Edit tour

Windows Analysis Report
https://d3k0gij77b1jti.cloudfront.net

Overview

General Information

Sample URL:	https://d3k0gij77b1jti.cloudfront.net
Analysis ID:	1499927
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://d3k0gij77b1jti.cloudfront.net/ MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1928,i,11253576738177546024,6209397194130133784,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 23.73.207.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.73.207.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.73.207.5
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 23.73.207.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.73.207.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.73.207.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.73.207.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.73.207.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.73.207.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.73.207.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.82.12.31
Source: unknown	TCP traffic detected without corresponding DNS query: 23.82.12.31
Source: unknown	TCP traffic detected without corresponding DNS query: 23.82.12.31

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: d3k0gij77b1jti.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: d3k0gij77b1jti.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://d3k0gij77b1jti.cloudfront.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd&oit=1&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd8&oit=1&cp=4&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80&oit=1&cp=5&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n&oit=1&cp=6&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7a&oit=1&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7ap&oit=1&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv&oit=1&cp=10&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.b&oit=1&cp=12&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.be&oit=3&cp=13&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.bea&oit=1&cp=14&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.beau&oit=1&cp=15&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.beauty&oit=3&cp=17&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: esd80n7apv.beautyConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23&oit=4&cp=2&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A&oit=4&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAXz4gFP3LXOIznPKU8iEhqKSNb0wVAnJXZ%2B5uInPTtYy4fQigZyvcEUqfsQJ3WUZPuI3hdUQTVhdT1z2bBNztpmsnynJTl7lfR1Ofob8k11hlFXRLehwFAFo9DSbIKq8OvOFeiEK%2BSqsrC0nTIUY7NGu4GWOmLiiDS7ytawm04XUTS6Xh3gkWZKviAcl7CGkIRzFVwdMIVLdmabRPzeb%2Bb4wRWlb4o/r%2BJu5GPJlA%2BZH7AONFS4vJei%2BczZQYMXlZKgLn2zHu5No86vJy%2B%2BDjzHYNwesDgobh6VDtAkJSnYvWMuVp%2BhhC4eDHxooDS69dtPtTKe60lC8%2BmWuo0c3vbgQZgAAECuBvfODLIrM3V1S8UqPQHawAcECzZYmLz9tbtPnQIw3EvyBIv2zQ9N1D54SFsCdAvGi5YwOtSVTt01BJClkjYwrL6lLtP/61Kba2aR7Af9bbHPzD%2BwEq%2BnxNp0sWBMBUr23RGK2y6%2BT7g/CFJ7NWSzON8kV%2BlA0zTIV4i1v9E0r5Xbi9NnEa4CY/mf9sFkzVuWhS8HwJIr2b3XKi69UoPZmMNdyW/xgVlEd%2BuOLhoYPtrgEUY4KjmJUliaqViAPLoRwHgKHqFKCuNfYkgTtuiXsICq2kiqxNVQxZoMi3IcsSWay5ZD4vCQWeKmR3/teVwrqDgtYOZZ0rhG6FfuyQnDrrgr8%2BEUz6ZsgkbH3Jc2e%2B5%2B74A1M6SQdYNVHBg407A%2BRXOEwVGwyWlFTepySFSqHgMMq4K1qE3pPfV8aaBqdiJj0kmHID6bazihmzyYs7pyLuTENyYM5ldg1jiDnzwOL0mHBZdQZuf17PlxoKV%2BKLsbechfZLxXVnaB2M0DJ82kueLxRTPmWh1dH3Q3%2BxFZtZ%2BIr7WhEHnSsCk0m072U7MozYcp1uKRZO6l48ExWQ0CwaUGglT/ltPzvmjh9XVQI%2B9cB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1724773714User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: C33ECB60C65C4AF6BB8A6E46CF4B40ADX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A82%3A&oit=4&cp=6&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A82%3A12%3A&oit=4&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.&oit=4&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.8&oit=4&cp=4&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82&oit=4&cp=5&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12&oit=4&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12.&oit=4&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12.31&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb&oit=1&cp=2&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-&oit=1&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/AF1QipM1AF06CxaMLr3ogY34t4eZnkQ0EgX3PGYL8Iua=w92-h92-n-k-no HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs&oit=1&cp=7&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.&oit=1&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.m&oit=1&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.me&oit=3&cp=10&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.med&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.med&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.medi&oit=1&cp=12&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media&oit=3&cp=13&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.&oit=3&cp=14&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.n&oit=1&cp=15&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.net&oit=3&cp=17&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 23.82.12.31:443Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 23.82.12.31:443Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 23.82.12.31:443Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 23.82.12.31:443Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 23.82.12.31:443Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 23.82.12.31:443Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 23.82.12.31:443Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 23.82.12.31:443Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: d3k0gij77b1jti.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: esd80n7apv.beauty
Source: global traffic	DNS traffic detected: DNS query: lh5.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: pb-logs.media.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4788Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closex-amz-bucket-region: us-east-1Server: AmazonS3Date: Tue, 27 Aug 2024 15:47:51 GMTX-Cache: Error from cloudfrontVia: 1.1 a300dbfb49a2eb50edb83038642c9f82.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA60-P1X-Amz-Cf-Id: 30lcifOdbnZsFPMvl6XqdQJ8zPrsASFgNCvT8i64ZQYffOw5CGjpHw==Vary: Origin
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closeServer: AmazonS3Date: Tue, 27 Aug 2024 15:47:53 GMTX-Cache: Error from cloudfrontVia: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA60-P1X-Amz-Cf-Id: 4g9FV9rhzhmsWUP3q9EYQ3w3rg7pB9cvhRdkCTEK6L3Eh1H4QNyFuA==Vary: Origin
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 15:48:23 GMTContent-Type: text/html; charset=utf-8Content-Length: 139Connection: closeAccess-Control-Allow-Origin: *Content-Security-Policy: default-src 'none'X-Content-Type-Options: nosniff

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.73.207.5:443 -> 192.168.2.17:49753 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@22/74@12/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://d3k0gij77b1jti.cloudfront.net/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1928,i,11253576738177546024,6209397194130133784,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1928,i,11253576738177546024,6209397194130133784,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://d3k0gij77b1jti.cloudfront.net	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82&oit=4&cp=5&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n&oit=1&cp=6&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12.&oit=4&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb&oit=1&cp=2&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A82%3A&oit=4&cp=6&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-&oit=1&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A82%3A12%3A&oit=4&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23&oit=4&cp=2&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://23.82.12.31:443/	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd8&oit=1&cp=4&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.med&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media&oit=3&cp=13&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.bea&oit=1&cp=14&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv&oit=1&cp=10&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs&oit=1&cp=7&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.&oit=4&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80&oit=1&cp=5&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.m&oit=1&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.medi&oit=1&cp=12&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.me&oit=3&cp=10&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.n&oit=1&cp=15&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.&oit=1&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://lh5.googleusercontent.com/p/AF1QipM1AF06CxaMLr3ogY34t4eZnkQ0EgX3PGYL8Iua=w92-h92-n-k-no	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.&oit=3&cp=14&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.be&oit=3&cp=13&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A&oit=4&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.net&oit=3&cp=17&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.b&oit=1&cp=12&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.beau&oit=1&cp=15&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7ap&oit=1&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd&oit=1&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://d3k0gij77b1jti.cloudfront.net/favicon.ico	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7a&oit=1&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12.31&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://d3k0gij77b1jti.cloudfront.net/	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12&oit=4&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.beauty&oit=3&cp=17&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.8&oit=4&cp=4&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d3k0gij77b1jti.cloudfront.net	13.32.118.214	true	false	unknown
www.google.com	172.217.23.100	true	false	unknown
esd80n7apv.beauty	34.197.100.133	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.23.97	true	false	unknown
lh5.googleusercontent.com	unknown	unknown	false	unknown
pb-logs.media.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pb-logs.media.net/	false		unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82&oit=4&cp=5&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12.&oit=4&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A82%3A&oit=4&cp=6&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23&oit=4&cp=2&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n&oit=1&cp=6&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd8&oit=1&cp=4&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-&oit=1&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://23.82.12.31:443/	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A82%3A12%3A&oit=4&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb&oit=1&cp=2&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.med&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.&oit=4&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media&oit=3&cp=13&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv&oit=1&cp=10&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.bea&oit=1&cp=14&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://esd80n7apv.beauty/	false		unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs&oit=1&cp=7&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.m&oit=1&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.medi&oit=1&cp=12&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80&oit=1&cp=5&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.me&oit=3&cp=10&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.be&oit=3&cp=13&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.&oit=3&cp=14&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://lh5.googleusercontent.com/p/AF1QipM1AF06CxaMLr3ogY34t4eZnkQ0EgX3PGYL8Iua=w92-h92-n-k-no	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.&oit=1&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.n&oit=1&cp=15&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.net&oit=3&cp=17&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.beau&oit=1&cp=15&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.b&oit=1&cp=12&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A&oit=4&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7ap&oit=1&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd&oit=1&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://d3k0gij77b1jti.cloudfront.net/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7a&oit=1&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.beauty&oit=3&cp=17&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.8&oit=4&cp=4&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12&oit=4&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12.31&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	Avira URL Cloud: safe	unknown
https://d3k0gij77b1jti.cloudfront.net/	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.32.118.214	d3k0gij77b1jti.cloudfront.net	United States	16509	AMAZON-02US	false
172.217.23.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.23.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.100	unknown	United States	15169	GOOGLEUS	false
34.197.100.133	esd80n7apv.beauty	United States	14618	AMAZON-AESUS	false
23.82.12.31	unknown	United States	30633	LEASEWEB-USA-WDCUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1499927
Start date and time:	2024-08-27 17:46:52 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://d3k0gij77b1jti.cloudfront.net
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@22/74@12/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 142.250.185.174, 74.125.133.84, 34.104.35.123, 192.229.221.95, 142.250.186.110, 172.217.16.131, 216.58.206.46, 142.250.185.110, 173.222.52.23
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, star.media.net.edgekey.net, accounts.google.com, encrypted-tbn0.gstatic.com, clientservices.googleapis.com, e607.d.akamaiedge.net, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, evoke-windowsservices-tas.msedge.net, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://d3k0gij77b1jti.cloudfront.net

