Edit tour

Windows Analysis Report
https://realtimesearchresults.com/

Overview

General Information

Sample URL:	https://realtimesearchresults.com/
Analysis ID:	1672088
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5480 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1912,i,15744807549929909011,9729045577241394979,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6308 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://realtimesearchresults.com/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://realtimesearchresults.com/

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://realtimesearchresults.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://realtimesearchresults.com/?tbm=contact	Avira URL Cloud: Label: phishing

Source: https://realtimesearchresults.com/	HTTP Parser: No favicon
Source: https://realtimesearchresults.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.6:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.191.50.132:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.191.50.132:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.31.250:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.31.250:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.31.250:443 -> 192.168.2.6:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.31.250:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.191.50.132:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.31.250:443 -> 192.168.2.6:49711 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: realtimesearchresults.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /__media__/pics/9000/09/890/realtimesearchresults.png HTTP/1.1Host: s.cdn-fileserver.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://realtimesearchresults.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /__media__/pics/9000/09/890/realtimesearchresults.png HTTP/1.1Host: s.cdn-fileserver.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /__media__/fonts/Inter-Regular/Inter-Regular.woff HTTP/1.1Host: s.cdn-fileserver.comConnection: keep-aliveOrigin: https://realtimesearchresults.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://realtimesearchresults.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: realtimesearchresults.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://realtimesearchresults.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?logid=kfk&evtid=usr_bhv&cc=US&cid=8CUS70K5E&crid=171376611&iso=0&pid=8POQYHV9J&prid=8PR11258V&vi=2249295933715547343&evt_type=pageshow&pgtid=40&bck_btn=0&bfch=0&scr_h=1024&scr_w=1280&cl_h=897&cl_w=1280&evt_ts=1745413738234&evt_diff=367&evt_ctr=1&visit_ctr=0 HTTP/1.1Host: l.cdn-fileserver.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://realtimesearchresults.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: realtimesearchresults.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?logid=kfk&evtid=usr_bhv&cc=US&cid=8CUS70K5E&crid=171376611&iso=0&pid=8POQYHV9J&prid=8PR11258V&vi=2249295933715547343&evt_type=pageshow&pgtid=40&bck_btn=0&bfch=0&scr_h=1024&scr_w=1280&cl_h=897&cl_w=1280&evt_ts=1745413738234&evt_diff=367&evt_ctr=1&visit_ctr=0 HTTP/1.1Host: l.cdn-fileserver.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: realtimesearchresults.com
Source: global traffic	DNS traffic detected: DNS query: s.cdn-fileserver.com
Source: global traffic	DNS traffic detected: DNS query: l.cdn-fileserver.com

Source: chromecache_67.5.dr	String found in binary or memory: http://l.cdn-fileserver.com/nerrping.php
Source: chromecache_67.5.dr	String found in binary or memory: https://realtimesearchresults.com/?tbm=contact
Source: chromecache_67.5.dr	String found in binary or memory: https://s.cdn-fileserver.com
Source: chromecache_67.5.dr	String found in binary or memory: https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.eot
Source: chromecache_67.5.dr	String found in binary or memory: https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.eot?#iefix
Source: chromecache_67.5.dr	String found in binary or memory: https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.svg#Inter-Regular
Source: chromecache_67.5.dr	String found in binary or memory: https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.ttf
Source: chromecache_67.5.dr	String found in binary or memory: https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.woff
Source: chromecache_67.5.dr	String found in binary or memory: https://s.cdn-fileserver.com/__media__/pics/9000/09/890/realtimesearchresults.png
Source: chromecache_67.5.dr	String found in binary or memory: https://skenzo.com/sk-privacy.php/

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.6:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.191.50.132:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.191.50.132:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.31.250:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.31.250:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.31.250:443 -> 192.168.2.6:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.31.250:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.191.50.132:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.31.250:443 -> 192.168.2.6:49711 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@23/14@14/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1912,i,15744807549929909011,9729045577241394979,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://realtimesearchresults.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1912,i,15744807549929909011,9729045577241394979,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://realtimesearchresults.com/	100%	Avira URL Cloud	phishing

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://s.cdn-fileserver.com/__media__/pics/9000/09/890/realtimesearchresults.png	0%	Avira URL Cloud	safe
https://l.cdn-fileserver.com/log?logid=kfk&evtid=usr_bhv&cc=US&cid=8CUS70K5E&crid=171376611&iso=0&pid=8POQYHV9J&prid=8PR11258V&vi=2249295933715547343&evt_type=pageshow&pgtid=40&bck_btn=0&bfch=0&scr_h=1024&scr_w=1280&cl_h=897&cl_w=1280&evt_ts=1745413738234&evt_diff=367&evt_ctr=1&visit_ctr=0	0%	Avira URL Cloud	safe
https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.ttf	0%	Avira URL Cloud	safe
https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.eot?#iefix	0%	Avira URL Cloud	safe
https://s.cdn-fileserver.com	0%	Avira URL Cloud	safe
https://realtimesearchresults.com/favicon.ico	100%	Avira URL Cloud	phishing
http://l.cdn-fileserver.com/nerrping.php	0%	Avira URL Cloud	safe
https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.eot	0%	Avira URL Cloud	safe
https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.woff	0%	Avira URL Cloud	safe
https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.svg#Inter-Regular	0%	Avira URL Cloud	safe
https://realtimesearchresults.com/?tbm=contact	100%	Avira URL Cloud	phishing

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.69.4	true	false	high
realtimesearchresults.com	199.191.50.132	true	false	high
s.cdn-fileserver.com	104.21.31.250	true	false	high
l.cdn-fileserver.com	104.21.31.250	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://realtimesearchresults.com/	true		unknown
https://s.cdn-fileserver.com/__media__/pics/9000/09/890/realtimesearchresults.png	false	Avira URL Cloud: safe	unknown
https://realtimesearchresults.com/favicon.ico	true	Avira URL Cloud: phishing	unknown
https://l.cdn-fileserver.com/log?logid=kfk&evtid=usr_bhv&cc=US&cid=8CUS70K5E&crid=171376611&iso=0&pid=8POQYHV9J&prid=8PR11258V&vi=2249295933715547343&evt_type=pageshow&pgtid=40&bck_btn=0&bfch=0&scr_h=1024&scr_w=1280&cl_h=897&cl_w=1280&evt_ts=1745413738234&evt_diff=367&evt_ctr=1&visit_ctr=0	false	Avira URL Cloud: safe	unknown
https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.woff	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://l.cdn-fileserver.com/nerrping.php	chromecache_67.5.dr	false	Avira URL Cloud: safe	unknown
https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.svg#Inter-Regular	chromecache_67.5.dr	false	Avira URL Cloud: safe	unknown
https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.eot?#iefix	chromecache_67.5.dr	false	Avira URL Cloud: safe	unknown
https://s.cdn-fileserver.com	chromecache_67.5.dr	false	Avira URL Cloud: safe	unknown
https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.ttf	chromecache_67.5.dr	false	Avira URL Cloud: safe	unknown
https://skenzo.com/sk-privacy.php/	chromecache_67.5.dr	false		high
https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.eot	chromecache_67.5.dr	false	Avira URL Cloud: safe	unknown
https://realtimesearchresults.com/?tbm=contact	chromecache_67.5.dr	true	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
199.191.50.132	realtimesearchresults.com	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	false
104.21.31.250	s.cdn-fileserver.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1672088
Start date and time:	2025-04-23 15:07:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://realtimesearchresults.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@23/14@14/4

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 184.29.183.29, 142.250.68.238, 142.250.69.3, 192.178.49.174, 142.250.101.84, 142.250.69.14, 192.178.49.202, 192.178.49.170, 142.250.69.10, 142.250.68.234, 199.232.214.172, 192.178.49.195, 52.149.20.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ajax.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://realtimesearchresults.com/

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:HrYhR:khR
MD5:	DBAEE91D04C0708A9569B1F9EA383033
SHA1:	DB921B8F86AF164E23945C8755E8DD548402E26E
SHA-256:	D4C07F729F95A2ABE81E98F6016929BBD6C95476C231A13625210409489F1100
SHA-512:	4F477B9A74829107DF046B1B6BB18C9A050972F310A0E7D4747B443F7F7916D01D15B4558C2CF6107B69EF9359143EB13ACB58B74DA594714E54059B4AFBA645
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCbMg9WxxamUkEgUN4mCXSiHYnSm9XsWGzg==?alt=proto
Preview:	CgkKBw3iYJdKGgA=

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 27676, version 1.0
Category:	downloaded
Size (bytes):	27676
Entropy (8bit):	7.981206326129723
Encrypted:	false
SSDEEP:	768:O6OrO3qE5tOqr89LpbUaQ0FYiTXH51b3cp:O6OrO3qE5/r89dJYO51b32
MD5:	D018983276941D4D273424C1C01B411A
SHA1:	58185AA434EAFF25B3D2CC1180E33F381E3E398C
SHA-256:	DB8B880DA3B4500B5628FFF8B770B0B73C3C3CEC757DEAE20F1BF10C0A3DA670
SHA-512:	908EE039EDF7C351B1368FF7394489103E5237721F076358E4EE992884927DE2AD4D83F2853D3E599C2DDD61F62C9F872DEA8D09C9E9E56549343C114A53833B
Malicious:	false
Reputation:	low
URL:	https://s.cdn-fileserver.com/__media__/fonts/Inter-Regular/Inter-Regular.woff
Preview:	wOFF......l.................................FFTM..............<WGDEF.......k.....!."GPOS.......m..J.W\|2GSUB..........&4 .OS/2...X...Y...`.0..cmap............g{..cvt ...8...B...B...Xfpgm...\|.......eS./.gasp...0............glyf...8..KH.......head..c....6...6..Bzhhea..c........$.j.Xhmtx..c....+.....+a.loca..f............jmaxp..g.... ... ....name..g.........1.."post..i.........m3..prep..k.........O1W...........E......}g......4..x...;..`.E.3.,mY.6bb.6>..F)..G!.,.mxbNn.M7.0u+...fn..+.`I...l...{}.K]s.g....jA.M.y.'/.Y.D.?.......~wv.D.x..\[p....$Y.....\l...\B &.!.....@..&.$.1.....L.f:.3.fHH(zH.-2...4..).^..e.~......$n.2<.!..w..J.....-O.g.....=.?....`<...O[`.s.~y........{..J..U...W.J..w.{u...{.^T.;.{....y..D^..K.6.j<..c..h...x.'P..8.Gq..It1-...U../p.U./\.\;\{$....N.>v.v.s........=.Ls<.x..3.g3...9...s..WRQ2..d.....N.Ngj.y.w.w.w.w...........N.i...m_.......H..........s.....*...../."..5..,..p...vR...5Bn.....q..<NB)...R5..xw..@...V..Fl'...~.5.,.........j...p.y...8....

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32038)
Category:	downloaded
Size (bytes):	95992
Entropy (8bit):	5.391333957965341
Encrypted:	false
SSDEEP:	1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRmm:R+41ZqLTW8xRrqSb8qGH77da98Hr3
MD5:	F03E5A3BF534F4A738BC350631FD05BD
SHA1:	37B1DB88B57438F1072A8EBC7559C909C9D3A682
SHA-256:	AEC3D419D50F05781A96F223E18289AEB52598B5DB39BE82A7B71DC67D6A7947
SHA-512:	8EEEAEFB86CF5F9D09426814F7B60E1805E644CAC3F5AB382C4D393DD0B7AB272C1909A31A57E6D38D5ACF207555F097A64A6DD62F60A97093E97BB184126D2A
Malicious:	false
Reputation:	low
URL:	https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Preview:	/! jQuery v1.11.3 \| (c) 2005, 2015 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.3",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 2 colors
Category:	downloaded
Size (bytes):	198
Entropy (8bit):	1.3141495642663492
Encrypted:	false
SSDEEP:	3:3/nlrXllvlNl/FXl1ll1l8nB/555555555555555n:J1Wp555555555555555n
MD5:	3678CDBD64A22FA30AC1CBD55C172A0D
SHA1:	F7EEC842B643978BF4170DF2FFBEE8527DF75B11
SHA-256:	C0B46EF8C31C29FEBB37A659FBAF512B3144261D023DCFAB44DA82502FEB4E79
SHA-512:	BEE9B34872133F110C73AE6ED24DA0F385B54894393EEB5A5C09162665710E9E5DB9D997305F249CCF136F6C9A85D1D6B48629A2FB01B8CE9E612279741801C5
Malicious:	false
Reputation:	low
URL:	https://realtimesearchresults.com/favicon.ico
Preview:	......................(....... ...........@...................$.......................................................................................................................................

