76 7b 85 4c 67 32 cd 22 10 75 47 53 1c 75 ca c0 f7 0c b5 31 ca e5 5b b7 b8 8d 87 6d a9 bc 2d fb a3 cd 28 a4 d7 0e ca 63 f2 6f 9b b9 65 24 86 39 79 77 0c 35 72 cd 4f 18 a8 a5 e9 c2 1d 9d c4 60 b4 16 a7 65 4b 90 c5 43 54 00 5d 8a a2 80 ab c1 35 43 b2 eb c9 21 a0 5a 27 a8 59 39 b7 39 72 d6 b6 16 49 30 9a ba 79 3d 84 ae 96 8d 2b 19 7a 25 58 9d 50 ca 93 84 20 90 01 92 44 3a 9a ea 6d 6e 28 63 2f 74 ac 2f 65 c7 5d 79 a2 4e 4c fa 37 52 2c d4 f5 50 66 81 56 8b 2c 72 2b 42 3a 21 77 Data Ascii: ^cExX#2XWQp"z,}&%y#8Wr#GbcTLEi$YSN&(Mc`-3v{Lg2"uGSu1[m-(coe$9yw5rO`eKCT]5C!Z'Y99rI0y=+z%XP D:mn(c/t/e]yNL7R,PfV,r+B:!w

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:30 UTC	446	OUT	GET /p/AF1QipNpeiPk6wjU4a3R8sPLntbxf9sKstVHlbTu2QFo=w92-h92-n-k-no HTTP/1.1 Host: lh3.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:31 UTC	536	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="2016-06-16.jpg" X-Content-Type-Options: nosniff Server: fife Content-Length: 5306 X-XSS-Protection: 0 Date: Mon, 21 Apr 2025 19:08:13 GMT Expires: Tue, 22 Apr 2025 19:08:13 GMT Cache-Control: public, max-age=86400, no-transform Age: 7457 ETag: "v24" Content-Type: image/jpeg Vary: Origin Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-21 21:12:31 UTC	788	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 08 a8 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 02 00 31 01 02 00 07 00 00 00 26 00 00 00 69 87 04 00 01 00 00 00 2e 00 00 00 00 00 00 00 47 6f 6f 67 6c 65 00 00 02 00 00 90 07 00 04 00 00 00 30 32 32 30 86 92 07 00 54 08 00 00 4c 00 00 00 00 00 00 00 41 53 43 49 49 00 00 00 0a 00 00 00 41 4c 43 53 49 49 46 35 70 01 fe ff da 22 01 00 00 00 01 00 fb 9f 02 00 b2 bb 01 00 58 2c ff ff f5 17 00 00 1e dc ff ff eb 0a 01 00 f6 18 00 00 d6 1d 00 00 98 5e ff ff 93 83 01 00 00 00 00 00 c4 6c 00 00 b1 6a 00 00 6b 6c 00 00 5f 6a 00 00 ee 0c 5f 0c 00 00 01 ff b3 6e 94 6c 15 c5 00 00 06 b2 03 02 55 6a 56 6c a7 6a bc 6c 51 03 01 00 00 00 01 00 84 10 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: JFIFExifII*1&i.Google0220TLASCIIALCSIIF5p"X,^ljkl_j_nlUjVljlQ
2025-04-21 21:12:31 UTC	1324	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2025-04-21 21:12:31 UTC	1324	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ee dd cc 26 01 00 00 50 43 4c 31 33 32 33 30 37 33 20 43 41 4c 48 30 38 51 4c 48 4a 30 31 41 4d 20 43 52 43 30 31 00 ff db 00 84 00 03 02 02 0a 0e 0e 0a 0a 0a 0a 0b 08 0b 08 0a 0a 0a 08 0a 08 0d 0b 08 08 0a 0d 0b 0a 08 0a 0a 0b 0a 08 08 08 08 0b 0a 0b 08 0a 0a 08 08 0a 08 0a 08 0a 0a 0a 0d 08 08 0e 0e 0b 0b 0d 0a 0a 0a 0a 01 03 04 04 06 05 06 0a 06 06 0a 0d 0d 0a 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d Data Ascii: &PCL1323073 CALH08QLHJ01AM CRC01
2025-04-21 21:12:31 UTC	1324	IN	Data Raw: dd ba d4 6c f5 63 e9 aa 4f aa 75 1d 51 4b 26 0c 39 8e b0 ef 3d dc 1f a5 5b cb 5d f1 14 95 55 e3 63 1a c0 12 58 da 49 24 54 9a 3f 4e ca e2 16 91 9e 32 46 68 cb 48 15 82 c9 20 71 83 19 54 23 fe 50 bc f1 30 cf cd d7 bc 33 0e 82 fa be 97 04 d7 68 7d 20 43 14 37 58 e6 8f a2 6e 8d d2 79 5f 2c 28 58 c3 1e 47 a3 65 52 c8 80 65 0a 0c 67 3b 9b 63 e6 13 81 f4 78 36 1c bf da 0b d4 fa fe de f9 7a 98 7b 95 d4 0e c0 2d 6a 10 d8 1b 12 14 2d b4 d8 29 49 66 45 90 32 24 b2 88 d8 a0 0c ca 24 60 87 aa ea 35 50 a4 d3 4e 42 cc a4 0c 40 e3 8f 9b 03 f6 4f dd 25 86 41 c4 32 3b a2 9a 6b e1 4f f3 9b 4c 81 88 4a 6c f2 9a 75 fb a9 5a fb 7a d6 39 0b 60 b5 d8 d5 f5 fd ea 48 f0 95 6c 72 15 dc cb 16 c0 29 df 20 1f ba a7 e0 d2 bf c6 cc 9d ca db b0 7c 3e 4b 14 ff 00 4d 4f b1 5f f5 7f 0b 42 Data Ascii: lcOuQK&9=[]UcXI$T?N2FhH qT#P03h} C7Xny_,(XGeReg;cx6z{-j-)IfE2$$`5PNB@O%A2;kOLJluZz9`Hlr) \|>KMO_B