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 14:47:51 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9981890428775695
Encrypted:	false
SSDEEP:	48:8wid9T6731+HtidAKZdA1JehwiZUklqehDy+3:8wYseIy
MD5:	4809974C95177D64923D7A3ECDAD0425
SHA1:	7104CADE85090801F34FD6A3D4BFCA64AD906FB4
SHA-256:	2DC93FFC4282453E805C3D494AABFD2E959A05226ED831DEAA1B286315BF7DD5
SHA-512:	697946DEEFD233411BEC800BB4FD01EB79BBA5AC3A26868FD0AA4E03A9649A362881D3F546F7E6F3295B29D55F5490057A39B8D0889684C6C6C299D0473E7E56
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......ky........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.}....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.}....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.}...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.}...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 14:47:51 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.01490758931001
Encrypted:	false
SSDEEP:	48:8evid9T6731+HtidAKZdA10eh/iZUkAQkqeh4y+2:8+Yss9Qhy
MD5:	592786D914D00A7065848A214074C1FC
SHA1:	4548F577D87BF0A949A01EC183B944BE43F76B57
SHA-256:	C77C31272E5B29B592C93DB8A712C3F54B263CF2A4E840C54A3E163F87B29EF8
SHA-512:	FCA3AEBD3B374DA3219AA431809C40153213ABC80FCF01547E80CC60E5EEA485353293932201C62538474A79201BBA45519EF6A430BAADF31D0802632FA91F9E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....."ay........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.}....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.}....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.}...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.}...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.023644436664691
Encrypted:	false
SSDEEP:	48:8eid9T673jHtidAKZdA14tIeh7sFiZUkmgqeh7sey+BX:8eYsFnMy
MD5:	1683509F47649FA7A808BB44F554B9FC
SHA1:	F07AF5D4876D49169AB9A1DFD83685CB4353FF42
SHA-256:	086B4479A88DD03EE001FEBC2FAFB313FD278982F36E5761685DAF2486C995FE
SHA-512:	64BF18C48CCA720354052B4264A5BCB6C69657866037E3283351991D833FB5B627BAB5E8B7C7320C428C168FBC7C29C8F2946FB60642D1BF63034F0DA7AE2BF7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.}....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.}....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.}...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 14:47:51 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.014294204771525
Encrypted:	false
SSDEEP:	48:8Lid9T6731+HtidAKZdA1behDiZUkwqehEy+R:8LYsHWy
MD5:	03740CC073ABDA4108D0F1DF1D7307E9
SHA1:	3EA3375B1BBE9EB48163F81F6AC381E02BE6D639
SHA-256:	220E73A93C2BFA0C1A4BF7CB4AC98839A7CAC47A262BAF979F7B58857DDCAD8C
SHA-512:	68D8708C16B0FE6B137D28D59F540A08FA7E37CD408A203F5C4CA94872CFDE08D9404CA924436299B697921B388068ED561578882062EA8112023F67679827EA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....V[y........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.}....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.}....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.}...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.}...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 14:47:51 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.003728563697746
Encrypted:	false
SSDEEP:	48:8Zid9T6731+HtidAKZdA1VehBiZUk1W1qehSy+C:8ZYs39yy
MD5:	FD23D9E301506C903A027E9723C4A54C
SHA1:	465F77D9EE3CD9D7258856A2578D80FFF5B708B2
SHA-256:	9EF127C38644A26FCAD0106709D9A4D2B21DDD39996FDF8A509F9524C9B10931
SHA-512:	744818E497DBC44C248CDD78EE2DC2628E3158617624E6E5F2AD056B81B6723973C843A841A302D8746E646BDAB340893613A00277FF38EDDFF0694510F7ED3C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......fy........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.}....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.}....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.}...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.}...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 14:47:51 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.013286389200274
Encrypted:	false
SSDEEP:	48:8qid9T6731+HtidAKZdA1duT6ehOuTbbiZUk5OjqehOuTbMy+yT+:8qYsTTTTbxWOvTbMy7T
MD5:	7C139AFE649A60ECC5D072B40F9D35EE
SHA1:	25E64C1CF568B2243641AC0EFD7ACE9FE85FFAD7
SHA-256:	254A55E43030D52C6F067FEC1A419CB24A72C3DC6C23DFC6610201BF143599EB
SHA-512:	B785A55BB5B56564FF58E3A9AFAD7BC30C7CFDEB86E16B58798A3F31BF9826E5DFF18352D02A1EE6C331010F81C6EAFFCEF04FC589D322F5292FD8154C40D2AC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....J.Ry........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.}....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.}....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.}....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.}...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.}...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3114)
Category:	downloaded
Size (bytes):	3119
Entropy (8bit):	5.929747709606129
Encrypted:	false
SSDEEP:	48:BGKlgTx9JQhKvZ8OE13LUWZF1msLfaUF9kmERu9SXtHOWnGpJlbEFU7uZsEFBqm4:vlCWYZQRFaUF9zERusXVWlQFUssK4
MD5:	C17DD4DBE3150C3E45E2286284CD6D96
SHA1:	2B0980ABDCD11B0664D74A781D3A55C9F26B27A9
SHA-256:	507BD4FC511BA2F6C372F99C7ABC0CE3FF70DC675201B2BC48DA090A0DB506D5
SHA-512:	2715A70D2AEDF9D0510932D73EA89FB8A7702DF9D5176E09D5525BA17AAE02A7BA2120489152D792311468CAF66B582D626B061C9A149E5C3B64744F1762B2FB
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-&oit=1&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["pb-",["pb-580t","pb-580t","pb-2520","pb-1000","pb-9010t","pb-2000","pb-250ln","pb-755st","pb-770t","pb-2620"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"Cg0vZy8xMWMxcnQ1XzVoEh5FQ0hPIFBCLTU4MFRBQSDigJQgTGVhZiBibG93ZXIyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1RoUk1KQ0gtLVdfYjl4WnVtU3ktczVYMzMwdmtDRHFjN3otNWhtcTdjJnM9MTA6B3BiLTU4MHRKByNhMzQ5MmRSNWdzX3NzcD1lSnpqNHRWUDF6YzBURFlzS2pHTk44MHdZUFJpTDBqU05iVXdLQUVBVXVNR2ZBcBA\u003d"},{"google:entityinfo":"Cg0vZy8xMWZ2dzFneTFzEgtMZWFmIGJsb3dlcjJkaHR0cHM6Ly9lbmNyeXB0ZWQtdGJuMC5nc3RhdGljLmNvbS9pbWFnZXM/cT10Ym46QU5kOUdjUlpDSjNrQ3ItWnBpTE8yQTZQMHdTVUYtZUtxc3Z1YXVWMkREbzl4amMmcz0xMDoHcGItMjUyMEoHI2EzMzgyMVI1Z3Nfc3NwPWVKemo0dFZQMXpjMFRDc3JOMHl2TkN3MllQUmlMMGpTTlRJMU1nQUFXSEFHa1FwEA\u003d\u003d"},{"google:entityinfo":"Cg0vZy8xMWI3Xzhfc24yEglTdWJ3b29mZXIydGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1R