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (16373), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	50695
Entropy (8bit):	5.333123044703921
Encrypted:	false
SSDEEP:	1536:STQNcFO2V6BaR+k+8BMQpQetZ1wp2u6bOfhhmQjhax/kUgo1eVUp1mzpy8NBz/C7:STB3lJGMkUgo9713KDa
MD5:	CC47C09CB8BC8F9511172E0A8AAF0D26
SHA1:	BC7CBA4E90962DD6396E9061FA1E0453688AF258
SHA-256:	18E06460753C02F0366B1663F5AFB17DFD70C9615B791A995CFD46A7563F4C6D
SHA-512:	B7F105F59B90E905BBC6F0B93FC5380022F7CCCBF066B7ED245FD080AE88CD3CB3986855379664EDE596F72646E9147E769D5CD51E6D0FAF3C1E6B5F44BAD5A6
Malicious:	false
Reputation:	low
URL:	https://realtimesearchresults.com/
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head><script id="osVars">window.osVars={"epEc":{"cdv":"1656","cid":"8CUS70K5E","crid":"171376611","layer":"O_ARB","ptid":"40","tid":"900016405","vi":"2249295933715547343"},"epLc":{"lurl":"http://l.cdn-fileserver.com/nerrping.php"},"hoverRefInt":3900000,"usrTrk":{"enDt":{"cc":"US","cid":"8CUS70K5E","crid":"171376611","iso":0,"lpvi":"","pid":"8POQYHV9J","prid":"8PR11258V","vi":"2249295933715547343"},"evtType":["baseEventsTracker","rawEventsTracker","adClkVisEventsTracker"],"pgtId":"40","pxlHost":"l.cdn-fileserver.com"}};</script><script>var _mNRequire,_mNDefine;!function(){"use strict";var c={},u={};function a(e){return"function"==typeof e}_mNRequire=function e(t,r){var n,i,o=[];for(i in t)t.hasOwnProperty(i)&&("object"==typeof(n=t[i])\|\|void 0===n?o.push(n):(void 0===c[n]&&(c[n]=e(u[n].deps,u[n].callback)),o.push(c[n])));

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1067 x 314, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	28450
Entropy (8bit):	7.938438275725039
Encrypted:	false
SSDEEP:	768:kRZ7gwMax8H/lpmuGVTT0OM9M9bqkVhRXay:kR2wMax8f7mtVc5M9ekLX
MD5:	880892BDE716BF53E64FE255A4F3F230
SHA1:	3E4453EFB0C4F43874FFB1B03FF6227423FE343F
SHA-256:	2E33A9E164D56002E61EFE68C04A19588C308797C818B68EAFE0D5AFC5E80664
SHA-512:	24393FBC0402BC7A839656E0DAED286FA617F0EFA62482BDB96F8B945E3BE66F2C7FBA4122929B53F05E4E44E5CCBA49B077E9EF82F234035D91E009E6AE60C6
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...+...:.....?y......pHYs.........&.:4....sRGB.........gAMA......a...n.IDATx...M..Wv/..eU..<.....m.?..!r...~V.~....K.^ya&7..yA....Xb.I50oa....o..bv..f.=..C.{...J.l...m.......5.TF..d~..=7nD..@ .U......{.@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDM......./G.........W......([.Z....4.w..c..[.................+.u.(Z[^^.%....4@q....,p.A.w.[...........4.+..N.:.....*..X...^.i.%.......>HAA.r.../f..I:..0K....J...R..}Q.c.6e.9.h...=z.(..o~.}x`.~.<No...........J...r....:$P.@h./.eww.'N......8.d.~.[...{[...$....p"9.S..../..+[...We_.Fs......}..]...N\|.Wy?..~n...}yI.....Kr....P.>.p.......=.=...-...........'r.\|.e.r..Sw...~..>~>..r.o..E4.Y.8..,.+.Qt..<._...KY......(...y...D.u....}P-.:..yv...+....@../...

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 2 colors
Category:	dropped
Size (bytes):	198
Entropy (8bit):	1.3141495642663492
Encrypted:	false
SSDEEP:	3:3/nlrXllvlNl/FXl1ll1l8nB/555555555555555n:J1Wp555555555555555n
MD5:	3678CDBD64A22FA30AC1CBD55C172A0D
SHA1:	F7EEC842B643978BF4170DF2FFBEE8527DF75B11
SHA-256:	C0B46EF8C31C29FEBB37A659FBAF512B3144261D023DCFAB44DA82502FEB4E79
SHA-512:	BEE9B34872133F110C73AE6ED24DA0F385B54894393EEB5A5C09162665710E9E5DB9D997305F249CCF136F6C9A85D1D6B48629A2FB01B8CE9E612279741801C5
Malicious:	false
Reputation:	low
Preview:	......................(....... ...........@...................$.......................................................................................................................................

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1067 x 314, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	28450
Entropy (8bit):	7.938438275725039
Encrypted:	false
SSDEEP:	768:kRZ7gwMax8H/lpmuGVTT0OM9M9bqkVhRXay:kR2wMax8f7mtVc5M9ekLX
MD5:	880892BDE716BF53E64FE255A4F3F230
SHA1:	3E4453EFB0C4F43874FFB1B03FF6227423FE343F
SHA-256:	2E33A9E164D56002E61EFE68C04A19588C308797C818B68EAFE0D5AFC5E80664
SHA-512:	24393FBC0402BC7A839656E0DAED286FA617F0EFA62482BDB96F8B945E3BE66F2C7FBA4122929B53F05E4E44E5CCBA49B077E9EF82F234035D91E009E6AE60C6
Malicious:	false
Reputation:	low
URL:	https://s.cdn-fileserver.com/__media__/pics/9000/09/890/realtimesearchresults.png
Preview:	.PNG........IHDR...+...:.....?y......pHYs.........&.:4....sRGB.........gAMA......a...n.IDATx...M..Wv/..eU..<.....m.?..!r...~V.~....K.^ya&7..yA....Xb.I50oa....o..bv..f.=..C.{...J.l...m.......5.TF..d~..=7nD..@ .U......{.@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDM......./G.........W......([.Z....4.w..c..[.................+.u.(Z[^^.%....4@q....,p.A.w.[...........4.+..N.:.....*..X...^.i.%.......>HAA.r.../f..I:..0K....J...R..}Q.c.6e.9.h...=z.(..o~.}x`.~.<No...........J...r....:$P.@h./.eww.'N......8.d.~.[...{[...$....p"9.S..../..+[...We_.Fs......}..]...N\|.Wy?..~n...}yI.....Kr....P.>.p.......=.=...-...........'r.\|.e.r..Sw...~..>~>..r.o..E4.Y.8..,.+.Qt..<._...KY......(...y...D.u....}P-.:..yv...+....@../...