2025-04-21 21:12:31 UTC	546	IN	Data Raw: 4a eb 65 95 99 e7 ba a7 b3 fa 6e a2 af 52 f1 9a e2 71 e7 e4 fc af ed c9 5b 79 58 d3 ff 00 81 cd 4d dd 20 cb fc 5d 1d 7f c3 6a b1 3c 5b f6 16 59 7f dd 63 fa 37 fe 56 fb 90 9d ac da 69 e6 d1 a8 88 08 22 34 dd a6 e2 cc 75 62 38 56 80 7a b5 d6 d7 46 d1 3d 97 4c f6 7f 4f d3 b7 a7 ef 4d ec e4 f9 b7 84 b8 4b ef f9 91 d6 b9 35 9b 33 d0 76 ec 66 8a 12 2c 6e 23 88 7c 53 9b 0b 83 11 b6 18 4b 32 20 df 23 2a 0e 7d 62 17 ef b2 b5 b0 52 2d a7 f3 89 d3 41 e1 c2 dc e6 cd 6a 03 4b be 29 a7 01 ed 36 56 86 c4 a6 e9 ae 93 0f aa 7d c6 dd 95 13 1f 70 12 45 97 d5 3e eb 2e 04 ee 03 bc 92 7a a7 dc 6d 1c 10 bd d6 63 f4 e7 e5 69 8a 03 a8 cc 6f 88 37 2b 1c 51 3b 87 4f ce a7 95 86 28 39 9d c6 27 d9 69 8a 06 6c e4 e2 96 96 44 c8 cd 0e 27 60 0b 93 df 22 b1 09 2f b7 04 e1 e9 51 48 d5 d2 Data Ascii: JenRq[yXM ]j<[Yc7Vi"4ub8VzF=LOMK53vf,n#\|SK2 #*}bR-AjK)6V}pE>.zmcio7+Q;O(9'ilD'`"/QH

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:32 UTC	522	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=sk&oit=1&cp=2&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CLbgygE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:32 UTC	1303	IN	HTTP/1.1 200 OK Date: Mon, 21 Apr 2025 21:12:32 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-bw3Zy_SV1X9tS3eZG7T4Eg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-21 21:12:32 UTC	21	IN	Data Raw: 39 35 39 0d 0a 29 5d 7d 27 0a 5b 22 73 6b 22 2c 5b 22 73 6b 79 Data Ascii: 959)]}'["sk",["sky
2025-04-21 21:12:32 UTC	1324	IN	Data Raw: 20 68 61 72 62 6f 72 22 2c 22 73 6b 79 20 68 61 72 62 6f 72 22 2c 22 73 6b 69 6d 73 22 2c 22 73 6b 79 73 63 61 6e 6e 65 72 22 2c 22 73 6b 65 63 68 65 72 73 22 2c 22 73 6b 79 20 68 61 72 62 6f 72 20 70 61 72 6b 69 6e 67 22 2c 22 73 6b 69 6e 73 22 2c 22 73 6b 69 6e 64 65 78 22 2c 22 73 6b 79 70 65 22 2c 22 73 6b 65 74 63 68 75 70 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 67 76 62 53 38 77 63 33 6c Data Ascii: harbor","sky harbor","skims","skyscanner","skechers","sky harbor parking","skins","skindex","skype","sketchup"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"CggvbS8wc3l
2025-04-21 21:12:32 UTC	1055	IN	Data Raw: 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 6b 76 62 53 38 77 4e 58 67 79 61 32 63 53 45 45 5a 76 62 33 52 33 5a 57 46 79 49 47 4e 76 62 58 42 68 62 6e 6b 79 5a 47 68 30 64 48 42 7a 4f 69 38 76 5a 57 35 6a 63 6e 6c 77 64 47 56 6b 4c 58 52 69 62 6a 41 75 5a 33 4e 30 59 58 52 70 59 79 35 6a 62 32 30 76 61 57 31 68 5a 32 56 7a 50 33 45 39 64 47 4a 75 4f 6b 46 4f 5a 44 6c 48 59 31 52 78 52 47 31 32 55 47 55 32 63 44 5a 51 4e 30 74 36 62 55 4a 43 61 58 4e 78 55 32 64 36 56 47 70 75 4e 57 70 48 54 6a 5a 32 63 44 42 6c 56 47 4e 51 53 44 6c 76 4a 6e 4d 39 4d 54 41 36 43 46 4e 4c 52 55 4e 49 52 56 4a 54 53 67 63 6a 4d 57 51 31 4d 44 63 31 55 6a 5a 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 46 41 78 56 47 4e 33 63 6c 52 45 53 31 52 73 5a 47 64 4f Data Ascii: e:entityinfo":"CgkvbS8wNXgya2cSEEZvb3R3ZWFyIGNvbXBhbnkyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1RxRG12UGU2cDZQN0t6bUJCaXNxU2d6VGpuNWpHTjZ2cDBlVGNQSDlvJnM9MTA6CFNLRUNIRVJTSgcjMWQ1MDc1UjZnc19zc3A9ZUp6ajR0VFAxVGN3clRES1RsZGdO
2025-04-21 21:12:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 48

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:33 UTC	523	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skc&oit=1&cp=3&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CLbgygE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:33 UTC	1303	IN	HTTP/1.1 200 OK Date: Mon, 21 Apr 2025 21:12:33 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-qeW3cSJH1qNE79aokzg_dg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-21 21:12:33 UTC	21	IN	Data Raw: 37 63 64 0d 0a 29 5d 7d 27 0a 5b 22 73 6b 63 22 2c 5b 22 73 6b Data Ascii: 7cd)]}'["skc",["sk
2025-04-21 21:12:33 UTC	1324	IN	Data Raw: 63 22 2c 22 73 6b 63 22 2c 22 73 6b 65 63 68 65 72 73 22 2c 22 73 6b 63 63 22 2c 22 73 6b 63 63 20 73 6b 65 64 20 70 61 67 65 22 2c 22 73 6b 63 20 6c 69 76 65 73 74 6f 63 6b 22 2c 22 73 6b 63 20 6d 65 61 6e 69 6e 67 22 2c 22 78 6b 63 64 22 2c 22 73 6b 63 20 77 65 73 74 22 2c 22 73 6b 63 20 66 6f 6f 64 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 67 76 62 53 38 77 4e 44 6c 6b 58 78 49 6b 55 33 42 Data Ascii: c","skc","skechers","skcc","skcc sked page","skc livestock","skc meaning","xkcd","skc west","skc foods"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"CggvbS8wNDlkXxIkU3B