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 32x64, components 3
Category:	downloaded
Size (bytes):	961
Entropy (8bit):	7.259290321738146
Encrypted:	false
SSDEEP:	24:rQMro9X3C5xXxUksmiqjwwyGLHxZVRelisRxhCmTUd:rnrIo9zsm/cwzLRZUbRtTUd
MD5:	CF6F9C6B09337D40E010059A5F86AD84
SHA1:	87683C14AA6E001EB0C72B53C42787C0A62AA752
SHA-256:	5F0E91DDCDBB400357B467953FE6BF1A6A7C7E623381312BCE001A327AF174F5
SHA-512:	97514091A962D7EAAB0A8FB011D48567D690AAA6DB89823C24EF99EE5363AFE10A7F5DA9C40124ED194E42FF34FDA743B806960277CD6EDAA5B338D672A53AEC
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRf6ljiWzjK2CoNbdV3WAzu9OHFeq-ETnZk4otQ0m0&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@. .."....................................6..........................!1...AQ"aq..2....#$BCRb.....................................................1AQ!............?............x.\..........ym.xo0[.......' 9......;\|]x........H.Y.I.e....H....5(.......R........Y.c.......#....._k..eU5.$.U..X..G]F..d.....d...WY.w....l.#sB.....z.s......]<M.......}[0.\c.....q..\|......)#>Q.......k....J..5..I7.\..1[T.)..a_._,........GO..Z ..p.w]..g.).+....UBG.A#K..q.Rw..zm..g...oo].u...!n........_....=.^...o.....p....o.>...v.....A,....J>.;0.w...N.].m..{.......^....&F.<..d...j..469..hhP...Yd\..i.7.1..?.............Xn.....d.jK..(=#^..5..:...bf?.....G.F.<1mw.TEuA)..F.7.....=~zI.n.+..R......]..$....0......!.h^U.,..Kw..~.E>.Q.=3h]4......j.!..#..>.1...8x.c..n...}y....%.U..)'.'.<...m....%.]..

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x44, components 3
Category:	downloaded
Size (bytes):	1129
Entropy (8bit):	7.439595621544081
Encrypted:	false
SSDEEP:	24:rQQJ2vUjNEvPXUezSJmn5O/UyequBfw9kFXOiSYxSA1lJ:rBJLEv/pV5OKBKk1OiSm71lJ
MD5:	DBFAD55781ACE2D86CBDBF97A83818AB
SHA1:	7A28592328A5611404E54ADA654B3D041F88669A
SHA-256:	E27CA74A5F0C244DBFEE25D9D86BD9BA7E60429B11C9F43454ED5382415C29B4
SHA-512:	0875689BEF217DFA9AD2D982110674F825D83DEE0E4A80844CE0D1F6A6946E80A00D23F19B99A63719888605DF48D0CD80222CC3CB6E5B1721224D3C9B9D362B
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcThyNtNcWWVFQNwny3GMGUb5g_xwqmuph8ltqb4dW4&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......,.@..".......................................0.........................!1A.."Q.aq...Rr2C.................................%.......................!..1A."QRq..............?..h.....^5..N?.4y..Rq..._..i. .`c.. v.....5{....t..x.ZX%.}Y.....yX...U.....u......8.'.dq..eZ..A..>.....{5....I.......S.M..t.&...9.......9....}*.VI......aE.V..)%..pN.A,^#F..2...H.......K:..b..\J.)+.$...#....@.qd........>..,,"...,[$...:..E....e.....N...+...F..A...H}b..$.6.r..{K1=..s.G\u.Z;..FJ..h........g..lp.....q.{.;...V..)<..6.m.2.....$.......u...g%.C.&.ZM.F.gqnp...Y=e..}!..VCj)K....M.DT3.Yy...........\.]yg.._..\|.@.....i....hg..M..H#.Xw.Q..,rPd.........K..R$...e............S.nt....D.H.2>t=A.....%.......$.:.2e.v.0.M.o.z.}.(..q4.8v.....2...`..4......N.HD.O-........'.@.u._.I..`..$.3..-../\..#...{p".._..&.cg...iq....[..m..n..@...e..)...+.

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (609)
Category:	downloaded
Size (bytes):	614
Entropy (8bit):	4.990047724005266
Encrypted:	false
SSDEEP:	12:uGH+uWYkOk2WhD+uz+uBmBHslriFuOllnF7kwuSNZw4/ffffffff0wzyV:jRXkOfWhRzRBmBHslgu0lnF7F5Nqmffa
MD5:	557FDE1CF0D19EE4F87EA8A17311999C
SHA1:	01C6602EAAA70826F141A9FD4202982F567F5463
SHA-256:	1FAC31BF9B2EEA44FB74EE62C96717E5D635EC83950FC797A3FB40614B2EA25F
SHA-512:	1D11F1EC1FA32D31AF18FED0D9135EE03D7314D80A73326F4AF8CEED8B79B136776F39C72104F5280C222FCB590D98F0E5FD04D11A376C2769F227377CBD56CD
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.8&oit=4&cp=4&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["23.8",["23.8","23.8 kg to lbs","23.80 an hour is how much a year","23.8 inch monitor","23.8 celsius to fahrenheit","23.8mm to inches","23.85 an hour is how much a year","23.8 bmi","23.84 an hour is how much a year","23.8/2"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[1300,601,600,556,555,554,553,552,551,550],"google:suggestsubtypes":[[512,433,131],[512],[512],[512],[512],[512],[512],[512],[512],[512]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":1300}]

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	1267
Entropy (8bit):	7.485607521441941
Encrypted:	false
SSDEEP:	24:rQJLlaDYQM86MosRit0o1kwjLzmiLa+4S0rTDvfcFqZoaoMJMpI9o:rcLsk86MXiGhwjvmiLa+4Prv0aoMKC9o
MD5:	4294B37F9A508AB70790C9A223190C5E
SHA1:	48C489EFACF7384063FB355612C4E2AFCEB9A3F6
SHA-256:	D620C829C6844CEC08F81EEB1A1A0BCA575AEE429A9E2A36E56B5BF0BE7A78B9
SHA-512:	A8EAD0CDCFD7B522C7D081D585597217D94E3ABEEEEE3D293546BB910AAA3FF9A684F896DD8738F04200390482083FAF6E1C39A2DDF8643F09FCC2D8F0D37B5C
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQo0JrBNWOiXoGKPLikPreSb9LePk7pJ-c1NpVV9fg&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@.."......................................1..........................!1A."Qq..2a.3b.#B.................................. .....................!..1AQ...............?.....)J.R...)J........O.]$.....1$.wd...'..\|q.S.^-j.3=0......$..]8....1...c....Q.FfC...u.I?.@.m...:)yw3.iIR......2.~.......Z.o]&.../.2.....6.(.........'..f.dC...0..+PY!...#....1.p:..s.?.=..........]mc.TG^..>.T'..Izu..{.....2.f ...R.Z...d..ppx.5..:..l.wK..l........P'`...1....+...:!.)..m.....O`...q.Yr.w.=k.oK....W........]v.&#..._\........D..=p...D....D.>..S..zU.....1.m...!...$..Y.23.g..zz.q.u...%HZA ..=.~.r.S....$B.Zfe)J.....x?1.Y...$.(..R..U.[...=.)f..(.!Yo<..W..,..iW.:.6..q.'....... z..^u.JK..B.r...E..r....nHR.{.N8...A-......Z9J3.'NG.....J..kl...-)+.'.......b..O6.kiyX+R.......qY...3/..S.m..P...h.H....2?...OV[.=`..u.......