Static File Info

⊘No static file info

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 151
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2025 15:08:37.063421965 CEST	49672	443	192.168.2.6	204.79.197.203
Apr 23, 2025 15:08:41.126501083 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 23, 2025 15:08:41.438618898 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 23, 2025 15:08:41.875917912 CEST	49672	443	192.168.2.6	204.79.197.203
Apr 23, 2025 15:08:42.047909021 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 23, 2025 15:08:43.250834942 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 23, 2025 15:08:45.657090902 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 23, 2025 15:08:50.469639063 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 23, 2025 15:08:51.547796965 CEST	49672	443	192.168.2.6	204.79.197.203
Apr 23, 2025 15:08:55.582932949 CEST	49697	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:08:55.582978010 CEST	443	49697	142.250.69.4	192.168.2.6
Apr 23, 2025 15:08:55.583357096 CEST	49697	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:08:55.583586931 CEST	49697	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:08:55.583605051 CEST	443	49697	142.250.69.4	192.168.2.6
Apr 23, 2025 15:08:55.903263092 CEST	443	49697	142.250.69.4	192.168.2.6
Apr 23, 2025 15:08:55.903369904 CEST	49697	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:08:55.904829025 CEST	49697	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:08:55.904845953 CEST	443	49697	142.250.69.4	192.168.2.6
Apr 23, 2025 15:08:55.905078888 CEST	443	49697	142.250.69.4	192.168.2.6
Apr 23, 2025 15:08:55.954418898 CEST	49697	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:08:56.540743113 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:56.540802002 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:56.540914059 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:56.541171074 CEST	49699	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:56.541214943 CEST	443	49699	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:56.541331053 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:56.541347027 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:56.541373014 CEST	49699	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:56.541520119 CEST	49699	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:56.541542053 CEST	443	49699	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.061638117 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.061716080 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.062962055 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.062973022 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.063199997 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.063518047 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.064713955 CEST	443	49699	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.064810038 CEST	49699	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.065838099 CEST	49699	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.065848112 CEST	443	49699	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.066071987 CEST	443	49699	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.108268976 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.115684986 CEST	49699	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.362298012 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.362319946 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.362353086 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.362374067 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.362667084 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.362698078 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.362905979 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.532661915 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.532700062 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.532741070 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.532773018 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.532788038 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.532818079 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.532823086 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.532834053 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.532886982 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.532886982 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.532896996 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.532937050 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.532949924 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.533004999 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.533067942 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.533122063 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.545557976 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.545578957 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:57.545723915 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.546216011 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.546233892 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:57.546286106 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.546335936 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.546343088 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:57.546618938 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.546627045 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:57.559526920 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.559592009 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.702898979 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.702944994 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.702969074 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.702979088 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.703008890 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.703032970 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.703048944 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.703053951 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.703088045 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.703130960 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.703597069 CEST	49698	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:57.703610897 CEST	443	49698	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:57.839345932 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:57.839435101 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.840677977 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.840688944 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:57.840934038 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:57.842817068 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:57.842879057 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.844158888 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.844167948 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:57.844367981 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:57.844548941 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.880197048 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:57.892263889 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.176446915 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.176666975 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.177031994 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.177057028 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.177249908 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.177299023 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.177304983 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.177520990 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.177565098 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.177571058 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.177954912 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.177983046 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.178005934 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.178009987 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.178148031 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.178730011 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.178785086 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.178808928 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.178833008 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.178838968 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.179001093 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.179491997 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.179578066 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.179603100 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.179647923 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.179653883 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.179692984 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.180336952 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.180386066 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.180413961 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.180458069 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.180463076 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.180473089 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.180512905 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.180542946 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.180902004 CEST	49702	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.180918932 CEST	443	49702	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.332351923 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.332402945 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.332567930 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.332806110 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.332822084 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.619070053 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.619235039 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.887183905 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.887217999 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.887547970 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.887876034 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.928275108 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:58.935719967 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:58.980268002 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.038083076 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.038137913 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.038186073 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.038213015 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.038227081 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.038239002 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.038279057 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.038295984 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.038331985 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.038350105 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.038357019 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.038402081 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.038659096 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.038710117 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.039242029 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.039294004 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.039303064 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.039339066 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.039349079 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.039357901 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.039426088 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.040050030 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.040101051 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.040123940 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.040203094 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.040211916 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.040267944 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.040842056 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.040905952 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.040935040 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.040957928 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.040966034 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.041007996 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.041553974 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.041614056 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.044334888 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.046710968 CEST	49704	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.046726942 CEST	443	49704	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.217236042 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.217278957 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.217308998 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.217338085 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.217359066 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.217360973 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.217371941 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.217402935 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.217403889 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.217422009 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.217432022 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.217535019 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.218067884 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.218170881 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.218192101 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.218214989 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.218219995 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.218266964 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.218913078 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.218965054 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.219000101 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.219044924 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.219049931 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.219122887 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.219805002 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.219851017 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.219877005 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.219909906 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.219914913 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.219957113 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.220506907 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.220585108 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.220658064 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.221251965 CEST	49703	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.221265078 CEST	443	49703	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.235908031 CEST	49699	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:59.280283928 CEST	443	49699	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:59.391835928 CEST	49707	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.391875982 CEST	443	49707	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.391951084 CEST	49707	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.393757105 CEST	49707	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.393773079 CEST	443	49707	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.462085009 CEST	443	49699	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:59.463370085 CEST	443	49699	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:59.463454962 CEST	49699	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:59.463877916 CEST	49699	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:59.463898897 CEST	443	49699	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:59.655544996 CEST	49709	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:59.655591011 CEST	443	49709	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:59.655677080 CEST	49709	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:59.655925989 CEST	49709	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:08:59.655931950 CEST	443	49709	199.191.50.132	192.168.2.6
Apr 23, 2025 15:08:59.679749966 CEST	443	49707	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.679825068 CEST	49707	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.680880070 CEST	49707	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.680887938 CEST	443	49707	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.681119919 CEST	443	49707	104.21.31.250	192.168.2.6
Apr 23, 2025 15:08:59.681446075 CEST	49707	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:08:59.724303007 CEST	443	49707	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.004389048 CEST	443	49709	199.191.50.132	192.168.2.6
Apr 23, 2025 15:09:00.004471064 CEST	49709	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:09:00.005178928 CEST	49709	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:09:00.005193949 CEST	443	49709	199.191.50.132	192.168.2.6
Apr 23, 2025 15:09:00.005388021 CEST	443	49709	199.191.50.132	192.168.2.6
Apr 23, 2025 15:09:00.005647898 CEST	49709	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:09:00.043514967 CEST	443	49707	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.043566942 CEST	443	49707	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.043617010 CEST	49707	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:09:00.044655085 CEST	49707	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:09:00.044670105 CEST	443	49707	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.048269987 CEST	443	49709	199.191.50.132	192.168.2.6
Apr 23, 2025 15:09:00.079912901 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 23, 2025 15:09:00.225764990 CEST	49711	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:09:00.225807905 CEST	443	49711	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.225872993 CEST	49711	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:09:00.226041079 CEST	49711	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:09:00.226056099 CEST	443	49711	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.394793987 CEST	443	49709	199.191.50.132	192.168.2.6
Apr 23, 2025 15:09:00.394870043 CEST	443	49709	199.191.50.132	192.168.2.6
Apr 23, 2025 15:09:00.398334026 CEST	49709	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:09:00.446052074 CEST	49709	443	192.168.2.6	199.191.50.132
Apr 23, 2025 15:09:00.446084976 CEST	443	49709	199.191.50.132	192.168.2.6
Apr 23, 2025 15:09:00.511795998 CEST	443	49711	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.511874914 CEST	49711	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:09:00.512415886 CEST	49711	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:09:00.512424946 CEST	443	49711	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.512631893 CEST	443	49711	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.513020992 CEST	49711	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:09:00.560271978 CEST	443	49711	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.883743048 CEST	443	49711	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.883804083 CEST	443	49711	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:00.884130955 CEST	49711	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:09:00.885860920 CEST	49711	443	192.168.2.6	104.21.31.250
Apr 23, 2025 15:09:00.885878086 CEST	443	49711	104.21.31.250	192.168.2.6
Apr 23, 2025 15:09:05.886722088 CEST	443	49697	142.250.69.4	192.168.2.6
Apr 23, 2025 15:09:05.886790991 CEST	443	49697	142.250.69.4	192.168.2.6
Apr 23, 2025 15:09:05.886904001 CEST	49697	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:09:06.488481045 CEST	49697	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:09:06.488531113 CEST	443	49697	142.250.69.4	192.168.2.6
Apr 23, 2025 15:09:55.502471924 CEST	49718	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:09:55.502536058 CEST	443	49718	142.250.69.4	192.168.2.6
Apr 23, 2025 15:09:55.502605915 CEST	49718	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:09:55.502778053 CEST	49718	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:09:55.502789974 CEST	443	49718	142.250.69.4	192.168.2.6
Apr 23, 2025 15:09:55.817461967 CEST	443	49718	142.250.69.4	192.168.2.6
Apr 23, 2025 15:09:55.817807913 CEST	49718	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:09:55.817828894 CEST	443	49718	142.250.69.4	192.168.2.6
Apr 23, 2025 15:09:58.714224100 CEST	443	49681	2.23.227.215	192.168.2.6
Apr 23, 2025 15:09:58.714245081 CEST	443	49681	2.23.227.215	192.168.2.6
Apr 23, 2025 15:09:58.714358091 CEST	49681	443	192.168.2.6	2.23.227.215
Apr 23, 2025 15:09:58.714391947 CEST	49681	443	192.168.2.6	2.23.227.215
Apr 23, 2025 15:10:05.832443953 CEST	443	49718	142.250.69.4	192.168.2.6
Apr 23, 2025 15:10:05.832501888 CEST	443	49718	142.250.69.4	192.168.2.6
Apr 23, 2025 15:10:05.832691908 CEST	49718	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:10:06.503845930 CEST	49718	443	192.168.2.6	142.250.69.4
Apr 23, 2025 15:10:06.503889084 CEST	443	49718	142.250.69.4	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2025 15:08:51.144532919 CEST	53	51991	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:51.348800898 CEST	53	49272	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:52.383382082 CEST	53	64636	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:55.440562010 CEST	59302	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:55.440783978 CEST	61365	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:55.580923080 CEST	53	59302	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:55.580945969 CEST	53	61365	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:56.328378916 CEST	64401	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:56.328666925 CEST	50089	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:56.535067081 CEST	53	64401	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:56.538791895 CEST	53	50089	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:57.384448051 CEST	58471	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:57.384692907 CEST	52567	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:57.527075052 CEST	53	52218	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:57.528373957 CEST	53	58471	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:57.544682026 CEST	53	52567	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:58.184844017 CEST	55076	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:58.184989929 CEST	59399	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:58.325721025 CEST	53	55076	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:58.329583883 CEST	53	59399	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:59.075208902 CEST	53	60997	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:59.234723091 CEST	57704	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:59.235003948 CEST	57936	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:59.380676031 CEST	53	57704	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:59.390979052 CEST	53	57936	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:59.470103979 CEST	64065	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:59.470297098 CEST	53509	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:08:59.634896994 CEST	53	64065	1.1.1.1	192.168.2.6
Apr 23, 2025 15:08:59.654953957 CEST	53	53509	1.1.1.1	192.168.2.6
Apr 23, 2025 15:09:00.052474022 CEST	52987	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:09:00.056704998 CEST	53765	53	192.168.2.6	1.1.1.1
Apr 23, 2025 15:09:00.199492931 CEST	53	53765	1.1.1.1	192.168.2.6
Apr 23, 2025 15:09:00.225028992 CEST	53	52987	1.1.1.1	192.168.2.6
Apr 23, 2025 15:09:09.346709967 CEST	53	59163	1.1.1.1	192.168.2.6
Apr 23, 2025 15:09:28.174865007 CEST	53	50310	1.1.1.1	192.168.2.6
Apr 23, 2025 15:09:39.194993973 CEST	138	138	192.168.2.6	192.168.2.255
Apr 23, 2025 15:09:50.865206957 CEST	53	51520	1.1.1.1	192.168.2.6
Apr 23, 2025 15:09:51.033426046 CEST	53	60227	1.1.1.1	192.168.2.6
Apr 23, 2025 15:09:54.144368887 CEST	53	65188	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2025 15:08:55.440562010 CEST	192.168.2.6	1.1.1.1	0x9567	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:55.440783978 CEST	192.168.2.6	1.1.1.1	0xf834	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 23, 2025 15:08:56.328378916 CEST	192.168.2.6	1.1.1.1	0x1237	Standard query (0)	realtimesearchresults.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:56.328666925 CEST	192.168.2.6	1.1.1.1	0xe366	Standard query (0)	realtimesearchresults.com	65	IN (0x0001)	false
Apr 23, 2025 15:08:57.384448051 CEST	192.168.2.6	1.1.1.1	0x6385	Standard query (0)	s.cdn-fileserver.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:57.384692907 CEST	192.168.2.6	1.1.1.1	0x5246	Standard query (0)	s.cdn-fileserver.com	65	IN (0x0001)	false
Apr 23, 2025 15:08:58.184844017 CEST	192.168.2.6	1.1.1.1	0x1bb6	Standard query (0)	s.cdn-fileserver.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:58.184989929 CEST	192.168.2.6	1.1.1.1	0x7f10	Standard query (0)	s.cdn-fileserver.com	65	IN (0x0001)	false
Apr 23, 2025 15:08:59.234723091 CEST	192.168.2.6	1.1.1.1	0x46f2	Standard query (0)	l.cdn-fileserver.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:59.235003948 CEST	192.168.2.6	1.1.1.1	0xddbb	Standard query (0)	l.cdn-fileserver.com	65	IN (0x0001)	false
Apr 23, 2025 15:08:59.470103979 CEST	192.168.2.6	1.1.1.1	0x2dc7	Standard query (0)	realtimesearchresults.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:59.470297098 CEST	192.168.2.6	1.1.1.1	0x4741	Standard query (0)	realtimesearchresults.com	65	IN (0x0001)	false
Apr 23, 2025 15:09:00.052474022 CEST	192.168.2.6	1.1.1.1	0xd2b5	Standard query (0)	l.cdn-fileserver.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:09:00.056704998 CEST	192.168.2.6	1.1.1.1	0x2fdc	Standard query (0)	l.cdn-fileserver.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 23, 2025 15:08:55.580923080 CEST	1.1.1.1	192.168.2.6	0x9567	No error (0)	www.google.com	142.250.69.4	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:55.580945969 CEST	1.1.1.1	192.168.2.6	0xf834	No error (0)	www.google.com		65	IN (0x0001)	false
Apr 23, 2025 15:08:56.535067081 CEST	1.1.1.1	192.168.2.6	0x1237	No error (0)	realtimesearchresults.com	199.191.50.132	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:57.528373957 CEST	1.1.1.1	192.168.2.6	0x6385	No error (0)	s.cdn-fileserver.com	104.21.31.250	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:57.528373957 CEST	1.1.1.1	192.168.2.6	0x6385	No error (0)	s.cdn-fileserver.com	172.67.181.210	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:57.544682026 CEST	1.1.1.1	192.168.2.6	0x5246	No error (0)	s.cdn-fileserver.com		65	IN (0x0001)	false
Apr 23, 2025 15:08:58.325721025 CEST	1.1.1.1	192.168.2.6	0x1bb6	No error (0)	s.cdn-fileserver.com	104.21.31.250	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:58.325721025 CEST	1.1.1.1	192.168.2.6	0x1bb6	No error (0)	s.cdn-fileserver.com	172.67.181.210	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:58.329583883 CEST	1.1.1.1	192.168.2.6	0x7f10	No error (0)	s.cdn-fileserver.com		65	IN (0x0001)	false
Apr 23, 2025 15:08:59.380676031 CEST	1.1.1.1	192.168.2.6	0x46f2	No error (0)	l.cdn-fileserver.com	104.21.31.250	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:59.380676031 CEST	1.1.1.1	192.168.2.6	0x46f2	No error (0)	l.cdn-fileserver.com	172.67.181.210	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:08:59.390979052 CEST	1.1.1.1	192.168.2.6	0xddbb	No error (0)	l.cdn-fileserver.com		65	IN (0x0001)	false
Apr 23, 2025 15:08:59.634896994 CEST	1.1.1.1	192.168.2.6	0x2dc7	No error (0)	realtimesearchresults.com	199.191.50.132	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:09:00.199492931 CEST	1.1.1.1	192.168.2.6	0x2fdc	No error (0)	l.cdn-fileserver.com		65	IN (0x0001)	false
Apr 23, 2025 15:09:00.225028992 CEST	1.1.1.1	192.168.2.6	0xd2b5	No error (0)	l.cdn-fileserver.com	104.21.31.250	A (IP address)	IN (0x0001)	false
Apr 23, 2025 15:09:00.225028992 CEST	1.1.1.1	192.168.2.6	0xd2b5	No error (0)	l.cdn-fileserver.com	172.67.181.210	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