2025-04-21 21:12:33 UTC	659	IN	Data Raw: 45 64 79 62 33 56 77 49 4d 4b 33 49 46 42 6f 62 32 56 75 61 58 67 73 49 45 46 61 4d 6c 39 6f 64 48 52 77 63 7a 6f 76 4c 32 78 6f 4d 79 35 6e 62 32 39 6e 62 47 56 31 63 32 56 79 59 32 39 75 64 47 56 75 64 43 35 6a 62 32 30 76 63 43 39 42 52 6a 46 52 61 58 42 50 52 55 4a 46 4e 56 39 4b 57 6d 56 72 65 45 4d 79 4f 48 46 51 4d 33 4a 53 65 6b 4e 34 65 47 5a 45 62 6d 4a 34 62 47 39 48 4c 57 78 4e 4d 57 31 74 63 7a 31 33 4f 54 49 74 61 44 6b 79 4c 57 34 74 61 79 31 75 62 7a 6f 4a 63 32 74 6a 49 47 5a 76 62 32 52 7a 55 6d 74 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 6c 41 78 65 6d 4d 77 56 45 52 6a 63 6e 6c 71 55 45 70 35 63 32 64 35 57 55 78 53 55 30 35 68 61 58 64 4e 52 47 52 4c 54 57 70 54 4d 55 35 46 4e 44 4a 4e 4d 47 64 35 54 6c 52 46 65 6e 52 71 Data Ascii: Edyb3VwIMK3IFBob2VuaXgsIEFaMl9odHRwczovL2xoMy5nb29nbGV1c2VyY29udGVudC5jb20vcC9BRjFRaXBPRUJFNV9KWmVreEMyOHFQM3JSekN4eGZEbmJ4bG9HLWxNMW1tcz13OTItaDkyLW4tay1ubzoJc2tjIGZvb2RzUmtnc19zc3A9ZUp6ajR0VlAxemMwVERjcnlqUEp5c2d5WUxSU05haXdNRGRLTWpTMU5FNDJNMGd5TlRFenRq
2025-04-21 21:12:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:33 UTC	446	OUT	GET /p/AF1QipOmr7r4r2OkPRKl8qLAsxl2FcHLYBZKL-ddVnIM=w92-h92-n-k-no HTTP/1.1 Host: lh3.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:34 UTC	536	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="2023-07-17.jpg" X-Content-Type-Options: nosniff Server: fife Content-Length: 3456 X-XSS-Protection: 0 Date: Mon, 21 Apr 2025 19:23:25 GMT Expires: Tue, 22 Apr 2025 19:23:25 GMT Cache-Control: public, max-age=86400, no-transform Age: 6549 ETag: "v95" Content-Type: image/jpeg Vary: Origin Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-21 21:12:34 UTC	788	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 2a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 31 01 02 00 07 00 00 00 1a 00 00 00 00 00 00 00 47 6f 6f 67 6c 65 00 00 ff db 00 84 00 03 02 02 0a 08 08 09 09 0f 0a 0b 0a 0b 08 08 0a 0d 0b 08 0a 0c 08 0a 0a 08 08 0d 08 08 08 08 08 08 08 0a 08 08 08 08 0d 08 0a 08 08 0b 0d 08 08 08 08 09 09 0a 0a 0a 0e 0d 0d 08 0d 08 08 0a 08 01 03 04 04 06 05 06 0a 06 06 0a 0f 0d 0a 0e 0f 0f 0d 0d 0d 0d 0f 0e 0d 0d 0f 0d 0e 0d 0d 0d 0d 0d 0f 0d 0f 0d 0d 0e 0d 0d 0d 0d 0e 0d 0d 0d 0e 0d 0d 0d 0d 0d 0d 0d 0e 0d 0d 0d 0d 0d 0d 0d 0d 0d ff c0 00 11 08 00 5c 00 5c 03 01 11 00 02 11 01 03 11 01 ff c4 00 1d 00 01 00 02 03 01 00 03 00 00 00 00 00 00 00 00 00 00 07 08 04 05 06 03 01 02 09 ff c4 00 47 10 00 02 Data Ascii: JFIFExifII1Google\\G
2025-04-21 21:12:34 UTC	1324	IN	Data Raw: dc 29 e4 a5 92 68 92 55 20 87 8c 4a ac a4 10 55 7a 62 ca 1a 88 d5 44 6d b5 7b ed d1 d7 42 60 9f d1 aa a2 2c 8c 22 96 97 38 2a b2 a3 89 22 90 06 90 8d 51 ba 86 53 6e 44 7d 58 95 8b 4b b4 c8 79 13 f2 30 b6 9f 7f 71 51 2d 33 71 a2 d5 4d 29 64 55 83 34 b3 c8 4a 85 2c b2 71 39 ad 88 1a 48 f6 9b dc 31 3e 17 a8 d6 76 f3 ef 9f 99 dc fc 9c 5f d9 56 7c 2f 6b 72 f8 62 3c 35 dc 6a 65 76 d9 5c f2 a2 86 6a c9 63 25 da bf 32 7a c7 0d 1c c3 4c ef 2b ca d1 a5 a3 07 4d e4 36 d5 72 3c cf 3c 7a dd 1f 59 ff 00 95 49 28 a7 7d ef b5 1e 77 57 d1 47 a9 71 94 b6 d3 c5 7b d9 ca d4 6d 95 46 61 59 45 9a c6 bc 5f 44 69 b8 7a 15 f8 73 6a 32 23 ab ea 5d 5e a3 17 02 c4 74 e7 7e 58 d3 27 5c f2 66 86 6d 2b f8 a6 92 df cd 35 f7 29 8f a1 86 3c 53 c4 b8 95 5f f4 d3 fb 13 06 c9 6f 8b 5f 94 45 Data Ascii: )hU JUzbDm{B`,"8*"QSnD}XKy0qQ-3qM)dU4J,q9H1>v_V\|/krb<5jev\jc%2zL+M6r<<zYI(}wWGq{mFaYE_Dizsj2#]^t~X'\fm+5)<S_o_E
2025-04-21 21:12:34 UTC	1324	IN	Data Raw: 54 54 67 af 2c 23 5a f2 24 c5 a6 f6 e8 6e 39 da f8 bc 77 b6 61 96 7a a5 7f bb 2a 34 bb b6 f6 61 53 5d 92 55 a4 54 b2 d4 bc 3b 44 e5 d6 28 da 46 89 4d 0e 9b 9d 20 90 1c e8 f7 1b 0f 2c 55 34 9e ff 00 bb 95 43 7c 5d 85 a8 a5 ca 72 b8 64 a7 96 9d a7 cd 26 f9 39 63 78 8c 9a 69 60 50 da 59 54 b0 8f 88 de b0 04 2e a6 f3 38 4a 9b d8 1a 7d cd 3b 2f 67 ce 27 a6 01 4b cf 94 c8 11 58 aa 87 91 33 4c ae 46 0a 5a c2 fc 30 7c 7a 03 d0 02 47 3f 51 8e 52 85 47 9f c6 e4 29 25 c9 97 bf 3f 66 ed 1e 77 4d 01 0a ad 0e 47 16 b4 56 56 b3 b6 61 99 b2 82 54 91 7d 00 13 cf a1 1e 63 11 d3 6f 1a 7c ab 4f fd 0c ed b7 42 ed c3 26 cb 32 d9 32 fa ba 06 7a 98 25 99 84 c9 4a b3 8a a8 25 7d 71 38 91 15 e4 e3 25 9a 3b c8 a2 c8 91 aa 19 39 ac 35 cb 0c b3 6f 1b 4b 43 5f 12 7a 72 45 d3 e3 67 6b Data Ascii: TTg,#Z$n9waz*4aS]UT;D(FM ,U4C\|]rd&9cxi`PYT.8J};/g'KX3LFZ0\|zG?QRG)%?fwMGVVaT}co\|OB&22z%J%}q8%;95oKC_zrEgk