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	1395
Entropy (8bit):	7.578656151530258
Encrypted:	false
SSDEEP:	24:rQlELlqSM+49HHelI3Ad5cvViyZJQULBFsfbXS5+l+baU3rgsR2wn:raELMBgloAsvUyzYDU+l+bB3jR2w
MD5:	FA8B1160C80B66752BE5EFE80A26B403
SHA1:	A32CF5B20433D4B861B86062DBF4D58191966E36
SHA-256:	1AE5F764755D19BF23CD74E02099F56C53B6E0BD9F12EA93F487DA97D480C415
SHA-512:	3DC3CECDE082552244D3A6D894D924CF7792177758FF12CA808E90CD5A5CBBBC5095B0E1A2E4D432D5867D14A3C2C4DC1AB864B63998436A734CCCE38B510A74
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSYczYUTS212SW7SaDW8rsK2U_YDnQYzMbjdOlK49BmWcQWdIECC6CzEhc&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@.."......................................0.........................!.1A.."Qa...q..b...B...............................!........................!1.Q#A.............?.x.EA:Kp.H...l6..I..2~I...!.]8......5h..........v.Yo......\...hq..{..P.....+.;...1J........j.....'$..y..=....VT......$UI4.....,.....V.nET.c. ....O....@...[...lMc~jm[...).W$(...Hf%..}.V...PmG.V6?.L.t.0..8~....%aZ....Zt........_..zg^f;.+Z.=.3..BFJ...W>..Z.1.:t.S........5.......5/......a....e...kY'..>Aqar...5.+. .....=.d.M.#+J..J.....$.w..........N..Fr[r.:.M...8..........g..3{Ws...%9....9....V\|lvngZ<';/8>..Ol.).....:.3..,u..f..),.,5Z.b.+...(....[b.@..%..L..V.9.b.A../.."?....%..)<.B.....8..._X.a(t..6......Ayw.......v.:.8.-x..e.c.p.X.L..*Wd.Sm.F.R2.....)ob/f...w...qmF......B.54<i.....M......e)Gt..N.Kn4.=..$..W.#..py..{-....#

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	1405
Entropy (8bit):	7.5665032826830245
Encrypted:	false
SSDEEP:	24:rQ31kWd7tkdLX0TTl5thQRnGVd414E6fMoNAkQ8kE2G5cK:rk1kWhWqR5HEDoUoLNH2G5B
MD5:	32CDC9D92AFB2EA86ABD13A00C1BF9D1
SHA1:	BAE5648C80FCF42D608D33888F11CA4CFB4E3B88
SHA-256:	7B5C60B2A722B39184EA65F09739ABFC08A84D52969C911CE74DB716EC993D57
SHA-512:	39DFFC62D280F477A1A56D74491BAE924D00C16C6D3E77211A6DC16BF2931A99067609006C62FB165905BAD2C353CA38259B283E9F50FF410D2E02D745825FEB
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRl0wGBVDsfYgX0LlJSqA_WNfiadk5R_YD-IgvEZpKMaW_BjXpgFYXubEw&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@..".......................................3.........................!.1AQ."a.#q...2B......$...................................................A1!.............?...y......j#..jj....(..2TN.#A.v.BP.TW.!.MMk.v.;..`.......;5..q\.u...s....u...g{x..2<V.N..>....x..?fJ.(....j.....p...X&...~.,......sX.9..).C.M..._.!U.W...>m'..-#...}.....dR....cieS,..d.N.P.T\8.........O=6;m..p...e.....m"B.n..V[......Q.....K...U........p{q..../......*.....Km......Vq.a.d.ILv..S}..".. ..!.].Xj...^.\.k..Z...+..........G?fs...1.=NF.ltTE3)....-..d..?....f....'..s,.(.5,..}...s{\|....-....(&..:i.}q;..SDe.....G'@C_..\K..Q./C.^_&i".Q..;....7.U.P-.T....nx.q..i.J...e.a.t..e..TD...k.b...+G.KX./v......o....2:..I...J....Q. .M..cG..Y..[.T.K.....@7.....,.s..t.4.F..4#crI;..1d..9r.UZDf*...+.E.<...p.2.<.5..,..m.....W..`.u...N6.V..R.@.j%J

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (935)
Category:	downloaded
Size (bytes):	940
Entropy (8bit):	5.51956442806229
Encrypted:	false
SSDEEP:	24:Z34pzyP215msBHslgT6H/RWD9Nr3WvPu0PF7F5qmmm3mmNmQffffffVuV:GcsKlgT6fRKHou0pFrmQffffffVuV
MD5:	3252A7766EFC34D3527BF064F130CDD8
SHA1:	D15D8CD7E68D5A9AE410F26F7560681C175DC8DB
SHA-256:	1137008C10EC2951EB5A18E612E9326E5402AF3AD705E4CD314C3CC5B87F5C7B
SHA-512:	1E7D1C4AC8EA6585F50EA219A8DCEA76BB79C07000E0CB4B90A1A81CC85D979369EBF9D6B50CCFEBD317CE3F0EB8194D7CEC5167A6C994C9663C1D91F6A658E7
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd&oit=1&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["esd",["esd","esdeath","esd meaning","esd wa","esd login","esd pediatrics","esd wrist strap","esd mat","esd strap","esd student portal"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"Cg0vZy8xMWYwX2Njanc5EgAyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1JmNmxqaVd6aksyQ29OYmRWM1dBenU5T0hGZXEtRVRuWms0b3RRMG0wJnM9MTA6B0VzZGVhdGhKByMyZjRkNzVSNWdzX3NzcD1lSnpqNHRWUDF6YzBURE9JVDA3T0tyYzBZUFJpVHkxT1NVMHN5UUFBV0F3SGRBcBs\u003d"},{},{},{},{},{},{},{},{}],"google:suggestrelevance":[1300,950,601,600,555,554,553,552,551,550],"google:suggestsubtypes":[[512,433,131],[512,433],[512,433,131],[512,433,131],[512,433,131],[512,433,131],[512,650,433,131],[512,433,131],[512,433,131],[512,433,131]],"google:suggesttype":["QUERY","ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":1300}]

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	131
Entropy (8bit):	4.754670353803183
Encrypted:	false
SSDEEP:	3:VwGLCJpHwwBHsLpHbGWjLwWkzXFETH1u4:VwGLUt5BHsLRGAwWeXFEL13
MD5:	187E5226A8A1CA2ABFA45B9159AA9345
SHA1:	A173731B478EF4AC95A20C12FF441C4C95D2249C
SHA-256:	0A60B1A538053B94125F1E7010B04375247084B0C26AD8B6580B59CC8A71E247
SHA-512:	9C27CE6D093BEAA7DE76518A8728A9E352F5912BC55BA905FB06CBF107883C9B4021B53C8F383D1F2B36D45A71B42CBBAF022F2D2D66ED7923CB4E79E52D09BE
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12.31&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["23.82.12.31",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2045)
Category:	downloaded
Size (bytes):	2050
Entropy (8bit):	5.866981277335456
Encrypted:	false
SSDEEP:	48:tN1KlgRGMM9kcybA0bU89kmGq+5vLJcmNUQ99kmruFpFuHff5f0M:Aldl9srbU89zS1NcM99944ff5fF
MD5:	4DC9566649B0E82DD03E73DE55509FEB
SHA1:	7EA9242AB03F20948126B2AF6E3F2CC106E55134
SHA-256:	22390FB65CC941DBE0F04ECAE3C7E53E203C54917C1B18F8CA00759D096B92A9
SHA-512:	32569DDE511F6D3D222BE3D83D5A883A385DCA14ECC8E493C493CB16BE43ACF6A223FA134E19C858F13D7686E05431B701CD9B04D50EF832F405CF81B83DC5BD
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb&oit=1&cp=2&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["pb",["pbs","pbs kids","pbis","pbs kids games","pbis rewards","pbs newshour","pbs kids videos","pbs games","pbsc","pbis login"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{"google:entityinfo":"CggvbS8wNXhieBIfQnJvYWRjYXN0aW5nIHRlbGV2aXNpb24gbmV0d29yazJkaHR0cHM6Ly9lbmNyeXB0ZWQtdGJuMC5nc3RhdGljLmNvbS9pbWFnZXM/cT10Ym46QU5kOUdjU083UFVFWHNyTG52aGdUSjZZQWVEc3F0Vmd0UVRfY0F0WHcwOHVTSGcmcz0xMDoDUEJTSgcjMWYyZWEzUi5nc19zc3A9ZUp6ajR0RFAxVGN3clVpcVVHQTBZSFJnOEdJdVNDb0dBQ181QkxrcBc\u003d"},{},{},{},{"google:entityinfo":"Cg0vZy8xMWZ4ODFzZ2I3EiJTb2Z0d2FyZSBjb21wYW55IMK3IEV2YW5zdmlsbGUsIElOMl9odHRwczovL2xoNS5nb29nbGV1c2VyY29udGVudC5jb20vcC9BRjFRaXBNMUFGMDZDeGFNTHIzb2dZMzR0NGVabmtRMEVnWDNQR1lMOEl1YT13OTItaDkyLW4tay1ubzoMUEJJUyBSZXdhcmRzUmtnc19zc3A9ZUp6ajR0VlAxemMwVEt1d01DeE9UekkzWUxSU05haXdzREEzVERFMU1yUTBOREFGQVN1RGloUkxTM01UUzRNVUkzTURFOHNrRTBzdm5vS2t6R0tGb3RUeXhLS1VZZ0JjY2hLSnAZ"},{"google:entityinfo":"CgkvbS8wMnpoNDESG0FtZXJpY2FuIH