realtimesearchresults.com

s.cdn-fileserver.com

l.cdn-fileserver.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49698	199.191.50.132	443	1964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 13:08:57 UTC	675	OUT	GET / HTTP/1.1 Host: realtimesearchresults.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 13:08:57 UTC	229	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 23 Apr 2025 13:08:51 GMT Content-Type: text/html Transfer-Encoding: chunked referrer-policy: no-referrer-when-downgrade x-sc-h: 22-wkb6 via: 1.1 google Connection: close
2025-04-23 13:08:57 UTC	7009	IN	Data Raw: 31 66 32 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 69 64 3d 22 6f 73 56 61 72 73 22 3e 77 69 6e 64 6f 77 2e 6f 73 56 61 72 73 3d 7b 22 65 70 45 63 22 3a 7b 22 63 64 76 22 3a 22 31 36 35 36 22 2c 22 63 69 64 22 3a 22 38 43 55 53 37 30 4b 35 45 22 2c 22 Data Ascii: 1f27<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><script id="osVars">window.osVars={"epEc":{"cdv":"1656","cid":"8CUS70K5E","
2025-04-23 13:08:57 UTC	974	IN	Data Raw: 72 2d 6c 69 6e 6b 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 31 70 78 20 73 6f 6c 69 64 20 67 72 65 79 3b 7d 0d 0a 20 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 20 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 38 70 78 3b 63 6f 6c 6f 72 3a 20 23 32 43 34 31 36 34 3b 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 3a 66 69 72 73 74 2d 63 68 69 6c 64 20 61 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 3b 7d 0d 0a 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: r-link{border-right: 1px solid grey;} .footer-link:last-child{border: none;} .footer-link a{font-size: 12px;line-height: 18px;color: #2C4164;padding: 0 10px;} .footer-link:first-child a{padding-left: 0;}
2025-04-23 13:08:57 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 3a 20 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 20 32 30 70 78 3b 74 6f 70 3a 20 32 35 70 78 3b 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 20 6e 6f 6e 65 3b 77 69 64 74 68 3a 20 31 36 70 78 3b 68 65 69 67 68 74 3a 20 31 36 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 0d 0a 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 32 37 70 78 29 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e Data Ascii: 1000: absolute;right: 20px;top: 25px;cursor: pointer;-webkit-appearance: none;width: 16px;height: 16px;border-radius: 50%;display: none;border:none;outline:none; } @media only screen and (max-width: 727px){ .
2025-04-23 13:08:57 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 6f 72 28 6e 20 69 6e 20 72 29 69 66 28 72 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6e 29 29 7b 76 61 72 20 69 3d 70 61 72 73 65 49 6e 74 28 72 5b 6e 5d 29 3b 69 66 28 74 3c 65 2b 69 29 72 65 74 75 72 6e 20 6e 3b 65 2b 3d 69 7d 7d 2c 65 6e 63 56 61 6c 3a 65 2c 64 65 63 56 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 6e 2c 74 29 7b 72 65 74 75 72 6e 20 65 28 72 2c 74 2e 6c 65 6e 67 74 68 2d 28 6e 3d 76 6f 69 64 20 30 3d 3d 3d 6e 3f 39 3a 6e 29 2c 74 29 7d 2c 67 65 74 52 61 6e 64 6f 6d 49 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 28 30 2c 32 35 34 29 2b 22 2e 22 2b 63 28 30 2c 32 35 34 29 2b 22 2e 22 2b 63 28 30 2c 32 35 34 29 2b 22 2e 22 2b 63 28 30 2c 32 35 34 29 7d 2c 74 72 75 6e 63 61 74 65 55 72 6c 3a 66 75 6e Data Ascii: 1000or(n in r)if(r.hasOwnProperty(n)){var i=parseInt(r[n]);if(t<e+i)return n;e+=i}},encVal:e,decVal:function(r,n,t){return e(r,t.length-(n=void 0===n?9:n),t)},getRandomIp:function(){return c(0,254)+"."+c(0,254)+"."+c(0,254)+"."+c(0,254)},truncateUrl:fun
2025-04-23 13:08:57 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 22 61 64 63 6c 6b 22 3d 3d 3d 74 7c 7c 22 73 72 63 71 72 79 22 3d 3d 3d 74 3f 22 26 62 64 3d 22 2b 65 73 63 61 70 65 28 72 2e 67 65 74 53 65 61 72 63 68 42 6f 78 52 65 6c 61 74 65 64 44 61 74 61 28 29 29 3a 22 26 62 64 3d 22 2b 65 73 63 61 70 65 28 72 2e 67 65 74 55 52 4c 42 72 6f 77 73 65 72 44 61 74 61 28 29 29 7d 63 61 74 63 68 28 74 29 7b 7d 72 65 74 75 72 6e 20 65 7d 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 66 64 3d 22 23 22 2c 74 68 69 73 2e 63 6f 6f 6b 69 65 53 75 70 70 6f 72 74 3d 2d 31 2c 74 68 69 73 2e 69 73 69 6e 66 72 61 6d 65 3d 2d 31 2c 74 68 69 73 2e 62 72 6f 77 73 65 72 64 61 74 61 3d 22 22 2c 74 68 69 73 2e 67 65 74 4c 6f 63 61 6c 54 69 6d 65 5a 6f 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 Data Ascii: 1000"adclk"===t\|\|"srcqry"===t?"&bd="+escape(r.getSearchBoxRelatedData()):"&bd="+escape(r.getURLBrowserData())}catch(t){}return e}var n=function(){this.fd="#",this.cookieSupport=-1,this.isinframe=-1,this.browserdata="",this.getLocalTimeZone=function(){re
2025-04-23 13:08:57 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 61 73 63 72 69 70 74 22 2c 65 2e 73 72 63 3d 74 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 29 7d 2c 69 6d 61 67 65 42 65 61 63 6f 6e 4c 6f 67 67 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 28 74 29 26 26 28 28 6e 65 77 20 49 6d 61 67 65 29 2e 73 72 63 3d 74 29 7d 2c 69 73 53 74 72 69 6e 67 53 65 74 3a 66 2c 69 73 41 72 72 61 79 3a 69 2c 67 65 74 51 75 65 72 79 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 6e 3d 5b 5d 3b 66 6f 72 28 65 20 69 6e 20 74 29 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 29 26 26 66 28 74 5b 65 5d 29 26 26 6e 2e 70 75 73 68 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 2b 22 3d 22 2b 65 6e 63 6f 64 65 55 Data Ascii: 1000ascript",e.src=t,document.body.appendChild(e))},imageBeaconLogging:function(t){f(t)&&((new Image).src=t)},isStringSet:f,isArray:i,getQueryString:function(t){var e,n=[];for(e in t)t.hasOwnProperty(e)&&f(t[e])&&n.push(encodeURIComponent(e)+"="+encodeU
2025-04-23 13:08:57 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 6e 22 2c 6e 2c 65 29 2c 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 6e 22 2c 6e 2c 65 29 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 7b 61 64 64 45 76 65 6e 74 3a 76 2e 61 64 64 45 76 65 6e 74 2c 72 65 6d 6f 76 65 45 76 65 6e 74 3a 76 2e 72 65 6d 6f 76 65 45 76 65 6e 74 2c 61 64 64 45 76 65 6e 74 54 6f 53 65 72 70 4c 69 6e 6b 73 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 74 3d 69 28 29 3b 69 66 28 30 3c 74 2e 6c 65 6e 67 74 68 26 26 6e 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 29 76 2e 61 64 64 45 76 65 6e 74 28 74 5b 72 5d 2c 65 2c 6e 29 7d 2c 61 64 Data Ascii: 1000addEventListener("mn",n,e),window.removeEventListener("mn",n,e)}catch(e){}return{addEvent:v.addEvent,removeEvent:v.removeEvent,addEventToSerpLinks:function(e,n){var t=i();if(0<t.length&&n&&"function"==typeof n)for(var r in t)v.addEvent(t[r],e,n)},ad
2025-04-23 13:08:57 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6e 6e 65 72 2d 66 6f 6f 74 65 72 20 64 2d 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 66 6c 65 78 2d 66 6c 6f 77 2d 63 6f 6c 75 6d 6e 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 2d 66 6c 65 78 20 66 6c 65 78 2d 66 6c 6f 77 2d 77 72 61 70 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 2d 6c 69 6e 6b 22 20 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 6b 65 6e 7a 6f 2e 63 6f 6d 2f 73 6b 2d 70 72 69 76 61 63 79 2e 70 68 70 2f 22 20 74 61 72 67 65 74 Data Ascii: 1000 <div class="inner-footer d-flex justify-content-center flex-flow-column"> <ul class="d-flex flex-flow-wrap justify-content-center"> <div class="footer-link" ><a href="https://skenzo.com/sk-privacy.php/" target
2025-04-23 13:08:57 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 27 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 63 6f 6e 74 61 69 6e 65 72 27 29 5b 30 5d 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 27 62 6c 6f 63 6b 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 6c 73 65 20 69 66 28 28 65 2e 6b 65 79 43 6f 64 65 20 3d 3d 20 34 30 20 7c 7c 20 65 2e 6b 65 79 43 6f 64 65 20 3d 3d 20 33 38 29 20 26 26 20 73 72 63 68 49 6e 70 75 74 2e 76 61 6c 75 65 20 21 3d 20 22 22 29 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 1000 document.getElementsByClassName('autocomplete_container')[0].style.display = 'block'; } else if((e.keyCode == 40 \|\| e.keyCode == 38) && srchInput.value != ""){