2025-04-21 21:12:34 UTC	20	IN	Data Raw: c0 0c 00 c0 0c 00 c0 0c 00 c0 0c 00 c0 0c 00 c0 0c 01 ff d9 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:33 UTC	446	OUT	GET /p/AF1QipOEBE5_JZekxC28qP3rRzCxxfDnbxloG-lM1mms=w92-h92-n-k-no HTTP/1.1 Host: lh3.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:34 UTC	539	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="2023-03-03.jpg" X-Content-Type-Options: nosniff Server: fife Content-Length: 2677 X-XSS-Protection: 0 Date: Mon, 21 Apr 2025 19:22:56 GMT Expires: Tue, 22 Apr 2025 19:22:56 GMT Cache-Control: public, max-age=86400, no-transform Age: 6578 ETag: "v26883" Content-Type: image/jpeg Vary: Origin Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-21 21:12:34 UTC	785	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 5c 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 02 00 31 01 02 00 07 00 00 00 26 00 00 00 69 87 04 00 01 00 00 00 2e 00 00 00 00 00 00 00 47 6f 6f 67 6c 65 00 00 02 00 00 90 07 00 04 00 00 00 30 32 32 30 86 92 07 00 07 00 00 00 4c 00 00 00 00 00 00 00 6f 70 6c 75 73 5f 30 00 ff db 00 84 00 03 02 02 0a 08 08 08 08 08 0e 08 0a 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 07 08 08 08 08 08 08 08 08 08 08 08 07 08 08 08 08 0a 08 08 08 08 0a 0a 0a 08 08 0d 0d 0a 08 0d 07 08 09 08 01 03 04 04 06 05 06 08 06 06 0a 0d 0d 0a 0e 0d 0d 0d 0d 0d 0d 0d 0f 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0e 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0e 0d 0d 0e 0d 0d 0d 0e 0f 0e 0e 0d 0d 0e 0e 0d 0d 0d 0d 0d ff c0 00 11 08 00 5c Data Ascii: JFIF\ExifII*1&i.Google0220Loplus_0\
2025-04-21 21:12:34 UTC	1324	IN	Data Raw: 96 a5 06 97 65 a1 c6 a3 b8 54 2c 14 84 96 8c 96 92 a4 97 33 2b 35 d2 15 65 04 fc be 0e f1 cf 56 aa d5 9f 45 8b bb 5c 75 8b 4f e5 f7 36 86 db 49 28 09 20 f4 81 45 05 3d 64 ab 21 19 c0 5a 6e 92 b4 02 14 5b be 70 95 25 56 ca b4 a8 fb 7d a5 77 39 cf 65 9a 57 5f 21 de cf 17 b7 1b a8 7f 49 b1 f8 1a a5 b4 a7 d4 ca 58 0d 74 2f d9 75 5e d0 8c 9e 0b ec 0a b0 ca af 68 42 e0 b0 46 1d 4f da 05 c0 61 27 0e a7 c7 42 e0 8c 18 6d 3e 38 70 59 7e cf a3 8e 83 82 cf 4f 07 e4 b1 79 41 20 a5 37 17 04 dc fa 57 27 1f 7c e1 e1 4f 87 4d be bd be 67 6b 67 dc f8 98 b8 7c 4b 49 74 ef f2 37 68 3c de b4 c8 ce af b4 58 b7 be 91 90 77 84 6a 0f e2 2a f2 ae 56 d3 bd 71 b1 13 50 f7 57 87 3f 5f b5 1d 4c 0d d9 85 86 ee 5e f3 f1 e5 e9 f7 b1 f1 dc 25 29 2b b0 51 48 b8 49 25 20 db 50 92 40 ea 8e Data Ascii: eT,3+5eVE\uO6I( E=d!Zn[p%V}w9eW_!IXt/u^hBFOa'Bm>8pY~OyA 7W'\|OMgkg\|KIt7h<Xwj*VqPW?_L^%)+QHI% P@
2025-04-21 21:12:34 UTC	568	IN	Data Raw: 78 ab 4d da 66 36 fe 91 6f 0a 54 31 67 15 3c 33 7e 24 ef f2 39 7d 2a 68 63 84 b5 6f 25 23 4e 09 fc c1 3f 9d 43 a2 83 13 07 f0 13 d8 42 af f1 d7 85 4d 0e c5 af 11 48 f7 b2 0b ee b9 00 7c d2 28 a2 ac 7e d2 9b 5c 5a dd a1 66 df 10 7f 2a 54 16 10 52 4f 6f 92 b4 f5 a7 41 64 5d bf 8b e4 7f 31 4e 84 c4 a9 c0 37 f0 ee 23 f5 a2 89 23 99 7b c7 c6 aa 85 62 4a 13 db f2 a7 94 56 79 89 c4 40 55 ac ae fe a9 24 7d 78 56 84 8d 93 2b 4b b7 75 11 c1 44 23 c7 52 93 63 e5 f0 a4 31 50 26 ab ef 24 0e 1e f0 27 76 e0 01 d7 bc e9 eb 49 8d 19 8e 4b 16 d6 fa 77 70 fa ec ac ca 29 b9 49 36 d7 c3 aa 3f cf ad 21 d1 9b 19 8c da 0e 1c 0a 4d be 39 6d e1 6b d2 19 0c 2b ef d0 0b 92 42 88 1f f9 29 d6 d4 80 47 42 74 b0 d3 b7 5f d4 fc e9 d8 00 58 3a ef 16 e0 09 1e 60 9d 35 ec 34 c9 a1 85 85 11 Data Ascii: xMf6oT1g<3~$9}hco%#N?CBMH\|(~\ZfTROoAd]1N7##{bJVy@U$}xV+KuD#Rc1P&$'vIKwp)I6?!M9mk+B)GBt_X:`54