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=4, description=OLYMPUS DIGITAL CAMERA, software=Google], baseline, precision 8, 92x92, components 3
Category:	downloaded
Size (bytes):	7677
Entropy (8bit):	7.885636209455824
Encrypted:	false
SSDEEP:	192:YknsZ4gDOsu+fV+vh8nSiw59NZfz5fRdG57s48OHj:jnsZtP+VimrZfzU57s482
MD5:	64FFDCB68E2663CBEBCF41D667496FD9
SHA1:	AFE7CD4E1F8FCC836952D9E35A96AAC4802289EE
SHA-256:	D399066F117D8B06052F956538E06F409702780484A3EBD7CF3F368B4C3E63B8
SHA-512:	23B24838CE1F0C3A5093C1A599ED9F8D66AA5FA681F34C4BA0CFDD5F1D01DA681955933214267DE444BE3220B87BE5BDE5A995A4A16C424EB487DB8E2DAD98C0
Malicious:	false
Reputation:	low
URL:	https://lh5.googleusercontent.com/p/AF1QipM1AF06CxaMLr3ogY34t4eZnkQ0EgX3PGYL8Iua=w92-h92-n-k-no
Preview:	......JFIF..............Exif..II*...............>...1.......U...;.......\...........g.......OLYMPUS DIGITAL CAMERA.Google.Zach Straw.Zachary Straw Photography......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.5.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmp:CreatorTool="Google"> <dc:description> <rdf:Alt> <rdf:li xml:lang="x-default">OLYMPUS DIGITAL CAMERA</rdf:li> </rdf:Alt> </dc:description> <dc:rights> <rdf:Alt> <rdf:li xml:lang="x-default">Zachary Straw Photography</rdf:li> </rdf:Alt> </dc:rights> <dc:creator> <rdf:Seq> <rdf:li>Zach Straw</rdf:li> </rdf:Seq> </dc:creator> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>.....................................................................................................................

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (799)
Category:	downloaded
Size (bytes):	804
Entropy (8bit):	5.124281756413895
Encrypted:	false
SSDEEP:	24:8yvJbARHX9PaCrjznBHslgT9lCuABuoB7HHHHHHHYqmffffffo:3vJkNVaCrHKlgZ01BuSEqmffffffo
MD5:	1FE345A97E03557247A20F3B07E188A2
SHA1:	AD59C60B76B634C3BDFCC57D19C1E41B7882EF6C
SHA-256:	E69A02ADB9D390D8BB537008EA24B3AAE9EBEC5AEB8D8B9EA365D904E63338A6
SHA-512:	C5B921D8D9EFC69168096A8AF96EEF351522FD378A6414EA52574052137A6290D2411708782789CABDEB934BB2AFD3E81AEEEE3A84A5FDFBDBD7A7C88FB276A8
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["seattle seahawks roster","2025 social security cola increase","2025 zforce z10","petco national dog day","garmin fenix 8 review","lake mary little league world series","surprise arizona city council meeting","minnesota state fair storm damage"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (630)
Category:	downloaded
Size (bytes):	635
Entropy (8bit):	4.976501961031685
Encrypted:	false
SSDEEP:	12:uG318Cm+uehHpXkr3FBkrMIkpkr+o2BHslriFuOpQUd7kwu3Zw4/ffffffff0wzM:pmR0JU7kr4GSJBHslguQd7Foqmfffffy
MD5:	989C08E03D27F52580D77B084C4D04BD
SHA1:	42FD4217CB7D8ECF98AE550E1786EF6803239F66
SHA-256:	7E4EC96E183A320209BB93126934ABD2FF73D141E1437C76190EADD458559E88
SHA-512:	943C6A9E6715D454096F8EF26C0F7A706B7B13DC4EA3EB1D935FF2490432E570A6E7CAB118C0FC3778994F2E32243B0F482C5DF9DB9B53DC8CD1B8FAB9F90409
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82&oit=4&cp=5&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["23.82",["23.82","23.82 an hour is how much a year","23.82 bmi","23.82 hours","23.82 inches","23.82 usd to cad","23.826 to the nearest whole number","23.826 to two decimal places","23.826 to 3 significant figures","23.826 to three significant figures"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[1300,1251,1250,651,650,601,600,552,551,550],"google:suggestsubtypes":[[512],[512],[512],[512],[512],[512],[512],[512],[512],[512]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":1300}]

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (547)
Category:	downloaded
Size (bytes):	552
Entropy (8bit):	4.736091342177113
Encrypted:	false
SSDEEP:	12:u4juwVrsOXRl/CI3XVyWBHslriFuO2wld7kwu+w4/ffffffff0wzyV:rNVwOBl7cWBHslguald7Fomffffffffq
MD5:	14062C99D24E0574B3BF10C89548ADD4
SHA1:	6F84F3C7930D7EB7CF6E64BED47B5AC101578507
SHA-256:	F2D661E7D2174FC4E0898D697AED938C27382C56C577C4C10072B983D70B9148
SHA-512:	CB36AD563F578D7B737817D6F8B46F35C29B00ED6ADE93CF211CE474D9C48AD7935C7E05A955336BE1C8F607C741755181A080955C7B2C91F5EB1295E36391E7
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80&oit=1&cp=5&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["esd80",["esd8004mutag","esd8011mut5g","esd 8040 mutag","esd8004","es 8000 storefront","es 8000t","esd 800 key","es 8000t noa","es 8000 noa","es 80"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[1301,1000,750,700,650,601,600,552,551,550],"google:suggestsubtypes":[[512],[512],[512,10],[512],[512,10],[512,10],[512,10],[512,10],[512,10],[512,10]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":1300}]

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	1115
Entropy (8bit):	7.420213519527625
Encrypted:	false
SSDEEP:	24:rQNCCNEJBDOPASCb3oyRqpOBpSlnXPpG4BWAC:rUCCNEiPAxoyRqpOBclk4BWh
MD5:	A836A73C54A9389DFB3FDAE21B6C26B5
SHA1:	4E9776ED7F4C49FD4C100C20234B16627A592773
SHA-256:	A39A9C2D703A00DB27EEE0E48297BA11F9186B872B78737268DF0F5AFF423380
SHA-512:	6151EF64AF9894B63827CC6E701F47497386C3FC41C746C5C78374B847D9A09DCD45AD38F968B607DD591CAE1F452F84765BF6174307C3B0C6784D0F56C90CF3
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTzJ4hPEpyNxpIOtQ8OvAbnyy-m483pDDeUbrMpNZwjuyFV0Jr2xQjQrpM&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@.."........................................B..........................!1Qa..Aq.....".26Bt.......#%4DRTVbds..................................................A............?.8.....3J..S....7.F..R.....`.H(.....u...1....J...H..\|8.i....H.......$......Sul..[.H.sf\.0......H#....t.V@.T.;_...{.U5..'...P2MI....B/..R.R.A...T..%H....]..,.p.J.O..d.4.[ja..q...Q6..h..o..+.r...~\.0.@r.\o...<..B......s.....nne^.b.........e....pM....J..8.....Z.T.d..U...Z.A..!.bNy.1'..-. Xr.f.P....(....{.F..:c%..K`...\./L...+[.[.A.............}ba....$..R..0..g.H.,....V.....0...ZS....g.Q;.3(.I..H^`.d..X..d\...B.t...........S..Ch...<..7O.9@)QB.PP.....&..N.9U?.......+3\..mk........P....o.p..U..I8.....9zA..,.e.GG....?.g.....%.5..9.g.J.'2H.L2.;.].KV....:....9.....jF....0...bgW%&%]b...R...X0.IS..l..H\qcaQ.t....Y...-.._B.oi).*...