2025-04-23 13:08:57 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 5d 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 74 79 70 65 6f 66 28 72 65 73 70 2e 52 65 73 75 6c 74 73 2e 73 75 67 67 65 73 74 69 6f 6e 47 72 6f 75 70 73 29 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 20 26 26 20 72 65 73 70 2e 52 65 73 75 6c 74 73 2e 73 75 67 67 65 73 74 69 6f 6e 47 72 6f 75 70 73 20 21 3d 20 22 22 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 21 66 69 72 73 74 54 69 6d 65 53 68 6f 77 6e 29 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 27 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 63 6f 6e 74 61 69 6e 65 72 27 29 5b 30 5d 2e 73 Data Ascii: 1000]; if (typeof(resp.Results.suggestionGroups) !== "undefined" && resp.Results.suggestionGroups != "") { if(!firstTimeShown){ document.getElementsByClassName('autocomplete_container')[0].s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49702	104.21.31.250	443	1964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 13:08:57 UTC	682	OUT	GET /__media__/pics/9000/09/890/realtimesearchresults.png HTTP/1.1 Host: s.cdn-fileserver.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://realtimesearchresults.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 13:08:58 UTC	393	IN	HTTP/1.1 200 OK Date: Wed, 23 Apr 2025 13:08:58 GMT Content-Type: image/png Content-Length: 28450 Connection: close Server: cloudflare Last-Modified: Thu, 03 Apr 2025 11:47:31 GMT Accept-Ranges: bytes Cache-Control: max-age=1209600 Expires: Wed, 07 May 2025 10:25:42 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=86400 Age: 9795 Cf-Cache-Status: HIT CF-RAY: 934d97b719bd598b-PHX
2025-04-23 13:08:58 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 2b 00 00 01 3a 08 06 00 00 00 3f 79 d8 c8 00 00 00 09 70 48 59 73 00 00 10 9c 00 00 10 9c 01 26 cd 3a 34 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 6e b7 49 44 41 54 78 01 ed dd 4d 8c 1c 57 76 2f f8 7f 65 55 d1 d3 96 3c 2a b5 0d b7 9e a7 6d 05 3f 84 d6 a6 21 72 bc b1 c7 7e 56 10 7e 18 f7 db 0c 4b d3 5e 79 61 26 37 c6 e0 79 41 d2 0b 1b 90 58 62 b2 49 35 30 6f 61 92 0b 1b 18 6f 98 f4 62 76 1e 95 66 f1 9e 3d f0 03 43 03 7b e0 8d 9f 4a e3 8d 6c 15 c5 90 bb 6d ab 1b cf ad e2 eb ee b1 9a f5 35 e7 54 46 8a c9 64 7e c4 c7 3d 37 6e 44 fe 7f 40 20 8b 55 c1 aa c8 f8 ca b8 e7 9e 7b 2e 40 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 Data Ascii: PNGIHDR+:?ypHYs&:4sRGBgAMAanIDATxMWv/eU<*m?!r~V~K^ya&7yAXbI50oaobvf=C{Jlm5TFd~=7nD@ U{.@DDDDDDDDDDDDDDDDDDDDDDDDD
2025-04-23 13:08:58 UTC	1369	IN	Data Raw: 6a 80 0c 9e ef ab 16 81 3f df 59 15 aa c8 fd ac 86 a1 36 2e 24 20 22 aa 80 c1 0a 0a ca 82 05 29 c6 1d 05 2d 4e 9c 38 71 93 41 0b 1b 59 cf 59 84 66 eb 39 0c 58 34 ae 5e 85 e3 a2 7a be 53 be 5f 84 3d cb 63 1a 5a 2f 69 e3 82 6d 25 24 33 7e 16 c3 c8 c1 c1 41 9a 77 dd 3a 86 93 b9 be 8f 67 59 0b 5d f8 55 f4 7e d6 b8 f3 bd c8 79 44 44 34 09 83 15 14 04 2d 9c a9 8d f4 05 0d 52 3c 41 8b 87 4a d0 e2 9e 04 6d ba 20 a7 2c 1f aa 87 b3 7a 8c 2f fa 7d b8 d7 7b e3 8d 37 2e a1 02 e3 e1 02 26 64 7b 3f 86 23 be b3 2a 94 a7 bf 67 d9 a0 49 10 96 b6 d7 ab 98 da f3 9e 05 5e ad 86 04 14 1a ee 53 d3 70 32 a7 ef 5d 3e 1b bc cf 28 53 b4 5e 85 ef a1 36 0e 04 35 6c 8c 88 9a 89 b3 81 50 ed a4 51 be 2e 2f 77 d0 dc a2 99 16 22 0c 0a 71 9e 5f 5d 5d bd c0 29 4f 9d 89 61 44 1e 24 ef be f5 Data Ascii: j?Y6.$ ")-N8qAYYf9X4^zS_=cZ/im%$3~Aw:gY]U~yDD4-R<AJm ,z/}{7.&d{?#*gI^Sp2]>(S^65lPQ./w"q_]])OaD$
2025-04-23 13:08:58 UTC	1369	IN	Data Raw: f0 e2 bb 47 59 18 35 62 c0 62 ba 90 7a a6 9c 0e 03 d0 6c 80 82 eb 9b 3d f8 86 3a 5c 40 03 15 79 1a f3 ab ab ab 9b fa 2a eb a6 65 7b 6d e7 b1 48 9b 37 ee 6d 6f 5d 01 3e e3 8c 00 d3 b4 fa c0 02 af 96 f7 d5 b9 ca d4 eb a9 3b ab 22 93 e4 5d d1 32 b0 16 fa cc 4d 44 44 8a c1 0a 72 4a 8b 69 4a 6f c7 1d d4 64 18 a0 f8 fa ce cb 85 b2 26 ca d2 bf f1 cb 3f fc f2 d1 a2 b6 24 60 f1 67 3f f1 51 9d 81 8b e8 d1 a3 47 6f 47 51 74 36 4d d3 b6 15 c4 ab c2 ac 71 52 b4 67 ca 75 63 43 1b d6 28 66 11 87 0b e4 19 02 d2 1f 3e b8 1b 17 d9 5c d3 e0 82 cb 0c 14 16 e0 2b c6 38 23 20 81 ad 90 02 af 75 0f 03 29 14 f8 0d 21 ab 42 15 2c ae 19 c1 48 c8 33 37 11 11 0d 05 19 ac d0 d9 0d a4 87 2b 92 1b e9 69 f9 30 7a 25 eb 89 8a f0 38 7d 3a 02 15 a5 0f c6 5b da f3 29 1f 94 b7 2d 7a de 75 7a Data Ascii: GY5bbzl=:\@y*e{mH7mo]>;"]2MDDrJiJod&?$`g?QGoGQt6MqRgucC(f>\+8# u)!B,H37+i0z%8}:[)-zuz
2025-04-23 13:08:58 UTC	1369	IN	Data Raw: 4e 92 77 45 d9 f7 4e 33 5b b4 61 24 0d ea 5b 45 fe 8f 65 71 3e b9 7f 7c 8c 80 ec ef ef e7 ca aa 98 91 99 62 3d 0c c4 65 a3 33 86 91 b6 15 d7 b4 bc 06 ac 87 cc 58 06 5e 4b 5c bf 79 9e 17 8e 66 17 b1 ae 79 d2 e9 74 a2 69 3f 93 7d 76 b1 48 56 85 71 01 53 95 e4 5d d1 32 b0 86 70 67 6e 22 22 7a 8a d3 60 85 66 53 c8 0d ff 3d 1d 56 00 6a 9a dc 1f 8a d9 f0 0f 93 ea de 4a 87 45 fc de 77 7f b1 55 c3 3e e6 d1 f7 fc 8d 4f 7e e5 28 40 63 68 6d 77 77 77 d1 86 83 98 f5 3a e7 ed 99 ba 72 e5 ca 55 8b 5a 15 25 1a 01 31 ec 24 08 44 96 41 d2 cd b1 6a 32 63 1f 9a 06 2b 5c 9d 0f da db 0e 3b 41 65 cb 38 12 c3 4e 02 5b 31 ec 24 45 56 ce 39 1c e5 f3 c6 b0 4e 5f 0a 23 d3 02 7f 7a 1f 90 9f 75 91 cf f0 7e 1a c3 90 d1 50 9b 32 18 a8 20 a2 c6 70 36 75 e9 89 13 27 2e ca c3 7b a1 9e 3e Data Ascii: NwEN3[a$[Eeq>\|b=e3X^K\yfyti?}vHVqS]2pgn""z`fS=VjJEwU>O~(@chmwww:rUZ%1$DAj2c+\;Ae8N[1$EV9N_#zu~P2 p6u'.{>
2025-04-23 13:08:58 UTC	1369	IN	Data Raw: 90 99 90 86 fb e4 0d 90 8d 0f 8b 91 6b 3b 85 91 d1 eb 5e fe 6e ae a9 b9 a7 14 d8 8d 61 64 3c d3 24 07 cb c0 89 13 ac 57 41 44 be e4 2e b0 99 cd fa c1 40 45 bb dc bd 7f ff 7e 77 de 4a 56 59 15 5a 50 f3 d9 83 55 2c 3a 09 58 f4 1f 60 63 4d 22 87 37 a7 ad a3 f5 3c 7e f3 d3 af e2 0f 7f f2 af e1 52 96 5d 71 ab 85 33 83 c4 68 18 e9 e1 3c 63 d1 e8 69 42 e0 46 33 1e 2a 4e e3 e9 3a ab 42 7b cb 77 a4 47 18 56 1c cc 34 62 76 5c ab 04 8e 42 64 5c a0 d2 74 5f 05 36 dc 27 57 23 7a 42 36 98 e9 e7 8b d6 78 d0 69 7c f3 66 a0 8c 17 d8 35 3e 3f 54 52 64 65 e3 99 9b 9c 68 5b 01 5e 22 0a 57 ee 60 45 36 3d 69 04 6a 03 7d 70 b8 2c 81 8a 7e ce f5 73 55 d8 2f 42 eb 54 bc b0 fb 0c 5a 22 fa 27 f4 a2 7f 85 f2 8d ad c1 4c 21 57 d6 06 53 9b 4e f6 eb 3b 5f c1 ff f3 e3 df c6 d6 17 be 03 Data Ascii: k;^nad<$WAD.@E~wJVYZPU,:X`cM"7<~R]q3h<ciBF3*N:B{wGV4bv\Bd\t_6'W#zB6xi\|f5>?TRdeh[^"W`E6=ij}p,~sU/BTZ"'L!WSN;_
2025-04-23 13:08:58 UTC	1369	IN	Data Raw: d0 a2 64 55 8c 89 aa 04 2c 8e e3 46 f2 f7 d8 d8 3c 9c 52 37 e4 97 7f f8 e5 a3 21 21 0e 67 06 39 ad 41 aa 26 67 37 65 c5 35 61 24 19 fd 87 a6 cb 4b c3 71 c7 a0 97 db 59 a1 4d cb 87 df 3a 67 01 29 90 55 a1 4a 0f cb b2 0c 54 64 bf 3f 42 71 96 8d ab 36 36 68 62 18 f1 30 64 26 86 91 22 d7 6f d5 e2 9a ca 7a 2a e0 19 36 67 64 55 58 07 08 8a 9e 1f 2c ae 49 44 34 66 5a 98 bb d2 98 fb 1c 2e 68 5d 0a 50 c8 9c 0e 01 59 ac ac 8a 27 0c 03 16 11 4a d8 c7 f2 e5 59 3f d7 99 41 1c 5a 93 87 6f eb f1 bb a6 a4 11 1b c3 ce 13 e3 d3 b3 60 42 02 f7 d6 76 77 77 bb a8 c8 78 b8 40 82 9a 68 2f 2f 1c 17 fe ad 4b 99 61 20 96 05 f8 e4 fa 69 5b 71 cd a8 a9 43 66 f4 fa 85 9d 04 c5 c4 79 56 9a 15 bc d1 a9 80 51 03 f9 bb 53 3f 43 8d ef 91 aa 68 f0 8f b5 68 88 88 c6 3c 15 ac 30 ce aa d8 91 Data Ascii: dU,F<R7!!g9A&g7e5a$KqYM:g)UJTd?Bq66hb0d&"oz*6gdUX,ID4fZ.h]PY'JY?AZo`Bvwwx@h//Ka i[qCfyVQS?Chh<0
2025-04-23 13:08:58 UTC	1369	IN	Data Raw: 55 e0 98 ea f1 ff 18 1b 53 7f ae 75 2b 5c 0d 05 59 5d 5d 8d d0 a0 0f d9 ba a7 7d d3 14 7a ab a1 20 18 4c d5 d9 cb bb b2 e5 70 01 14 af 70 5f 99 06 a2 e4 fd c4 f3 d6 2b d2 50 29 22 1b 67 1f c1 48 81 ac 0d b3 de f6 22 29 eb 4d 60 7c 0d ec 58 0e 99 c9 ce f7 08 36 0a 5d bf 79 9f 07 f2 06 21 24 f0 6a 7a ef 90 6d cd 35 ec d8 f8 fc 50 45 b3 19 cc ae ed b6 d5 a2 99 c0 ba f6 48 15 0c 54 10 39 30 1c 06 e2 6c f6 87 4c ea 6a f6 8f 07 e8 ad ad e0 e0 e2 01 0e 2f 49 a0 e2 a8 b7 57 1a f0 58 24 fa a8 d0 c1 3e 3e c6 95 ad 25 2c dd fe 39 b8 7f 20 1f e1 2c 10 c4 cc 8a d9 1e e1 a0 8b 02 8d d0 79 4e 3e 5a 73 59 b7 42 1f 00 9a f4 41 1b c3 4e 92 73 bd 77 8d b6 63 4d 87 41 e4 4d 2b ae 3b 70 e3 da fe fe 7e de 19 40 9c 07 c8 33 a6 ef 39 6f 36 9b 65 1d 83 b6 35 68 8c af 01 d3 9a 2d Data Ascii: USu+\Y]]}z Lpp_+P)"gH")M`\|X6]y!$jzm5PEHT90lLj/IWX$>>%,9 ,yN>ZsYBANswcMAM+;p~@39o6e5h-
2025-04-23 13:08:58 UTC	1369	IN	Data Raw: 18 81 4a 5a 72 3a e6 98 16 5b 8e 31 f4 41 30 ee 75 2e d5 30 d1 21 0d ae c7 65 8f 58 db dd dd ed ce f8 79 8c 06 99 d4 33 bb b1 b1 d1 cd 93 55 a1 8d 15 1f e9 c8 da f8 30 3c 9e 47 e4 b3 73 56 03 ca b2 b7 dd c2 8e cf 42 ac e3 42 29 50 59 54 16 84 0c 22 f0 9a 77 38 59 99 e0 8d c3 c6 6e a9 e1 5f 96 e7 47 89 4c 13 5e db e5 85 5e 5c 93 88 1c d1 60 85 b3 46 49 95 2a cf 07 e8 c4 a0 2a d6 fe 09 bd 08 44 0e 68 43 10 0d 60 dc eb 5c 7a 96 04 1d d7 0b 23 f2 9e cf 4d fa 7e 8b 86 0b e4 cd aa 30 ad 55 31 4a 1a 58 a6 c1 8a 59 bd d8 4d 9b 46 18 35 3e a8 87 34 33 50 51 c6 43 02 8a 1e 93 38 cf 4a 65 82 37 8e 0a d6 26 65 b2 2a 8c cf 0f 95 14 59 b9 81 59 53 21 35 c2 63 84 ab 8d 33 2c 11 d5 c6 69 b0 42 6e bc 55 8a 4f 45 a0 4a 76 b1 1f 83 68 b1 84 3a ed 5b 1f 76 e2 49 81 89 26 0e Data Ascii: JZr:[1A0u.0!eXy3U0<GsVBB)PYT"w8Yn_GL^^\`FI*DhC`\z#M~0U1JXYMF5>43PQC8Je7&eYYS!5c3,iBnUOEJvh:[vI&
2025-04-23 13:08:58 UTC	1369	IN	Data Raw: 05 64 e3 2f 9f fd 07 b8 c2 e2 9a 44 44 44 14 a0 90 8b 6b 72 f8 2c 91 91 a5 e1 17 27 4f 9e d4 79 0f 2b 67 43 8c d8 59 5d 5d 3d f3 c1 07 1f a4 a0 c6 71 79 3e 9c fe 97 2f e1 f7 ff f1 57 41 ee 7d b2 f2 43 fc c6 8b ef c0 a1 db f7 ef df bf 04 22 22 22 a2 70 b8 6e a7 b8 74 06 cc ae 20 32 d1 19 f9 da 69 8b 47 ac ed ee ee 3a eb 9d 27 ef 9c d5 0a d1 a1 20 5b 5f f8 2e c8 bd f7 dd d6 aa d0 21 40 9b 20 22 22 22 0a 87 66 54 87 1a a8 d0 6c 54 06 2a 88 8c 7c 1e ac 90 46 4a 1f ee ad 4b 0f fd 3a a8 71 5c 37 5a ff af 9f f8 08 e4 de dd 2f fe 0d 1c da d9 de de 4e 40 44 44 44 14 8e 08 e1 62 a0 82 c8 d0 e7 c1 8a ac 91 62 31 56 fd ce cb 2f bf 1c 81 1a 25 2b b2 e8 ec 7c f8 8b 67 be cd 42 9b 8e fd 99 04 80 74 18 88 43 1c 73 49 44 44 44 a1 89 11 ae f7 41 44 66 46 87 81 68 6f fa 6d Data Ascii: d/DDDkr,'Oy+gCY]]=qy>/WA}C"""pnt 2iG:' [_.!@ """fTlT*\|FJK:q\7Z/N@DDDbb1V/%+\|gBtCsIDDDADfFhom