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:34 UTC	446	OUT	GET /p/AF1QipOIgPrwEvvRIpzC-2Pd8GaQzShZC9U-zRUNlOTv=w92-h92-n-k-no HTTP/1.1 Host: lh3.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:35 UTC	533	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="unnamed.jpg" X-Content-Type-Options: nosniff Server: fife Content-Length: 6371 X-XSS-Protection: 0 Date: Mon, 21 Apr 2025 19:23:25 GMT Expires: Tue, 22 Apr 2025 19:23:25 GMT Cache-Control: public, max-age=86400, no-transform ETag: "v43" Content-Type: image/jpeg Vary: Origin Age: 6550 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-21 21:12:35 UTC	791	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 62 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 02 00 31 01 02 00 07 00 00 00 26 00 00 00 69 87 04 00 01 00 00 00 2e 00 00 00 00 00 00 00 47 6f 6f 67 6c 65 00 00 02 00 00 90 07 00 04 00 00 00 30 32 32 30 86 92 07 00 0d 00 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff db 00 84 00 03 02 02 0f 0a 0b 0b 0a 0b 0d 0f 0a 0a 0a 0b 0e 0a 0d 0e 0d 0d 0a 0e 0d 0d 0d 08 0a 09 0a 0a 0a 0b 0b 0a 0d 0d 0e 0a 0b 0b 08 0b 0b 0a 0a 0a 0b 0b 08 0b 0a 0b 0a 10 0b 0f 0a 0a 0d 0b 0a 0d 0d 01 03 04 04 06 05 06 0a 06 06 0a 10 0e 0b 0e 12 10 10 10 10 10 10 10 0e 10 0f 0d 10 0f 10 10 0d 0d 10 10 10 10 0f 10 0f 0f 10 10 10 10 10 0f 0f 0d 0e 10 10 0f 0f 0f 0d 0f 0f 10 0f 10 10 0f 0f 0f ff Data Ascii: JFIFbExifII*1&i.Google0220L
2025-04-21 21:12:35 UTC	1324	IN	Data Raw: 2a 54 10 bb 81 6d da 2d a1 c6 ff 00 a8 f3 80 15 09 00 d8 11 ca fe 1a 81 ad 16 74 a9 41 21 a9 4c c1 3c 39 c6 fe 75 98 73 8e d2 3d cc 41 5a 66 e6 8c 8f 12 41 5b 84 82 4b 00 04 5d ea 13 07 1c 02 31 c5 c9 48 1d 6d d1 ab 15 85 6f 29 ca 2b 3a fa 89 d3 b4 2b 83 56 92 8a 6c 51 1e db 94 98 b1 6e 2f e5 e1 73 10 55 60 10 4d 80 36 e0 5a c4 b9 da 14 ae e2 48 fd ad 7e 75 32 59 01 36 14 ab 57 a4 34 aa 6d ee 56 78 81 75 37 a7 45 58 c0 b8 8a 6e ae c4 5d 20 3b 14 2c a0 13 4d 0e 38 72 99 c4 ac c8 4a 07 22 0a 8f 98 20 7b af e3 5d 0b 6c 5b 31 f7 40 af 5e 74 df d5 c5 14 db 4f 5a a0 0d 76 03 06 22 ca 8b 6e 0a 8f 19 04 e0 90 40 20 88 38 e3 e7 5a 69 e5 94 ba ca 4e 5f 8c 83 44 e3 cc a2 5a 75 42 7e 84 53 e8 e6 e9 46 8a 56 a8 d7 d3 1e 04 28 04 35 e3 c8 87 26 0e 60 00 05 c0 00 4d a6 Data Ascii: *Tm-tA!L<9us=AZfA[K]1Hmo)+:+VlQn/sU`M6ZH~u2Y6W4mVxu7EXn] ;,M8rJ" {]l[1@^tOZv"n@ 8ZiN_DZuB~SFV(5&`M
2025-04-21 21:12:35 UTC	1324	IN	Data Raw: 85 3b 49 24 1f fa 40 24 60 cf 11 2b 10 8c e1 0a a3 67 0c 16 92 e8 d3 86 94 bb 4f 5b bc b1 99 24 e3 e7 f7 e2 f9 14 61 06 97 b4 fc f1 dd 55 89 d8 0c 93 ef b8 81 ed b7 b4 47 09 2e 24 18 de b3 83 76 98 a2 55 79 cd 6a b6 4d 43 2f 91 7d 55 55 33 b4 35 46 55 92 76 13 c7 9a 53 57 09 8b 6b 46 e1 59 f6 af 46 b9 53 54 a4 c8 d5 4a d4 49 b6 16 49 04 97 00 35 c8 01 cd 37 82 8d 50 08 c9 01 92 ec f7 1c 69 73 94 5f dd d6 f5 ab 83 6f bf de d2 b4 ea 3a 9e e5 16 aa 89 01 49 58 f2 cd aa ac 40 20 c4 c1 10 b8 27 f4 e1 07 12 94 28 20 8d 6a f7 52 90 a0 2f f0 a9 7a 69 3e f3 46 bd 32 c6 91 60 15 59 60 db 2b 50 16 37 6c 01 20 98 2b b4 ce 20 83 b8 80 d5 c8 9a 8b 15 87 0a 28 e5 af da b3 4d 37 2f 7d 35 77 6a 7a b7 5a b4 62 2a 0b e9 b8 66 53 70 4a 81 cb 53 02 4a de ad e4 a4 98 01 a3 83 Data Ascii: ;I$@$`+gO[$aUG.$vUyjMC/}UU35FUvSWkFYFSTJII57Pis_o:IX@ '( jR/zi>F2`Y`+P7l + (M7/}5wjzZb*fSpJSJ
2025-04-21 21:12:35 UTC	1324	IN	Data Raw: 46 78 47 66 73 28 eb 7b 5e 34 fc f2 ab 82 c3 9d d1 6f 1e 15 cd 1d 7f f6 2a 52 6d 24 53 ee 43 03 ee 0c 34 9f 50 23 f8 64 ac b6 16 00 ad 68 3e d1 24 fe a9 da 78 56 7a 5c 19 b2 db 87 38 e3 15 76 95 03 6d f5 11 51 ee 3b 32 b9 b5 6c 00 b0 f6 3e cc 46 05 c1 66 e1 c5 38 21 eb 84 a9 d1 a4 75 bd ad c6 4d e9 78 a5 7a bc 04 1d 67 ae b4 aa dc d3 40 aa 43 2a a5 cd ec c4 21 fd 59 0d a4 29 69 37 18 19 c8 3b 8e 28 c6 36 b6 82 42 12 a5 ea 79 8f 86 9a fe 76 4e 15 c0 b2 4a 94 13 f5 f8 d0 8e 6b cb 88 40 b6 82 4d 4b b3 79 51 01 48 60 40 86 12 58 66 08 8c a9 bb 88 8a 48 48 29 04 da 0f 23 a4 4c 01 b8 16 de aa 4a 81 51 0a 20 70 f0 e3 af 42 8c 6a 96 99 82 a7 25 45 de 07 d4 04 18 15 09 21 60 00 04 91 1e e4 cf 02 e6 01 c5 c1 48 1a 0d 67 5f 31 5e 46 31 29 90 4e fb 11 58 6d 3f ad da Data Ascii: FxGfs({^4oRm$SC4P#dh>$xVz\8vmQ;2l>Ff8!uMxzg@C!Y)i7;(6ByvNJk@MKyQH`@XfHH)#LJQ pBj%E!`Hg_1^F1)NXm?