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x58, components 3
Category:	downloaded
Size (bytes):	1656
Entropy (8bit):	7.669380540515664
Encrypted:	false
SSDEEP:	48:r6LARmIYRM5f0wFHHWftmLAML91WCfiPAv:eLARmIY255Wf4NrWCfiYv
MD5:	3099FF998C422547378418F29C58533C
SHA1:	C39AB35E403EAAA0898AFAA7615FBCB3715CE395
SHA-256:	5C93AC6DFE575A413CC2AF9F56C6E98EFB26755CDA294DA8DD3A9B8E712D9659
SHA-512:	0A7711E2E5D8C9E28381FDB648D15C881C270A061CA7EBF318C245929FA9754A2160BBA1E1CD8CECE73DE7498D9E054E45784CDAA0042B62836CE93C1F60B02C
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQHjCnerev7ZIrmQVvxS_J0mmyMxfBlIGJpOHDrRE8&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......:.@.."........................................6..........................!.1A.."Qaq...2BR.#s..................................... .......................!A1a.."............?.8._.;L.P.s)4.{..[H.8.&.......%L..H.?!.m..q...>....X.)...&\y.].R....{...$>..\.-QWR..Z.;..qkp\.!#..9yb..._.._MVi.......>....$;JC.u.6...W>.0.*l...V].R\|i....0=...\|..rglR&;.%z.c[.aSZwO.j.G.OM.!\|...g...".9..h.....".w [.c6v{L3s.".....yHY.r.V..v..E[..Re.' .<..k.r."=A......Z......S.T.x:M../.k`).=W3.i.[..}..KJ.....d~"...../..5\.._g.....4.).........z.r..D.......h.......1.....N`rJ.{.x\|..%!(V..}.`zb...Fd....N...un\._..b..y..Z..FL.nq....6...]..{X....yBs..b.%.R.(4.H..8..5[q,cF2.)x8..r..u..P.....y.\|xs.:P..Xs<.......P.C.7..'...9...a....B....@.~X..6.......vP.K...Y.....(V..tR..c..........Z....F..B.j.x...o..a....-.-....#......Q..Oj.Sy.N....H,.....

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XML 1.0 document, ASCII text
Category:	downloaded
Size (bytes):	243
Entropy (8bit):	5.549637453564604
Encrypted:	false
SSDEEP:	6:TMVBd/ZbZjZvKtWRVzjemkwUjMfjSHUYMFlcg80hOtMan:TMHd9BZKtWREm7wMlcg80hOWa
MD5:	5760D8EA2B7F71EBF9C12D6B68C8E55E
SHA1:	74DC99DF2B7836464D87BEB402A4A1A57854B15E
SHA-256:	897397DAEE892C9AD75A52BEE915AE9C2D39AD7CAC8601142E432C78C4C29DAC
SHA-512:	77E563FEB4640EDCD089F4278A5C08092CF3A9DADB54A5AB4F538F0336D9384D450115D6489D85E3CC28F9317EAF400B2684C4DF030666EA0CE397FC6E75767E
Malicious:	false
Reputation:	low
URL:	https://d3k0gij77b1jti.cloudfront.net/favicon.ico
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>VXYETQTK0WZ84GJJ</RequestId><HostId>NWSN4zaAXx4mCQrc8jkl8bqqOQohZJYAnTmpkiaMhSRU4PhaEyiEDpE/nNnDwXpS4qVrRRJe80k=</HostId></Error>

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	964
Entropy (8bit):	7.282748699045802
Encrypted:	false
SSDEEP:	24:rQ6SgS9GLlh9d53b67N9BPBpALUDDtXwKLFp:rEg2GLT9De7TRBaYDDJfp
MD5:	C966B1F44FCD421C10CFC4363357B788
SHA1:	2D245C26FE82C6092AF67E5A566B435767983CB6
SHA-256:	24DC5A644E19F2CB383BD992F0F89FDEA981833742B405740D81218481BCCD10
SHA-512:	3C6C46D02865ACEFBEC12B5DF49E9E8C1F9B124185C3B34D65A4388EDD436584C39DF6B4D30254E90CD8C99708B6F4490050E7EE02D5CF9211418760C2A77862
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQIb4ttzh-iR0PAPMxe5fYW6OEJLTtSHy0OII9rjZg&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@..".......................................5.........................!1AQa...q"2b.....#BCRc..................................#.......................1A.."q...!............?..(.......{Z.ikluN.}K....5..R.R..J"....E..^..R..o.vYKr.#......&...G.]\|.AW0kj.LS......a..NEOZ..'..y.'....D]...N.ck.1..<.V..b.{...:...P...$.7..V..Ey....)m.."L.........=s..^T:.n.CN..Rl.......l.;;}..j.....f.b&6<...\|..nL........B.Dm.....q6c'.H2.y..?....x....D.D...m..p. .Cw.......<...&.......q.w>.4.V..T.s.C[Y(ygx...}.q.%....)]K.#..ux.....^....'.,K...D....l........;....Y..-..o........p.........._......NU7...V...\|.]..htF....k\|3Ao...=....v.O><9....%....+nCk[....G......n...R2..M.<..c....U..6K....{.0.d../dLF...Ej..[...O.......I/..n....t=V..Q.Cq4..id.v\Z9.7.w.w...v.(.-..F..!...7.?%.D.............

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x35, components 3
Category:	downloaded
Size (bytes):	1178
Entropy (8bit):	7.4525848883832255
Encrypted:	false
SSDEEP:	24:rQ2g59WM/9ALdRNEHSGDzrE4DgRoSJ0QRxXZh5p:r1g5BABRNlGDzrIM4L3
MD5:	4A309656D287D1207C8E8906381BC079
SHA1:	7B565607FBFADA934D981E2D8562FDB65ECFB2EE
SHA-256:	A210A666DF89B7CE9E3C566902294FE10CA9D70426CAB1DABAEA62640FBE6539
SHA-512:	9358BA23FC10858360B86CFF0AD808B9546F011D21FC56CD9280D6285E57CCAC71E4ACE2FF69485055E218B65A9E15087D6F6D06B375B47165A57E51DFEE3D7F
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcThRMJCH--W_b9xZumSy-s5X330vkCDqc7z-5hmq7c&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......#.@..".......................................1.........................!..1A.."Qa2q....3Bcr...............................!.......................!"a..AQ.............?.v..f..^m..U...?&..F..yx.Z..T...9\uh..G.N.......m.kw..L[0.4..'..V...~....#.....,7....`v...a.w.4...S.Z.8N.$..I...NK..e%..1..+s.d......7/.....;.@.(.d...\|.R@:.}...PK.R:..C.+[.../..l.....~.dls..../.eZ.&./..[6m...;.?qfTa...........j..$.@....CV.W..$<t...3)....:........%f8m...\|4..9..2..K......twP...S.oc......6....sL!...[^..I&.6......8....\.q.8..,;b....`z.i....p.C.F.u......i........@..9.p..O..+.=t\i.3u..Aa.O0..S.s~+....U.[....J_i....\. V....lw.[X..L..m...(6.1.W.)@t.:...E..AL..KZ.+Q..D..v..Si..n:......~.+U.<..0}JQ.H...w......K.....K.a.x......[....CJ....a.\|.S..&.v..3..JA 'os.Ts8mc.p.2.kv.txs>#I.(W.')W.......@.v."0<.Hi..e.r7.t.3U:z.Y..L.+