2025-04-23 13:08:58 UTC	1369	IN	Data Raw: 49 1d c1 0b bd bf bc 8d 30 25 18 64 56 54 31 bc 87 ea b3 45 0c 37 f7 4f 3d 6e 9b 18 1c b7 4d 10 b5 40 a1 a8 a0 34 54 7b d2 50 e5 54 a3 7e ec 74 3a 9d b3 1f 7e f8 61 08 d1 ed 27 9c 3c 79 52 1f 08 2e c2 80 06 2c 7e f7 bb bf b0 d0 19 16 c6 81 0a 75 21 e4 ec 9d 40 0c 7b ff 86 01 8a a6 46 d0 52 b4 a3 a1 dc 96 e3 a1 f4 01 f2 2e 9a f7 20 39 1a 9c d0 d7 08 cd 97 22 ec 9e f9 2e ea 0d 56 b8 48 73 ef 62 10 a4 88 e0 4f 4f 96 db a8 ff 7e 37 7a df 8a d1 6c 29 06 e7 c2 35 f8 0b 06 f5 30 38 77 42 a4 e7 d7 25 94 13 63 70 4e 74 61 fb 59 96 62 70 bc fa 20 6a b0 c2 29 4c 96 0d 55 7a ca ce ea ea ea 99 d0 32 2c b2 3a 26 9a 9a 67 76 93 fd ed ff f2 f3 f8 fa c3 af 60 d1 18 d6 a8 18 ea 4b a0 c2 d7 2c 3f 4d 14 63 f0 70 d4 f4 06 f1 34 09 1e 37 94 43 0f 5c b4 e9 41 7f 92 14 e1 3f 48 Data Ascii: I0%dVT1E7O=nM@4T{PT~t:~a'<yR.,~u!@{FR. 9".VHsbOO~7zl)508wB%cpNtaYbp j)LUz2,:&gv`K,?Mcp47C\A?H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49704	104.21.31.250	443	1964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 13:08:58 UTC	436	OUT	GET /__media__/pics/9000/09/890/realtimesearchresults.png HTTP/1.1 Host: s.cdn-fileserver.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 13:08:59 UTC	393	IN	HTTP/1.1 200 OK Date: Wed, 23 Apr 2025 13:08:58 GMT Content-Type: image/png Content-Length: 28450 Connection: close Server: cloudflare Last-Modified: Thu, 03 Apr 2025 11:47:31 GMT Accept-Ranges: bytes Cache-Control: max-age=1209600 Expires: Wed, 07 May 2025 10:25:42 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=86400 Age: 9796 Cf-Cache-Status: HIT CF-RAY: 934d97bc885797fd-PHX
2025-04-23 13:08:59 UTC	976	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 2b 00 00 01 3a 08 06 00 00 00 3f 79 d8 c8 00 00 00 09 70 48 59 73 00 00 10 9c 00 00 10 9c 01 26 cd 3a 34 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 6e b7 49 44 41 54 78 01 ed dd 4d 8c 1c 57 76 2f f8 7f 65 55 d1 d3 96 3c 2a b5 0d b7 9e a7 6d 05 3f 84 d6 a6 21 72 bc b1 c7 7e 56 10 7e 18 f7 db 0c 4b d3 5e 79 61 26 37 c6 e0 79 41 d2 0b 1b 90 58 62 b2 49 35 30 6f 61 92 0b 1b 18 6f 98 f4 62 76 1e 95 66 f1 9e 3d f0 03 43 03 7b e0 8d 9f 4a e3 8d 6c 15 c5 90 bb 6d ab 1b cf ad e2 eb ee b1 9a f5 35 e7 54 46 8a c9 64 7e c4 c7 3d 37 6e 44 fe 7f 40 20 8b 55 c1 aa c8 f8 ca b8 e7 9e 7b 2e 40 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 Data Ascii: PNGIHDR+:?ypHYs&:4sRGBgAMAanIDATxMWv/eU<*m?!r~V~K^ya&7yAXbI50oaobvf=C{Jlm5TFd~=7nD@ U{.@DDDDDDDDDDDDDDDDDDDDDDDDD
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 50 2d e4 81 3a a8 86 79 76 1e 0f 87 2b ad eb f7 b2 40 86 0e 2f ba bd bc bc 6c d6 c0 cd 02 37 4d 0a 54 a8 2d 38 a4 59 08 b2 0f ba f0 e0 d1 a3 47 be ee 59 af c2 ce bb 08 88 5c 3f e7 d0 72 12 7c 9a 78 ce 5b 5f bf 45 1a 98 b2 8d be ef 23 7a 2d 39 0f 56 f8 bc 1f 28 39 7f 8b 5e 4f af a0 61 18 a8 20 a2 2a ea ed 5a 24 ca 49 b3 28 a4 a1 7f 4f 1a 6e 9f 4a 03 ae 07 c3 1a 14 c6 62 59 ee c8 7b 79 20 cb 1d 2d fc 09 f2 2d 46 33 68 90 eb 8e 3c 38 3f d0 9e 3e 7d 88 86 63 0d 0c 54 28 a7 8d 65 d9 07 e7 e1 89 04 5a 23 f8 61 76 5c a7 35 9c eb a2 c1 60 b4 db ce 37 bf f9 cd 89 fb dc f8 fa 4d 50 8c 65 80 ec 29 56 81 3f cd b2 82 47 72 fe 16 ba 9e 1a 78 be 27 20 22 aa 80 c1 0a 0a da 30 48 21 8d b6 7b 68 4e 23 33 8f 48 96 ee ee ee 2e 83 16 9e e9 6c 30 68 18 4d 49 96 87 e8 7b 12 b4 Data Ascii: P-:yv+@/l7MT-8YGY\?r\|x[_E#z-9V(9^Oa *Z$I(OnJbY{y --F3h<8?>}cT(eZ#av\5`7MPe)V?Grx' "0H!{hN#3H.l0hMI{
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 1a 83 15 64 4a 0b 69 4a e3 8c 81 0a 3b b1 66 ac bc fc f2 cb 11 68 2a e3 9e 29 dc b8 71 23 c9 bb ae 1c 2f a7 c1 a5 92 e9 e0 0b 37 5c 20 6f 56 85 ac 73 1b 86 64 ff bc 08 03 96 8d c6 b6 0d 01 c9 34 f6 1a 08 25 f0 6a 3c 1c 65 ae b2 19 62 59 56 45 0f f5 d9 29 38 54 2e 86 9d 60 33 e1 88 88 14 67 03 21 33 d2 eb af 3d 17 7d 04 ec d9 83 63 b2 ac e2 85 bd 67 a7 ae f3 c9 ca 0f 64 f9 21 02 16 69 e1 4d 09 58 9c e5 4c 21 93 19 f7 4c 25 45 56 36 78 b8 0f 2a b3 22 d4 e1 02 39 b3 2a 52 09 26 dd 92 f3 c5 2c 3d 5c 82 b7 cf c3 06 0b f0 15 60 39 bb 42 91 e0 65 51 1a 78 b5 bc 9f 15 d9 76 cb e1 28 79 94 9d 11 24 cf bd c0 92 9c 77 45 af a7 85 9d b9 89 88 88 c1 0a 32 a1 81 0a 79 e9 23 10 1a 94 38 f5 e8 79 9c fc 91 2e 6b 47 5f bf b0 fb ec 51 a0 22 af 1f 74 76 b1 fd 63 9f 1e 2d df Data Ascii: dJiJ;fh)q#/7\ oVsd4%j<ebYVE)8T.`3g!3=}cgd!iMXL!L%EV6x"9*R&,=\`9BeQxv(y$wE2y#8y.kG_Q"tvc-
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 00 5f 61 4d be 06 82 d8 76 1d 4e 86 7c 81 93 f7 e5 f9 c2 bc 58 6d 8e f5 72 3d e3 e8 70 30 eb ec de a2 43 6d 60 87 c5 35 89 a8 11 cc 83 15 59 26 c5 03 f9 52 0b fe c5 a0 e0 e8 70 81 97 5f 7e 39 42 41 5a a7 42 5e 6e c2 98 66 21 fc d1 b7 ff 2d ce 7f ef ab 68 8b 17 f6 9e c1 ef 7d f7 17 f0 ef fe f9 e7 f1 ec c1 31 18 8b b2 61 3a 0b c7 b2 d7 19 c5 0b a5 5d 84 63 72 5c 93 22 eb 87 12 b8 f1 24 4f ad 8a f4 fa f5 eb fd f1 ef 1b 37 b0 0a 17 06 9c 23 86 9d 04 2d 63 59 60 d6 fa 1a 08 e5 fa 2d 30 1c 25 91 df 9b c2 d6 cc fb 7b 91 ac 0a 2d b2 6b 79 7e a0 f8 f5 c4 5a 34 44 b4 f0 cc 82 15 9a 7a 3e 92 49 11 81 82 56 66 3a 2f f9 60 d7 c6 40 04 43 9a 7d f0 47 df fa b7 38 f5 23 97 cf f6 e1 f8 f5 9d af 1c bd 3f 0f c3 42 d6 4f 9c 38 71 09 0b c6 b2 d7 19 05 d2 a6 b3 74 de 18 6e dd Data Ascii: _aMvN\|Xmr=p0Cm`5Y&Rp_~9BAZB^nf!-h}1a:]cr\"$O7#-cY`-0%{-ky~Z4Dz>IVf:/`@C}G8#?BO8qtn
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 21 20 44 e4 43 a9 60 c5 30 50 01 4e 49 da 16 e9 ea ea 6a 92 63 3d 93 a2 9a 5a 54 f2 d7 be 7f 1c 4d b6 8f e5 b9 c1 87 51 2f e2 c6 a5 03 1c ce ed dd d5 20 ce e9 7f f9 12 0c ac 65 d9 15 ad 65 39 ed 9b 47 89 2c 67 25 50 51 75 38 89 e5 58 6c 57 2a cd a6 90 65 b4 44 f3 d6 93 86 df dc c0 ac b2 ec 0d ce b6 23 42 05 2c c0 57 58 0c 3b d6 43 66 2c af df 04 c5 c4 f3 56 18 9f 5d c4 72 9a cc f1 eb 28 6f 56 85 d8 1a ab fd 13 c3 50 40 c5 35 5d 61 56 05 11 79 51 38 58 c1 40 45 fb e8 c3 fb 07 1f 7c 90 ce 5a c7 2a ab e2 eb 0f 5f 6e c3 ac 1f 3b c7 d1 2b fc c1 7d 1c 37 7a 07 c0 dc 31 fa df f8 e4 5f e3 85 bd 67 e1 5a 9b b3 2b 8c 7b 9d cd 69 af be 2c 17 a4 e7 ea ac 8b de 2b cb e1 02 0e 25 a8 26 d7 74 a5 05 8a 93 a6 30 34 29 7d bd e0 ff 0f a9 b7 bd 09 cc ea 7b 58 0f 99 b1 0c bc Data Ascii: ! DC`0PNIjc=ZTMQ/ ee9G,g%PQu8XlWeD#B,WX;Cf,V]r(oVP@5]aVyQ8X@E\|Z_n;+}7z1_gZ+{i,+%&t04)}{X
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 1a 59 0e 17 28 51 e1 de a9 2c 10 d3 cd b1 6a 52 b6 41 69 3d 23 88 9c 4f a5 ae 39 cb 69 4b db 56 5c b3 c9 43 66 2c 03 af 25 ae df 3c 3d fe 53 67 17 91 bf f7 10 f5 9a f8 99 ea a1 00 71 92 77 c5 90 66 7e 21 22 0a c5 d4 60 45 36 fc c3 69 2f df 34 c3 20 85 4e a1 c9 ec 89 70 c8 71 39 07 87 da 9c 55 31 4a 02 0d bd 8f 71 e5 bd 07 e8 45 28 49 0b 6e 2e cd 78 c8 f9 da f7 8f e3 f4 bf 7c 09 0e ad ad ae ae 3a cd a2 a9 91 59 af b3 3c 70 27 23 5f bf 03 f7 d6 1c 57 a6 8f 61 27 41 8d 74 9c 7a ce 55 0b 67 55 0c 49 63 d4 f4 f3 a8 cc 18 fe 90 7a db 1b 22 86 9d 04 b6 62 d8 49 50 4c 9e 46 f4 ac c6 70 8a 9a cc 99 09 28 86 a1 22 d9 0c 81 cd fc 42 44 14 84 a9 35 2b 7c 0c ff d0 3a 14 d2 8b 73 e1 83 0f 3e 48 41 41 d1 5e 76 79 20 76 da 78 6d 79 56 c5 98 a5 d3 1d ec df 93 80 c5 d9 e3 Data Ascii: Y(Q,jRAi=#O9iKV\Cf,%<=Sgqwf~!"`E6i/4 Npq9U1JqE(In.x\|:Y<p'#_Wa'AtzUgUIcz"bIPLFp("BD5+\|:s>HAA^vy vxmyV
2025-04-23 13:08:59 UTC	371	IN	Data Raw: 7b 30 94 37 00 a1 bd ed 56 8d 58 6d 44 d6 51 53 c0 52 93 0b cc 86 74 fd e6 7c 1e 48 72 ac a3 bf eb 21 8c e9 b9 3c 6b aa d2 21 e3 02 a6 85 0a b0 66 53 6e b7 6e e6 26 8f 2c 87 f3 54 95 80 88 2a 59 19 f9 fa 3c 1c 93 9b f5 ed 0f 3e f8 20 05 35 86 4e 5d e9 ea 21 e9 85 bd 67 39 04 64 b2 b5 65 ec 6b 3d 82 7e 91 ff 94 0d 05 89 27 fd ec 97 7e f0 65 fc c1 4f fe 35 1c 09 f9 83 7f 96 da a6 7d d3 a1 20 72 dd c4 70 2f 7e fd f5 d7 4f 97 e8 19 6b d5 70 01 cd 14 c9 d9 a8 4f 64 5f f5 e1 d0 1b 6f bc 91 96 99 62 34 2f f9 dd 2f e6 59 cf b2 b7 5d 02 3c 6d ac 57 d1 e4 6b 20 88 6d 2f 10 20 cb 7b fe a4 b0 37 af a8 e6 90 e9 e7 5c 9e 4c 93 a1 b6 ce dc e4 51 8c 70 a5 20 a2 4a 8e 86 81 64 43 40 62 b8 95 6e 6f 6f 33 fd a9 61 5c a6 cd 9e 74 3b 34 a1 6d 0a 07 07 0f b0 bc 39 ed 67 2f ec Data Ascii: {07VXmDQSRt\|Hr!<k!fSnn&,T*Y<> 5N]!g9dek=~'~eO5} rp/~OkpOd_ob4//Y]<mWk m/ {7\LQp JdC@bnoo3a\t;4m9g/
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: ef 63 39 39 0e fb 34 5d 97 e9 a7 1c 02 32 9d 0e e7 f8 27 f4 a2 7f 55 e0 98 ea f1 ff 18 1b 53 7f ae 75 2b 5c 0d 05 59 5d 5d 8d d0 a0 0f d9 ba a7 7d d3 14 7a ab a1 20 18 4c d5 d9 cb bb b2 e5 70 01 14 af 70 5f 99 06 a2 e4 fd c4 f3 d6 2b d2 50 29 22 1b 67 1f c1 48 81 ac 0d b3 de f6 22 29 eb 4d 60 7c 0d ec 58 0e 99 c9 ce f7 08 36 0a 5d bf 79 9f 07 f2 06 21 24 f0 6a 7a ef 90 6d cd 35 ec d8 f8 fc 50 45 b3 19 cc ae ed b6 d5 a2 99 c0 ba f6 48 15 0c 54 10 39 30 1c 06 e2 6c f6 87 4c ea 6a f6 8f 07 e8 ad ad e0 e0 e2 01 0e 2f 49 a0 e2 a8 b7 57 1a f0 58 24 fa a8 d0 c1 3e 3e c6 95 ad 25 2c dd fe 39 b8 7f 20 1f e1 2c 10 c4 cc 8a d9 1e e1 a0 8b 02 8d d0 79 4e 3e 5a 73 59 b7 42 1f 00 9a f4 41 1b c3 4e 92 73 bd 77 8d b6 63 4d 87 41 e4 4d 2b ae 3b 70 e3 da fe fe 7e de 19 40 Data Ascii: c994]2'USu+\Y]]}z Lpp_+P)"gH")M`\|X6]y!$jzm5PEHT90lLj/IWX$>>%,9 ,yN>ZsYBANswcMAM+;p~@