2025-04-21 21:12:35 UTC	1324	IN	Data Raw: 57 14 e3 cc 39 4a 35 33 a4 91 dc b1 52 3f 3d f4 ad 2a d6 93 00 b3 88 20 35 c0 6e b9 3c 60 a5 2b 0f 76 82 3f 7d bf 31 57 17 13 d9 c4 1a cc a8 74 b1 0e cb 50 43 2f 89 59 c8 23 79 8f 8d a3 de 78 b5 ec 4e 51 dc 37 a2 69 b0 ab 91 6a 33 f7 5b 34 f5 90 45 a5 c5 48 f7 12 d4 12 37 ce 41 69 8f d3 13 c7 58 c4 76 89 83 a8 a0 71 8c ae 82 34 fc 1a 4e 7d 2f ef fd 38 a3 3c 51 16 eb 6c e9 de 84 65 5a f5 4a ba da f4 56 2d 11 8a 68 1a 4b 29 1b d3 02 25 08 06 e1 25 94 8f 93 7b 12 92 52 07 3f 9f e6 a9 6c 11 af 2a 8f a4 fa 69 96 8a 3b 86 56 52 69 15 b5 40 04 a4 c1 72 ac b7 5c 20 a4 b1 07 05 62 e3 c3 5d c5 0c c4 27 4e 37 fc 50 a5 ab 02 68 b7 2c fa 70 25 1e e9 52 27 0a 0e 55 5d 00 c4 98 25 96 49 02 24 48 8c f1 e5 3e 14 08 af 25 05 26 68 6f 38 e8 86 aa 9d da 4e a1 a8 b9 6b 2a 20 Data Ascii: W9J53R?=* 5n<`+v?}1WtPC/Y#yxNQ7ij3[4EH7AiXvq4N}/8<QleZJV-hK)%%{R?li;VRi@r\ b]'N7Ph,p%R'U]%I$H>%&ho8Nk
2025-04-21 21:12:35 UTC	284	IN	Data Raw: f9 62 45 b2 22 a5 e1 90 ad 76 e7 5c 6d e5 c5 76 e9 de b5 74 5a 88 b6 da cc d5 0c a8 32 5c 8c 67 d8 01 0a 3d 87 ce 21 6f 61 1b 5c 13 36 81 a9 16 f3 a6 b6 f2 87 0f 21 45 ba 07 a8 dd 95 2e 20 93 7c 98 c9 b5 2a 95 04 88 98 b5 40 f7 81 f3 9e 33 5e c2 a1 0a 84 c8 1c 27 98 aa bd 61 59 66 07 95 7d fe de 67 d2 14 26 3f 0d 1e e1 ea 9c 1f db 71 f1 b6 36 e1 63 08 86 de 91 31 26 c7 4a a0 62 14 a4 9d 3c 77 a2 9c ef 9b 9a 88 f4 8e 02 a2 b4 82 d2 48 72 b9 24 9c 11 83 81 b9 da 78 e3 4c 00 bc c4 93 c8 c4 7c a9 6b c4 1c a2 00 f1 bf de 87 75 df 32 27 4d 51 bd 26 91 a2 54 82 e3 f8 b5 f4 b4 5a 7c bf c3 ac f1 b4 10 be cb 1c 1e 11 19 9d 85 19 17 d6 36 07 95 13 ce 64 48 ca 23 ce a2 ab a8 25 40 b8 8b 1e 99 90 72 de 68 90 c4 cc 82 1a 71 69 90 33 12 0b 20 49 04 5a f5 d2 4a 40 23 5a Data Ascii: bE"v\mvtZ2\g=!oa\6!E. \|*@3^'aYf}g&?q6c1&Jb<wHr$xL\|ku2'MQ&TZ\|6dH#%@rhqi3 IZJ@#Z

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:34 UTC	446	OUT	GET /p/AF1QipMUHoFviYARFYuXqZTxzX_A4b7QBl7eW2EhnvXX=w92-h92-n-k-no HTTP/1.1 Host: lh3.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:35 UTC	537	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="2024-01-10.jpg" X-Content-Type-Options: nosniff Server: fife Content-Length: 5560 X-XSS-Protection: 0 Date: Mon, 21 Apr 2025 19:23:25 GMT Expires: Tue, 22 Apr 2025 19:23:25 GMT Cache-Control: public, max-age=86400, no-transform Age: 6550 ETag: "v281" Content-Type: image/jpeg Vary: Origin Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-21 21:12:35 UTC	787	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 2a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 31 01 02 00 07 00 00 00 1a 00 00 00 00 00 00 00 47 6f 6f 67 6c 65 00 00 ff db 00 84 00 03 02 02 03 0b 0d 0b 0b 09 0d 0a 0d 0e 0d 0b 0b 0d 0a 0b 0b 0b 0a 0b 0a 0e 10 0a 0a 0d 0b 0d 0d 0d 0a 0b 0b 08 0e 10 0a 0d 0a 0a 0a 0a 0a 0a 0a 08 0a 09 0b 0a 0d 0d 0b 0d 0a 0e 0f 0a 08 0a 08 01 03 04 04 06 05 06 0a 06 06 0a 10 0e 0b 0e 0e 0f 0f 0d 0e 0d 0f 0f 10 0f 0e 10 0d 0f 0f 0f 0f 0d 0f 0f 0f 10 0e 10 0d 0d 0d 0e 0f 0d 0d 0f 0d 0f 0e 0d 0d 0f 0d 0d 0f 0d 0d 0d 0d 0f 0d 0d 0d 0d ff c0 00 11 08 00 5c 00 5c 03 01 11 00 02 11 01 03 11 01 ff c4 00 1d 00 00 02 02 03 01 01 01 00 00 00 00 00 00 00 00 00 06 07 04 05 01 03 08 02 09 00 ff c4 00 44 10 00 02 Data Ascii: JFIFExifII1Google\\D
2025-04-21 21:12:35 UTC	1324	IN	Data Raw: f9 2e e5 8c 84 ac 70 54 93 0b 9c b2 12 a8 4a 48 d2 3b 90 ad 99 3a 1a ed 2d 75 85 bb be cb 3e 9b c1 1a dd 29 a1 6a 98 eb 25 91 b9 1e d2 35 6b 89 1d e0 51 21 52 08 94 46 a4 ab 35 ce 63 1a a5 db de d4 13 93 88 1e c7 b0 9c a6 53 57 0e 15 51 3b 1a 85 4b 4d 90 47 2a 12 63 52 ab 95 63 72 40 20 b3 16 68 9c fb 36 66 e5 92 ac 62 13 09 a6 02 b9 d5 60 d2 99 a4 e9 ec 90 9f 8f 31 d0 fc ff 00 47 1b 0f 89 79 47 65 88 f3 aa 5c a7 54 39 c5 6a 5f 6d 41 a1 fd 68 7f 93 2e de 1a 15 0e d4 26 3d 15 1a e9 d7 f2 36 5c 14 52 a5 cc 91 81 73 f4 da d2 a1 2c 38 d5 84 45 ea ea cc 01 63 3c 20 5c 5e d9 9c 2f c3 4b 1d 40 22 e3 4b 8d 08 2b 2e a8 f4 c5 5d cd c5 65 45 59 a5 88 80 c8 d6 8e 07 8e e5 18 32 f5 a8 94 d8 38 56 d1 81 b8 1a f5 b8 e4 2b e5 94 49 49 b9 ed cc 59 65 76 76 45 65 8d 6c aa Data Ascii: .pTJH;:-u>)j%5kQ!RF5cSWQ;KMG*cRcr@ h6fb`1GyGe\T9j_mAh.&=6\Rs,8Ec< \^/K@"K+.]eEY28V+IIYevvEel