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	128
Entropy (8bit):	4.726509204305764
Encrypted:	false
SSDEEP:	3:VwGLCAEHwwBHsLpHbGWjLwWkzXFETH1u4:VwGL5EH5BHsLRGAwWeXFEL13
MD5:	8080A7EA9A58B2A553BACAE991C172F4
SHA1:	CBE94947B6A708C9891FB76F18EEF8A8E37997E7
SHA-256:	7D78B85A34A7164905EAE577DAAF78A1338FF21179484B44CA9BA22ED2A75282
SHA-512:	18A5B1C91A2C8549428DBBD9B13EAFE93D2EBDF089B5947204C91676188D042AD6B4E492EEFE1CE8BF1CB0127F1BA924441D34CFA1FB160A1B7A6015441CF7DB
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12&oit=4&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["23.82.12",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (363)
Category:	downloaded
Size (bytes):	368
Entropy (8bit):	4.851959265784524
Encrypted:	false
SSDEEP:	6:VwtblTzQpHzrVXuJvVNsadVVuwZBdVVoBHsL2YriFGHLNjQKu7kwGRVzToSNrwGy:uPTzQpzrwJvrsW/uwV/oBHslriFuZsdD
MD5:	115F63FC8785E168B9A1A5D93DD600D8
SHA1:	F4AC5AAE645F3F55792F9C9B4CFC5BD856857C7C
SHA-256:	B89970BD74F6791781EB9A816EC2EB1A80A56AC5CF514943035993B942AA428E
SHA-512:	D84C69543EA05CB068D4BAF31402D8A34E7B5C35094ADF49D6199F556B7BC53ED6E80A385DBF94F3290BBC1D27EBA60058827EFAEE6F57E908C4708D751B80F4
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv&oit=1&cp=10&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["esd80n7apv",["esd8011","esd802a","esd8011mut5g","esd8004mutag","esd8006"],["","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,552,551,550],"google:suggestsubtypes":[[512,546],[649,546],[512,546],[512,546],[512,546]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":851}]

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	137
Entropy (8bit):	4.674176492905908
Encrypted:	false
SSDEEP:	3:VwpCMjNuwwBHsLpHbGWjLwWkzXFETH1u4:VwpCMI5BHsLRGAwWeXFEL13
MD5:	342B7BBC1CCF7E32D6D5806006E14D2B
SHA1:	9EB6A4126FDFA1DF8A90BEAD5E74F47344F9F0FD
SHA-256:	EC5360CE3F4E4B63240DE6122C928266EAE31C0800165FBC57DAE86E4B1DF90A
SHA-512:	57B5FEBDE43D23A36B146AF70107D6B7B87B58F7B24A9A3BCA2A26B2D3630E79A666FD247FA63E23BA0928077BAF3682D72AA60A4EF95259A6066FF8962C012E
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.net&oit=3&cp=17&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["pb-logs.media.net",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1617)
Category:	downloaded
Size (bytes):	1622
Entropy (8bit):	5.8821529180670415
Encrypted:	false
SSDEEP:	48:wv4xYKlgTFxie0wtVZQsHilBEBuU0guIgTFBqm5fffQVO:wv2DlAiDw24i2uUNgL5fffQ0
MD5:	5108C5F43E0A8412A3611EEAAE42E0A0
SHA1:	D15B070F80B0A0031FBD0B112457D9281A9205B3
SHA-256:	F086A6E0E89E95F306383A9FEE35DEA72E59816E85ADCF5D74A0034919A30124
SHA-512:	834A13A9E2BC052BD4E508C80F65E41499B6D554F483FEB1488FDE915A8945DB9110C3515304F9A855EC6745B616D938A84EA5A11D0C34A4697D1AD756B28643
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A&oit=4&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["23:",["23 and me","23 and me","23 blast","23 kg to lbs","23 minute timer","23 cm to inches","23 in spanish","23 jump street","23 an hour is how much a year","23 celsius to fahrenheit"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"CgovbS8wMnJfamxsEiEyM2FuZE1lIOKAlCBCaW90ZWNobm9sb2d5IGNvbXBhbnkyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1RRMExxZzNHcGI5a05xSXcxQ245dlJzMmx6cHZGTVFZMHdNLVF1OC00JnM9MTA6CTIzIGFuZCBtZUoHIzVjODIxMlI5Z3Nfc3NwPWVKemo0dExQMVRjd0tvclB5c2xSWURSZ2RHRHc0alF5VmtqTVMxSElUUVVBWVJrRzVBcBc\u003d"},{"google:entityinfo":"CgsvbS8wMTF4M3BfXxIJMjAxMyBmaWxtMnRodHRwczovL2VuY3J5cHRlZC10Ym4wLmdzdGF0aWMuY29tL2ltYWdlcz9xPXRibjpBTmQ5R2NSbDB3R0JWRHNmWWdYMExsSlNxQV9XTmZpYWRrNVJfWUQtSWd2RVpwS01hV19CalhwZ0ZZWHViRXcmcz0xMDoIMjMgQmxhc3RKByM0MjQyNDJSM2dzX3NzcD1lSnpqNHRiUDFUY3dOS3d3TG9pUE4yRDA0akF5VmtqS1NTd3VBUUJKWWdacXAU"},{},{},{},{},{"google:entityinfo":"CgsvbS8wMTI1a3

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 42, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	921
Entropy (8bit):	7.676453000903496
Encrypted:	false
SSDEEP:	24:ZlsttrFigH3pxKOCImhxqrdRLdGwoJkz1jHSNvQ5KQmeegL7:ZKEgHSFPqRiwoazVyBHa
MD5:	9C17D39791F6980219DCB9AA89F5056E
SHA1:	088147805482D8DF3D8461DAE647BCF1E94F1C3A
SHA-256:	47CE35CB0593E79A5040EEB8A07ACF20A00467C8D3F9209D261DCF6FFA680597
SHA-512:	DCC9F4D1D05A69F5E256ECF6E313D9D6D04A79373E3EC5CA3125BF228A8BECDD6B99F9B569E716BF9467B085AFE0CF974BC0A532231F46475BFA415741DA8933
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTQ0Lqg3Gpb9kNqIw1Cn9vRs2lzpvFMQY0wM-Qu8-4&s=10
Preview:	.PNG........IHDR...@........4......PLTE........a..3G.,......v..................X..P..c...........!..]..K.....TA................Q....G..m....}............Z.K~..h...d.m....(\h..v.@[.%7.'}~A.._.o;j....9...4..K.......J..f.-.KC.^N{.0...4r.fK..W...Z..,....vIDATH...{[.0.....lM.n#.....WQQ.e.....B..v..G....Y.w.7M....=..........o.;..z.......j.>.v.....8..GU5\.....9.......-....O.`pH../..%.Nhx...p......`1...`..8w.w.P].....%.....Y....\....3F....3w}...."..u... ...y........(.n.b....(..9UC...../.C..".....I..f/.D.u..E.n..)..A..@..1].N1......@"..!. F.'M..........[&...Y.=X...N..(.X`.Q....U.\|b}...ot.rz...&I....@.!1q...L.4I....j..x...km8H.2.l.....(..)`Q.........$.!.@CAP.Ij.(H#....j..Qv.Uyo..9..FJIk...MV...&il....Bf<.I...0$......Y..3.......}..#..._...z.1.m1.u........sww.G./..T=....J.....~.s.0..].v.2,C.i.....G..+.k......v....Y./.k3.../r]..a...`..;.TO......-..}.....IEND.B`.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (362)
Category:	downloaded
Size (bytes):	367
Entropy (8bit):	4.84687146395373
Encrypted:	false
SSDEEP:	6:VwtblHEpHzrVXuJvVNsadVVBVVuwMBHsL2YriFGHLNjQKu7kwGRVzToSNrwGd/fA:uPHEpzrwJvrsW/B/uwMBHslriFuZsd7P
MD5:	C5A1A7B326834921A82C05BBF5979568
SHA1:	B22B40B86286D1606555D0E844A1A71B09A83A87
SHA-256:	F08782216BA941EC4FECC71106B9FF2123D288A70D0B55AD92E70B7E72379EDB
SHA-512:	15E018F7B4DB45EEBBA6E971A3504B6DF87B7BC838D8BDAFCA35CAAF543CAD2D2AA79E0F9DF30CA97FBE251BB4804DB26350FB55650DB9D9CDE3BC5B682BA6F2
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7ap&oit=1&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["esd80n7ap",["esd8011","esd802a","esd8011mut5g","esd8006","esd8004mutag"],["","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,552,551,550],"google:suggestsubtypes":[[512,546],[649,546],[512,546],[512,546],[512,546]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":851}]