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 5f db a3 22 84 5d 80 3f 01 11 39 a1 c1 8a 08 8e 54 19 db 9b 4d cb 18 81 4a 5a 72 3a e6 98 16 5b 8e 31 f4 41 30 ee 75 2e d5 30 d1 21 0d ae c7 65 8f 58 db dd dd ed ce f8 79 8c 06 99 d4 33 bb b1 b1 d1 cd 93 55 a1 8d 15 1f e9 c8 da f8 30 3c 9e 47 e4 b3 73 56 03 ca b2 b7 dd c2 8e cf 42 ac e3 42 29 50 59 54 16 84 0c 22 f0 9a 77 38 59 99 e0 8d c3 c6 6e a9 e1 5f 96 e7 47 89 4c 13 5e db e5 85 5e 5c 93 88 1c d1 60 85 b3 46 49 95 2a cf 07 e8 c4 a0 2a d6 fe 09 bd 08 44 0e 68 43 10 0d 60 dc eb 5c 7a 96 04 1d d7 0b 23 f2 9e cf 4d fa 7e 8b 86 0b e4 cd aa 30 ad 55 31 4a 1a 58 a6 c1 8a 59 bd d8 4d 9b 46 18 35 3e a8 87 34 33 50 51 c6 43 02 8a 1e 93 38 cf 4a 65 82 37 8e 0a d6 26 65 b2 2a 8c cf 0f 95 14 59 b9 81 59 53 21 35 c2 63 84 ab 8d 33 2c 11 d5 c6 69 b0 42 6e bc 55 8a Data Ascii: _"]?9TMJZr:[1A0u.0!eXy3U0<GsVBB)PYT"w8Yn_GL^^\`FI*DhC`\z#M~0U1JXYMF5>43PQC8Je7&eYYS!5c3,iBnU
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 61 98 45 f1 14 69 ac 6e 2e 2f 2f df 84 23 7f f6 df 7e 84 af ef 7c 05 64 e3 2f 9f fd 07 b8 c2 e2 9a 44 44 44 14 a0 90 8b 6b 72 f8 2c 91 91 a5 e1 17 27 4f 9e d4 79 0f 2b 67 43 8c d8 59 5d 5d 3d f3 c1 07 1f a4 a0 c6 71 79 3e 9c fe 97 2f e1 f7 ff f1 57 41 ee 7d b2 f2 43 fc c6 8b ef c0 a1 db f7 ef df bf 04 22 22 22 a2 70 b8 6e a7 b8 74 06 cc ae 20 32 d1 19 f9 da 69 8b 47 ac ed ee ee 3a eb 9d 27 ef 9c d5 0a d1 a1 20 5b 5f f8 2e c8 bd f7 dd d6 aa d0 21 40 9b 20 22 22 22 0a 87 66 54 87 1a a8 d0 6c 54 06 2a 88 8c 7c 1e ac 90 46 4a 1f ee ad 4b 0f fd 3a a8 71 5c 37 5a ff af 9f f8 08 e4 de dd 2f fe 0d 1c da d9 de de 4e 40 44 44 44 14 8e 08 e1 62 a0 82 c8 d0 e7 c1 8a ac 91 62 31 56 fd ce cb 2f bf 1c 81 1a 25 2b b2 e8 ec 7c f8 8b 67 be cd 42 9b 8e fd 99 04 80 74 18 88 Data Ascii: aEin.//#~\|d/DDDkr,'Oy+gCY]]=qy>/WA}C"""pnt 2iG:' [_.!@ """fTlT*\|FJK:q\7Z/N@DDDbb1V/%+\|gBt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49703	104.21.31.250	443	1964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 13:08:58 UTC	622	OUT	GET /__media__/fonts/Inter-Regular/Inter-Regular.woff HTTP/1.1 Host: s.cdn-fileserver.com Connection: keep-alive Origin: https://realtimesearchresults.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://realtimesearchresults.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 13:08:59 UTC	453	IN	HTTP/1.1 200 OK Date: Wed, 23 Apr 2025 13:08:59 GMT Content-Type: font/woff Content-Length: 27676 Connection: close Server: cloudflare Accept-Ranges: bytes Last-Modified: Wed, 15 Jul 2020 10:51:09 GMT Cache-Control: max-age=14400 Expires: Wed, 23 Apr 2025 13:13:59 GMT Access-Control-Allow-Origin: * Edge-Control: downstream-ttl=1d Via: 1.1 google Alt-Svc: h3=":443"; ma=86400 Cf-Cache-Status: REVALIDATED CF-RAY: 934d97bcca1697f4-PHX
2025-04-23 13:08:59 UTC	916	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 6c 1c 00 12 00 00 00 01 15 d8 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 46 46 54 4d 00 00 01 94 00 00 00 1c 00 00 00 1c 89 9f 3c 57 47 44 45 46 00 00 01 b0 00 00 00 6b 00 00 00 96 0e 21 0e 22 47 50 4f 53 00 00 02 1c 00 00 0c 6d 00 00 4a ec bb 57 7c 32 47 53 55 42 00 00 0e 8c 00 00 05 ca 00 00 26 2a 34 20 d8 82 4f 53 2f 32 00 00 14 58 00 00 00 59 00 00 00 60 1a 30 8a 99 63 6d 61 70 00 00 14 b4 00 00 01 83 00 00 01 da 67 7b a3 80 63 76 74 20 00 00 16 38 00 00 00 42 00 00 00 42 13 87 0d 58 66 70 67 6d 00 00 16 7c 00 00 01 b1 00 00 02 65 53 b4 2f a7 67 61 73 70 00 00 18 30 00 00 00 08 00 00 00 08 00 00 00 10 67 6c 79 66 00 00 18 38 00 00 4b 48 00 00 90 b8 9b d7 ac d2 68 65 61 64 00 00 63 80 00 00 00 Data Ascii: wOFFlFFTM<WGDEFk!"GPOSmJW\|2GSUB&*4 OS/2XY`0cmapg{cvt 8BBXfpgm\|eS/gasp0glyf8KHheadc
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: ad 14 70 ed f1 ad f7 76 52 12 e5 aa 82 1a 35 42 6e bb b9 bf ae 86 71 83 c7 9b 3c 4e 42 29 f3 fc c4 52 35 8a a7 78 77 99 9a 40 ab 1a c2 56 de db 46 6c 27 f6 f2 de 7e e2 35 e2 2c f3 2e f3 de 15 a2 8b e7 dd 6a 80 ad 05 70 97 79 1e bd a7 38 da d8 b6 0b d3 d5 6b bc 37 83 f7 e6 a8 6b f1 cd 64 2f 29 a8 62 b9 49 44 13 fb ea e1 d1 cd 52 7f 63 f9 38 4b 56 b1 e4 24 a2 87 f0 a5 ae 44 de 67 c4 2d 42 e4 b4 a0 8c b4 96 f3 aa 4a 05 4b 00 93 d5 1e f6 7a 04 b5 6a 1f ea 78 3e 1d 0f b1 d7 3b 98 c9 eb 07 59 63 16 51 4f 1a 1b d5 06 f6 db 82 b6 a4 82 00 eb af 51 63 58 4b 3c 43 ac 23 9e 23 5e 20 4d 7b 78 ec 20 7d af b3 fc 1b c4 61 e2 4d e2 2d e2 08 f1 23 e2 3d d6 ff 39 f1 3e f1 01 f1 21 71 9e f8 05 f1 4b d6 ff 15 f1 6b e2 37 44 82 b8 08 05 bf e3 f1 0f c4 1f 89 8f 89 4b 84 42 fc Data Ascii: pvR5Bnq<NB)R5xw@VFl'~5,.jpy8k7kd/)bIDRc8KV$Dg-BJKzjx>;YcQOQcXK<C##^ M{x }aM-#=9>!qKk7DKB
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 21 7b a6 1b b2 96 03 19 b1 42 d8 32 b7 1a 52 08 f4 ab 65 49 bf 26 61 8b ec 6d ec d0 f9 91 3b cb 17 83 83 e3 db 99 71 48 8f 50 b8 b6 a0 cc 42 9c 47 3a 4c 9c 06 b5 d9 b6 7f 1d a5 e7 12 8b e5 29 16 89 36 08 09 ab 01 14 e9 e6 5c f4 95 ab ad 62 d0 b2 6d 4e 48 46 58 f9 c7 6c f1 dc 71 c0 f0 cc 88 b4 1b 5b 0a 8d 19 32 77 2c 3b ca 36 75 7f 38 67 0e c7 b7 11 a4 50 ed 19 78 f6 1f 93 5b 70 94 ac 6b 88 14 6a 73 fb 30 d3 19 28 cc c2 d4 a9 d6 59 24 bd 25 6f 0e dd 6a 72 cf 44 8c c8 42 b6 63 d0 35 63 6d 9f cf 2a 40 8c 49 39 e6 01 25 57 8c 35 0a 2b 2e 87 a2 97 d4 33 91 cc 27 04 01 ab c6 4c b3 63 62 70 ba 2b 84 63 43 73 99 6b fa 81 e6 b3 a2 d5 49 3b c6 fa d6 32 12 eb c7 bc e2 9f 84 53 3d e4 51 b7 ab df e7 6e 61 67 ac ab f0 75 4a 96 bf 04 b2 47 6f 39 fb 04 ec c6 75 7b 6f 73 Data Ascii: !{B2ReI&am;qHPBG:L)6\bmNHFXlq[2w,;6u8gPx[pkjs0(Y$%ojrDBc5cm*@I9%W5+.3'Lcbp+cCskI;2S=QnaguJGo9u{os
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 3d 72 11 e7 a1 5d 6c 69 0f d3 46 ec 45 07 e7 30 f1 35 89 67 e5 f7 24 9e c7 01 a6 17 e5 37 25 be 2d bf 1a b5 0d 27 71 16 af 22 8e 2e e6 74 e3 16 4e d1 6e 7a 78 7d 1b 77 f0 1e ee 32 bd ff 3f cd 26 70 70 00 00 00 78 da e5 5a 5d 4c 5b 55 1c ff 9d db 0f 5a 7a e9 ba ae 54 44 84 0e 2a 41 82 64 23 84 10 d2 20 22 69 1a e4 43 b1 99 3a 27 5b 29 db 98 a9 8c 30 36 e7 c7 16 c4 97 3d 2c 7b e2 81 4c 62 0c 92 65 0f c6 a8 d1 97 89 5f 1b f2 b4 18 b3 2c 1b 12 8c 3e a8 0f 8b 59 f6 b4 18 63 9c ff 73 ee 2d f7 52 5a 46 a5 b7 94 91 93 9e 73 ef b9 ff ef f3 ff 38 e7 f6 82 01 c8 c7 39 66 83 a9 2d d8 11 86 67 e0 60 df 30 6a 62 91 91 41 b4 c1 4c 4f 71 ef 1e f2 68 60 90 60 a2 19 2b dd a5 9a f7 c2 f4 f4 53 61 1f aa 3b bb 3b 7c f0 f6 74 77 52 9f 14 92 cf d9 74 73 16 31 6b 8b 44 62 23 a8 Data Ascii: =r]liFE05g$7%-'q".tNnzx}w2?&ppxZ]L[UZzTD*Ad# "iC:'[)06=,{Lbe_,>Ycs-RZFs89f-g`0jbALOqh``+Sa;;\|twRts1kDb#
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: df 35 e7 fa 1e 35 9e 49 4e aa ff 41 19 bf 06 1b 93 23 2e e2 93 9c cc 94 1b 15 fd f3 f8 f5 01 c8 99 d9 b4 1e 7f 0f 1e a2 5d c4 34 ae 31 30 1b 73 6d b9 ec 99 fd bc d4 8e 1e ec 5d 77 1e cd f6 99 3f fe 05 cb 0b f4 f3 93 d7 c8 94 87 9e 21 b8 6e d2 e6 79 9a 7d 89 74 7a 19 fb f0 0a 7a b1 9f 3c ea 75 bc 81 53 94 7f df c1 18 65 a9 4f f1 05 be c2 d7 f8 06 df e2 3b 5c c1 4f 58 c0 22 7e 26 49 65 e2 71 4a c0 f3 b7 dd 5e 3c 44 11 6d 12 9e a9 7d 57 e2 51 bf b4 09 2e fb 8f 20 19 4c 3d c2 cb fe f7 72 92 c5 f9 97 3a ca d7 3a 66 f1 b5 4e 10 e1 ff 00 ae 59 14 df 00 00 78 da 63 60 61 49 61 9c c0 c0 ca c0 c2 12 cb bc 98 81 81 61 17 84 66 7a c9 b0 0b 88 19 98 b8 59 99 98 81 c2 0c 2c 0f 18 98 fe 0b 31 2c fc 0f 64 33 82 04 82 82 7d 83 19 1c 18 98 54 ff b0 a5 fd 4b 63 60 e0 d8 c9 Data Ascii: 55INA#.]410sm]w?!ny}tzz<uSeO;\OX"~&IeqJ^<Dm}WQ. L=r::fNYxc`aIaafzY,1,d3}TKc`
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 56 c3 39 12 47 ec 64 2e 09 9a 09 29 0c 89 31 c4 21 15 06 2d 02 29 a4 8a c3 a7 90 f3 aa d1 de 89 3f ed 36 23 89 29 54 ed e6 4e c5 ee 53 6d e6 ce f6 69 76 8b ad 50 b5 da 3a 55 99 16 aa 36 bb ec 54 cd 62 45 05 51 2d a2 ec 54 6c 15 c3 8a cb 4b ca 02 fe 04 77 bc d1 9b 9d e7 0a 88 de 23 d3 ca ca a6 e1 4f e6 7b f6 17 ea f9 e5 34 c3 c1 cb 1f b1 f3 34 89 e7 84 e7 e1 3c 08 e7 28 02 00 90 42 c5 10 08 91 18 12 23 15 2a 92 9f 3d a3 3f a4 4a 0c 3b 9c 18 db a9 88 0e 55 82 03 98 62 3b 55 33 2d 24 c3 8a 5d 72 80 fd d7 d4 fa 9b 56 f8 4c a2 11 fc 61 f7 f0 12 22 75 c2 3d 52 48 06 9d 44 82 c9 00 73 d0 9d 90 14 08 04 82 26 f8 f4 60 4c 9c 05 ae 43 84 26 9b ac 85 ed 82 9c 9a 96 e3 09 a8 f0 6f da e3 3d 89 29 39 1e 7f c8 20 b1 97 44 47 7a 06 be 64 80 97 8c e6 58 2b bc 44 95 4c 9f Data Ascii: V9Gd.)1!-)?6#)TNSmivP:U6TbEQ-TlKw#O{44<(B#*=?J;Ub;U3-$]rVLa"u=RHDs&`LC&o=)9 DGzdX+DL