2025-04-21 21:12:35 UTC	1324	IN	Data Raw: 64 1a 75 d2 c0 5f 65 31 38 9c 63 3f 87 45 ff 00 43 bc 91 69 b7 0e ef cd 50 7d 41 4c e2 9e f3 61 90 d2 c6 98 66 24 ae 79 f4 e9 92 0a a8 26 60 8e d9 08 21 73 b6 42 4a a9 6b 82 09 16 6b 91 71 e0 31 b8 b7 d4 2c ae d2 04 13 76 91 d5 b1 56 bd 2a 11 34 cc 99 de 89 eb b8 52 63 02 d9 ba 77 d9 ba 18 f6 d4 b2 f3 f0 d9 54 03 bb 4e 3c ff 00 3f 4d b5 05 49 49 96 42 41 fa 58 51 e5 86 9a fd eb e9 47 da e4 ff 00 f7 67 a8 3a 67 a0 a5 ea 0b 75 ae 8e 87 d5 ed d5 7e d1 fe bb 67 ca 34 2e 28 e1 be 0b ba b3 2c 06 68 c0 55 65 8e 55 12 37 8b 34 ed 79 06 60 d9 06 56 55 64 0a 56 e8 58 10 64 39 34 ab 56 7b 49 70 f7 64 8b 69 b7 2a 2b de ac 23 87 d0 62 50 44 8a e2 98 52 35 96 99 dd cf 30 e6 25 af 9c 1b 12 09 75 cf 96 e7 a6 d9 81 d8 87 51 73 c9 e5 e6 db 1a 22 1c a2 04 59 53 56 70 df 70 Data Ascii: du_e18c?ECiP}ALaf$y&`!sBJkkq1,vV4RcwTN<?MIIBAXQGg:gu~g4.(,hUeU74y`VUdVXd94V{Ipdi+#bPDR50%uQs"YSVpp
2025-04-21 21:12:35 UTC	1324	IN	Data Raw: 1e 8b 09 78 00 13 11 30 09 31 d4 0a 31 8b 84 7b c5 3d dd 60 a9 19 00 30 86 8d a1 ff 00 78 1c a8 0c b0 9f 11 be ac 19 ad a5 ec b1 85 c0 3c 23 46 89 ca ea 8c 33 a9 06 7b 6e 7c 16 b9 c0 d4 a8 33 36 9b bf c8 47 65 82 8b 51 e8 fd 8f 43 79 12 9e b7 29 74 2c 39 3c c4 5b 38 b5 d9 23 90 84 50 58 96 3a 00 06 66 36 d4 cd e1 5a 35 06 5e 31 b3 07 f9 a3 bc 89 3c dd 88 3f 2e a8 d7 49 61 b9 dd fb c2 d8 dc 14 c6 c4 10 e2 48 84 52 b1 e6 cc 64 aa 8d e4 55 7c ca 1a 44 29 06 61 9d c0 89 92 ec a8 f6 28 6e d2 2c 33 1c 38 c7 61 9c 79 7a 00 01 d4 6a 26 f7 df ce 11 2a 61 22 93 6b 30 1c ba 92 63 43 a1 85 5e 24 c3 39 51 e5 75 b8 58 c3 59 85 fa 20 23 4d 6d a1 d3 a7 5f 33 b1 cf 18 1e 4c 5a fe 29 36 86 18 1d 08 7e ae 8a 87 c7 61 a2 c8 a3 57 0c 0d c2 bd fd d1 6c be 25 20 dc 92 0b 13 d8 Data Ascii: x011{=`0x<#F3{n\|36GeQCy)t,9<[8#PX:f6Z5^1<?.IaHRdU\|D)a(n,38ayzj&*a"k0cC^$9QuXY #Mm_3LZ)6~aWl%
2025-04-21 21:12:35 UTC	801	IN	Data Raw: 84 8d 39 49 fe 11 ff 00 bd ad c7 3f 79 54 34 db b9 51 e3 1b 9b 80 5f 58 94 11 a8 d3 bd 8a f9 6b a1 3f 2e bd 81 d9 86 62 1e 2f 98 a1 9a 4d 8d 17 20 7a 68 6e 6d 1c 26 91 a1 46 c8 7d 60 49 20 b9 8c 12 61 c8 a4 90 6c cc 39 85 2e 45 c0 3a 1e ab d8 70 3d 73 50 3c 38 dc 44 0e d9 3d cb 0f 1d 4c 33 2c 0b 5f c3 d5 24 f8 33 c5 ed e3 c3 a7 89 e9 a6 78 d2 f9 24 8c b5 e9 f2 c8 6c 4b 44 e4 a0 0a d6 91 9d 54 38 0a 75 b1 60 da 78 ec 15 3c 5d 32 d7 b4 13 a8 3b 64 73 8b df 48 d2 e9 2c 35 77 51 78 70 36 da 36 7b da be 82 6e d7 1c 37 ee 48 d5 c4 78 74 a0 8b ac b1 4f 2e 46 04 5c 11 95 27 5f f0 ca c0 f5 d3 a0 e1 5d c1 74 9a 60 97 0e 68 1e 9d cb a5 18 c2 6e 00 29 ad 8b 7a ca 9e a2 d6 3e e8 d7 ec b7 4b 5f e2 7a 77 3b 2a c7 83 d2 8e 52 c3 7a 71 6a a6 47 e4 2b 33 5c 8e ca be 16 cb Data Ascii: 9I?yT4Q_Xk?.b/M zhnm&F}`I al9.E:p=sP<8D=L3,_$3x$lKDT8u`x<]2;dsH,5wQxp66{n7HxtO.F\'_]t`hn)z>K_zw;*RzqjG+3\

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:36 UTC	525	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcur&oit=1&cp=5&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CLbgygE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:36 UTC	1303	IN	HTTP/1.1 200 OK Date: Mon, 21 Apr 2025 21:12:36 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-V_MT2jbbwy-TZq0iKzQoJw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-21 21:12:36 UTC	21	IN	Data Raw: 32 35 38 0d 0a 29 5d 7d 27 0a 5b 22 73 6b 63 75 72 22 2c 5b 22 Data Ascii: 258)]}'["skcur",["