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 87 b3 3c 60 8c 05 04 24 53 8f 37 4f f8 f4 c0 ee e6 ea 75 55 55 eb aa 9b 77 1d 14 36 02 7b fd ea ec 62 ed 43 ed 89 97 5e d2 9e d4 7e b5 f8 2c fd 15 7c e6 62 ed 23 c1 62 4c ec fe 4c e9 bc 6a e9 fe cc b2 64 40 54 2c cd 0f 24 38 65 87 60 5a 1c f9 c0 03 bb b5 8f 16 d3 62 7a c7 4b 2f d1 db a9 7f f1 59 cd af fd 05 fe f3 9f e5 67 5d 27 ec 15 0f 00 ac 32 c9 22 4c d2 a8 e2 f4 29 f6 f3 60 02 43 36 6e 3f 8c 7e d5 c5 ef 32 94 96 1b c4 80 98 eb b1 52 53 ae cb eb 32 ac a3 e9 da 1f aa a9 dd b2 d7 42 ed d5 da 1f 68 7a b5 f6 2d 3c d0 be 15 8f 3c 72 b8 a1 8d 56 6a 67 da 1a 0e 3f d2 d0 a6 9d a1 95 6d 70 bf 33 a4 5e 5a 22 25 83 1f 30 0b 34 ab 4f 31 05 54 0a ba d3 e0 0f 12 8a ba 93 c4 82 56 a5 04 2f a9 68 86 d3 58 7c 4a ec 79 45 f0 ab 66 90 60 b0 cb e6 58 7c cd 6c 82 b7 c5 9a Data Ascii: <`$S7OuUUw6{bC^~,\|b#bLLjd@T,$8e`ZbzK/Yg]'2"L)`C6n?~2RS2Bhz-<<rVjg?mp3^Z"%04O1TV/hX\|JyEf`X\|l
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 9a fb c8 a2 09 07 7d c7 e7 8b 86 ae 43 a5 e6 a2 07 6f d8 73 fe 27 3b be d8 df f8 cb 6d 74 e3 1d 3b e7 36 2f ba f5 c8 3c 4a 87 64 c5 0b 9f b7 6a 53 72 8a 77 fe 4b d3 81 2f 1b ef 08 22 7d 76 5e fd b3 d4 60 e8 24 69 e0 77 01 7d 92 10 13 d9 40 90 c1 3e 55 86 3f 26 b0 64 3e 55 44 d8 8b 18 ec ba 8f 05 30 ab 6e 80 dd 07 7f f3 ac 20 7c 26 51 4e 47 e7 ca 2d 33 bd 30 38 1b 9e 23 36 b7 95 3b 51 a8 bb 12 d0 a1 07 85 25 47 41 91 5f 24 08 9e f8 6e 50 91 29 77 d2 ac 2b 6f fc 23 25 98 b4 7f f3 4b ff 23 6e f4 5b 1b 1a 7f d3 f8 93 2f 9b 17 bc da bc e0 e7 b3 1f ae 5b 70 68 ee ec 03 f3 17 3c 52 2b 9c a4 fb e8 4b bf 57 96 ed d2 3e d2 fe ba 60 45 e3 97 07 1f fc d3 6e 4a ab 9e a6 b2 38 ef c8 c2 f9 47 16 2d 78 6c fe a2 c7 b9 bc 2e 01 3e 4c 03 7a 9b c0 26 05 0d c8 85 e8 24 21 ef Data Ascii: }Cos';mt;6/<JdjSrwK/"}v^`$iw}@>U?&d>UD0n \|&QNG-308#6;Q%GA_$nP)w+o#%K#n[/[ph<R+KW>`EnJ8G-xl.>Lz&$!
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 60 e7 ec 4d 63 04 3b 4d a5 8f fe 6e d7 1f b4 0b 8f 2e ff dd a9 b5 99 35 63 c7 2e 35 48 bb be 78 70 e7 3f 6f b5 c4 4d 18 36 b3 6b ed e8 ba 7f fd be a1 b3 63 4d 87 f6 fc ff d2 f6 69 ab d3 73 cd bb 5d 79 49 f4 4b fa cf 75 cf dd a1 9e 7a 75 e7 4d 07 19 7f 96 10 62 28 61 f6 30 0e ac 18 f3 c2 15 31 c0 33 07 c6 18 42 c1 78 19 51 23 5b 7c 2c bc 52 69 8c ee e8 07 20 d8 f1 8a 59 22 66 2f 4b 04 6f 87 e0 3d fd 68 d7 b1 47 3f a4 9d df c4 61 be 87 1e d3 6e 11 aa 85 56 90 bc 10 d8 dc 33 70 0f 17 58 80 3c b2 4c f7 f5 c1 a7 e2 b6 37 0f 9c ab f4 34 76 ab 74 14 ca 7c 46 f8 78 10 82 74 bf 12 cf 59 1e b3 e9 d9 68 17 8d 60 08 06 21 ad e3 81 c3 e3 62 91 a8 69 f1 dc 26 a4 cb 6a ac 05 58 3e 0f 43 12 38 a0 9c a5 7b 17 cc 18 a2 af 94 9b c5 c9 e5 cd 2a cd e2 a4 c9 0a 09 e6 27 ff 79 Data Ascii: `Mc;Mn.5c.5Hxp?oM6kcMis]yIKuzuMb(a013BxQ#[\|,Ri Y"f/Ko=hG?anV3pX<L74vt\|FxtYh`!bi&jX>C8{*'y
2025-04-23 13:08:59 UTC	1369	IN	Data Raw: 66 25 d1 88 71 a5 ff 38 f9 e5 aa 95 5f be a4 75 d0 ca 50 f3 63 af 68 3f 37 9c db 7e fe be fb 3e d9 d1 f5 95 70 26 b4 fb 7e 85 e3 6f 23 c3 9f 8b e4 63 7d dd 81 f8 4b 0c e3 2f 07 f1 37 88 bb 04 80 3f f0 07 32 75 fc 15 60 6e 2c 1e 5d 60 ab 23 0e fd b7 18 59 b1 00 22 19 4e e3 6c 15 e8 ff f5 45 a8 c9 e5 cd 37 76 23 b5 5c 0c 78 d0 11 ee 85 d8 3d 9b cf be 77 ef b6 83 61 dc d6 4e fd e2 bd a7 e7 de de 1b bf e7 b4 33 b7 6a 5d 27 cb c3 38 4e a5 59 bf ae f9 db f1 08 9a 75 3c 7f c5 74 49 12 99 af 73 67 2c e7 4e 54 e7 21 bb cc 50 6d 47 54 27 73 2e 01 54 cb 7e 64 14 b7 8e ea 14 4c b2 30 46 41 36 35 ca 18 59 a9 32 c8 8f 62 ae 50 92 e4 1e 04 30 9a 40 6a 8c 7d 89 f0 c0 01 3a f3 9c f6 ae d3 85 a4 68 7f ec f1 53 48 8a cd 1f ee 3c fc 79 71 d7 e3 c2 24 da d5 21 74 1e d9 7d ff Data Ascii: f%q8_uPch?7~>p&~o#c}K/7?2u`n,]`#Y"NlE7v#\x=waN3j]'8NYu<tIsg,NT!PmGT's.T~dL0FA65Y2bP0@j}:hSH<yq$!t}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49699	199.191.50.132	443	1964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 13:08:59 UTC	613	OUT	GET /favicon.ico HTTP/1.1 Host: realtimesearchresults.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://realtimesearchresults.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 13:08:59 UTC	303	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 23 Apr 2025 13:08:53 GMT Content-Type: image/x-icon Content-Length: 198 last-modified: Thu, 20 Apr 2023 18:11:48 GMT accept-ranges: bytes cache-control: max-age=1209600 expires: Wed, 07 May 2025 13:08:59 GMT via: 1.1 google Connection: close
2025-04-23 13:08:59 UTC	198	IN	Data Raw: 00 00 01 00 01 00 10 10 02 00 00 00 00 00 b0 00 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 01 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 24 bf f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 Data Ascii: ( @$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49707	104.21.31.250	443	1964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 13:08:59 UTC	891	OUT	GET /log?logid=kfk&evtid=usr_bhv&cc=US&cid=8CUS70K5E&crid=171376611&iso=0&pid=8POQYHV9J&prid=8PR11258V&vi=2249295933715547343&evt_type=pageshow&pgtid=40&bck_btn=0&bfch=0&scr_h=1024&scr_w=1280&cl_h=897&cl_w=1280&evt_ts=1745413738234&evt_diff=367&evt_ctr=1&visit_ctr=0 HTTP/1.1 Host: l.cdn-fileserver.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://realtimesearchresults.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 13:09:00 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 23 Apr 2025 13:08:59 GMT Content-Type: image/gif Content-Length: 43 Connection: close Accept-Ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Full-Version, Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: * Cache-Control: max-age=0, no-cache, no-store Expires: Tue, 22 Apr 2025 13:08:59 GMT Pragma: no-cache Via: 1.1 google Strict-Transport-Security: max-age=63072000 Alt-Svc: h3=":443"; ma=86400 Cf-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 934d97c299d11a78-PHX
2025-04-23 13:09:00 UTC	43	IN	Data Raw: 47 49 46 38 37 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 04 0a 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF87a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49709	199.191.50.132	443	1964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 13:09:00 UTC	400	OUT	GET /favicon.ico HTTP/1.1 Host: realtimesearchresults.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 13:09:00 UTC	303	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 23 Apr 2025 13:08:54 GMT Content-Type: image/x-icon Content-Length: 198 last-modified: Thu, 20 Apr 2023 18:11:48 GMT accept-ranges: bytes cache-control: max-age=1209600 expires: Wed, 07 May 2025 13:09:00 GMT via: 1.1 google Connection: close
2025-04-23 13:09:00 UTC	198	IN	Data Raw: 00 00 01 00 01 00 10 10 02 00 00 00 00 00 b0 00 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 01 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 24 bf f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 Data Ascii: ( @$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49711	104.21.31.250	443	1964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 13:09:00 UTC	645	OUT	GET /log?logid=kfk&evtid=usr_bhv&cc=US&cid=8CUS70K5E&crid=171376611&iso=0&pid=8POQYHV9J&prid=8PR11258V&vi=2249295933715547343&evt_type=pageshow&pgtid=40&bck_btn=0&bfch=0&scr_h=1024&scr_w=1280&cl_h=897&cl_w=1280&evt_ts=1745413738234&evt_diff=367&evt_ctr=1&visit_ctr=0 HTTP/1.1 Host: l.cdn-fileserver.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 13:09:00 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 23 Apr 2025 13:09:00 GMT Content-Type: image/gif Content-Length: 43 Connection: close Accept-Ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Full-Version, Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: * Cache-Control: max-age=0, no-cache, no-store Expires: Tue, 22 Apr 2025 13:09:00 GMT Pragma: no-cache Via: 1.1 google Strict-Transport-Security: max-age=63072000 Alt-Svc: h3=":443"; ma=86400 Cf-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 934d97c7cb1e720e-PHX
2025-04-23 13:09:00 UTC	43	IN	Data Raw: 47 49 46 38 37 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 04 0a 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF87a!,L;

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5480, Parent PID: 5960

Function Logs

General

Target ID:	3
Start time:	09:08:43
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

COM Activities

WMI Operations

Show Windows behavior

Process Activities

Process Created

Process Terminated

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 1964, Parent PID: 5480

Function Logs

General

Target ID:	5
Start time:	09:08:49
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1912,i,15744807549929909011,9729045577241394979,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6308, Parent PID: 5960

Function Logs

General

Target ID:	9
Start time:	09:08:55
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://realtimesearchresults.com/"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://realtimesearchresults.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5480, Parent PID: 5960

General

File Activities

File Opened

File Created

File Deleted

Windows Analysis Report
https://realtimesearchresults.com/