2025-04-21 21:12:36 UTC	586	IN	Data Raw: 73 6b 20 63 75 72 72 65 6e 63 79 22 2c 22 73 6b 20 63 75 72 72 65 6e 63 79 20 74 6f 20 75 73 64 22 2c 22 73 6b 20 63 75 72 69 6f 73 69 74 79 20 66 6f 6e 74 20 66 72 65 65 20 64 6f 77 6e 6c 6f 61 64 22 2c 22 73 6b 20 63 75 72 72 65 6e 63 79 20 63 6f 64 65 22 2c 22 73 6b 20 63 75 72 6c 20 63 72 65 61 6d 22 2c 22 73 6b 20 63 75 72 6c 69 6e 67 20 70 72 6f 76 69 6e 63 69 61 6c 73 22 2c 22 73 6b 63 75 72 65 22 2c 22 73 6b 20 63 75 72 72 69 63 75 6c 75 6d 22 2c 22 73 6b 20 63 75 72 72 65 6e 74 20 74 69 6d 65 22 2c 22 73 6b 20 63 75 72 74 61 69 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 Data Ascii: sk currency","sk currency to usd","sk curiosity font free download","sk currency code","sk curl cream","sk curling provincials","skcure","sk curriculum","sk current time","sk curtain"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"
2025-04-21 21:12:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:37 UTC	526	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcurt&oit=1&cp=6&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CLbgygE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:37 UTC	1303	IN	HTTP/1.1 200 OK Date: Mon, 21 Apr 2025 21:12:37 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tja5wuOpuzC8RN7kCDUw-g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-21 21:12:37 UTC	21	IN	Data Raw: 33 66 34 0d 0a 29 5d 7d 27 0a 5b 22 73 6b 63 75 72 74 22 2c 5b Data Ascii: 3f4)]}'["skcurt",[
2025-04-21 21:12:37 UTC	998	IN	Data Raw: 22 73 6b 69 72 74 73 22 2c 22 73 6b 69 72 74 20 73 74 65 61 6b 22 2c 22 73 6b 69 72 74 20 73 74 65 61 6b 20 72 65 63 69 70 65 73 22 2c 22 73 6b 69 72 74 20 73 65 74 73 22 2c 22 73 6b 69 72 74 69 6e 67 22 2c 22 73 6b 69 72 74 73 20 66 6f 72 20 77 6f 6d 65 6e 22 2c 22 73 6b 69 72 74 20 73 74 65 61 6b 20 6d 61 72 69 6e 61 64 65 22 2c 22 73 6b 69 72 74 65 64 20 74 6f 69 6c 65 74 22 2c 22 73 6b 69 72 74 20 69 6e 20 73 70 61 6e 69 73 68 22 2c 22 73 6b 69 72 74 69 6e 67 20 62 6f 61 72 64 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a Data Ascii: "skirts","skirt steak","skirt steak recipes","skirt sets","skirting","skirts for women","skirt steak marinade","skirted toilet","skirt in spanish","skirting board"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:
2025-04-21 21:12:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-21 21:12:38 UTC	527	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=skcurti&oit=1&cp=7&pgcl=4&gs_rn=42&psi=hNCHZ1THOPJNOILY&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CLbgygE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-21 21:12:38 UTC	1303	IN	HTTP/1.1 200 OK Date: Mon, 21 Apr 2025 21:12:38 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-RHEvz7tVfpeJNFZKfwEC-w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-21 21:12:38 UTC	21	IN	Data Raw: 31 34 38 0d 0a 29 5d 7d 27 0a 5b 22 73 6b 63 75 72 74 69 22 2c Data Ascii: 148)]}'["skcurti",
2025-04-21 21:12:38 UTC	314	IN	Data Raw: 5b 22 73 63 75 72 74 69 22 2c 22 73 63 75 72 74 61 69 6e 22 2c 22 73 63 75 72 6c 22 2c 22 73 63 75 72 72 74 79 20 66 75 72 6e 69 74 75 72 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 36 30 31 2c 36 30 30 2c 35 35 31 2c 35 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 35 31 32 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c Data Ascii: ["scurti","scurtain","scurl","scurrty furniture"],["","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,551,550],"google:suggestsubtypes":[[512,546],[512,546],[512,546],[512,546]],"google:suggesttype":["QUERY",
2025-04-21 21:12:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:10:35
Start date:	21/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff77eaf0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	17:10:36
Start date:	21/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,13100426057217993000,2118561166014208890,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
Imagebase:	0x7ff77eaf0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false