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 27, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	869
Entropy (8bit):	7.661931769065579
Encrypted:	false
SSDEEP:	24:8V+smWb3N2PCMlmlV5T8APyRlhe14oB2obw7:LWb3srK5wAqze2F7
MD5:	49A626CA27AEB32228E85473CAA142B4
SHA1:	35E87618F8A8CDD318090E2F5B8E89600F6AFA89
SHA-256:	9F3090C05CF40A5551C2CAFCD662375DBA3ADB4D466BEC61B6166AC93FCBF63E
SHA-512:	24788DD197040BFC078AD96D79DD45D9AE9CF4FD0D957FE2A71A5399A94068CD70D71161DD98B6D2442BF7F7875B1B879F444570C97355F568C3F5D5D08105B0
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSO7PUEXsrLnvhgTJ6YAeDsqtVgtQT_cAtXw08uSHg&s=10
Preview:	.PNG........IHDR...@...........y....~PLTE...&8.....#..,........ ..1......!4..&.#6..........\|...................9G.....LW......v}.O[.lu.@N...fo.[e.......2A.O......IDAT8..Tk..0.l(./Z.Dy(..r..........a...dHf.2.".^%.C{f.......8.J...Oc..8^.v....._....[.c...q...(q..:E.J.i....>%......M...)..9Ei....\|xc...^.....;...\N.g.].8O.;h..H.T..t&.9)5(......s9J,.s<...9.}..GxS0./% .<.F.....rTc.]Y.w..v......Xa...QG1.Dx.......h..B..Q..x.}.Dd..n!~~.0..iL%...K.`..%`Y.O.. <\|....;.NC......}...X...y......1...[s..../.X.i.SY..(..&.^....8.`B.......(..tNo..>JX.+X*..C...jx...~Z.f...a#;.....r....Q6+I....Rr&..Yf..zK..t.au!..e.f..yJ.....~..^...pN..s.....c.F.9.\|...z&..u.....;..@....'...x..."......if{.].....d.....@Z.R...+...i2..,.:U.M.!..AG/......#}x".}Ug...U....V...}.\|D.m57;..=..;.eN@A...=(..W"8...-Ef..U.3...Z..lU,.....E......=....).4......IEND.B`.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	130
Entropy (8bit):	4.655769849374946
Encrypted:	false
SSDEEP:	3:VwGfeB+4JHwwBHsLpYJWriFGWjLwWkzXFETH1u4:VwGf4H5BHsL2YriFGAwWeXFEL13
MD5:	42C95B6E624DB9EF0F1DBE21E99272D0
SHA1:	8E394DA414079B8436043A1D484B588064F70DA1
SHA-256:	78EF68A81C29DC1F3D8DACEDC024F1A58B019744500CED95FCD426C93084C31B
SHA-512:	E47C2F4577FF01EC7862EFE8CD5E87CC968E07AFEFA70FF16A9923BE5FBB8F5188BB0129E0C534DC597690E9DECEDE9C331CF7C25C30DCF6731A660DD276BA14
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A82%3A12%3A&oit=4&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["23:82:12:",[],[],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggesttype":[],"google:verbatimrelevance":851}]

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	1581
Entropy (8bit):	7.611690160877827
Encrypted:	false
SSDEEP:	24:rQUIVyUta7OhVjV7KVsllw5Rhiw53Jyxy6PH5Dj52M9ZBIAP4StvmisNhGPc:rMyT6zjV7Ll+Ro3yWZDjsSZBIA/QVAc
MD5:	ED4E5E0B62E8B868902721095800B7F9
SHA1:	41CDAD4C09B3D5DD351C461BC9FE8550D6EA71D3
SHA-256:	4A9BC7724701BA99B0BBCF482573FFA1F38EF35985D3D4E378081CF105DB41D2
SHA-512:	7374DAE4D947F7E341D1424906BC11605D5DD1D7CD68CEB3304309B304E32944EC8498628A110534598F0309B14F64F00EFCC9174A856B8FE77AEF08C29027C3
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQ5izffnK4mof-tp-H7-K3eMXruQNNm3D-zFIlW0hSoQlchQB6QXeO36R4&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@..".......................................8.........................!.1Q.Aa.."2q....#R....b....................................%.........................!.AQa1."#q............?...m[...>.3..0Yu$..y..'.5....tX..f...#j../.0...c....QB.q/4...f..sd...2...n..b..]qK..+.m.uv.....>....ef1n)Lx...B0..c.)a<_9.r.%v`eE..F2.....^c..[..o.Fs..x}(x.b.h.Q..&1n.........;..Jd.]%.(e...N....C.V1.B-o6.....o4....lh.+.......;.2....'.Q5`.$q\+.V....j.+...$...JAR.2..Ft......-.T.R\mg ..NqF..\.O.......$a#rJ.....<..-..V..G..Y......{T.1..,\[1Plo..C.a..pw...q.Sl..p\...[..g......G..4?.d.G.0..._...$..>4w.,....-..N2....:......)/.3.N\O..6;..V;E6u6...H...........D%G;cRN..J.],V.........(...R.>.U5....m..."+zJ.wVH.m.S.?k.9....*.mC...8Bzs'..'H....8..H..q.......>..T.~%....p)...O.......^.......N3.V.....G......\|O...v.[.%n....]ep..

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	137
Entropy (8bit):	4.718869580908931
Encrypted:	false
SSDEEP:	3:VwtblTzLHwEHwwBHsLpHbGWjLwWkzXFETH1u4:VwtblTzzwo5BHsLRGAwWeXFEL13
MD5:	B98AF41787798668A26C13AE75B10180
SHA1:	8EF79F9152E966CF153E3A37908F7A153D15A5D3
SHA-256:	E27A309D30C694F63B0EA04098C842D7906283882FD62DD217C5C0058D6890AA
SHA-512:	3ADAE2A844D05EAE5DFBD0627E3BCDBB8D8ACF3DB1350D254104864718E41E42639198CDE25BABE9CDC171A1B38663738A77CE5AC6EAA4456183DE629B5429C6
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.beauty&oit=3&cp=17&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["esd80n7apv.beauty",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	139
Entropy (8bit):	4.717826995152233
Encrypted:	false
SSDEEP:	3:PouV7uJzhquHbtt6vYk2ZRMRJfHKERSAEtvxLrXZiLKY8K09AbBK6c4NGL:hxuJzhqIzyYk+qRU4zEdxXZiqsbBK34A
MD5:	DA7DA7D630292E7A2A7DDA8CA87B3D39
SHA1:	A4CB76424DC44433A2DF01FE8B0BBD836D15E970
SHA-256:	52C1E7A2C36BE28C42455FE1572D7D7918C3180CAD99A2B82DAA2A38A7E7BB23
SHA-512:	9E717F9C6699B280436CA9BE7107BA6301430D4DEF8311B963A266A5B3B91B2719687B04860509B6142FA24D629A3217BD450696559FE6D9DC8C60BCCFD740AD
Malicious:	false
Reputation:	low
URL:	https://esd80n7apv.beauty/
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta charset="utf-8">.<title>Error</title>.</head>.<body>.<pre>Cannot GET /</pre>.</body>.</html>.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XML 1.0 document, ASCII text
Category:	downloaded
Size (bytes):	243
Entropy (8bit):	5.541919275699948
Encrypted:	false
SSDEEP:	6:TMVBd/ZbZjZvKtWRVzj9iv8ZA/SjlCLVsySR9LtpUan:TMHd9BZKtWRniv8rjwU9Lt+a
MD5:	3E95AA2BB46C88BE4B3363502E8C7400
SHA1:	45FC574FFEDC4D0D3408A60F656D3834F178213A
SHA-256:	A384DA1E6D1267F8F9280A108A1D7A921EF42BE365CC996CE37F54AF48090D5B
SHA-512:	62FDD92EF0CCF852F39E0F98E977D26FEF971178DD8A49CD876AB447E6C8E1CD67B64C0363DEA611F8EA60F45B987A3C5AD579BCBABFD7E4195A74D7B860F8CB
Malicious:	false
Reputation:	low
URL:	https://d3k0gij77b1jti.cloudfront.net/
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>6XA545BTH7WASY5W</RequestId><HostId>9gEw8dAKC7fw39nFjum/IIqLIjRQMVxXeU1Yj0c6Ar3+A+qH9CKtdD71APgXA9fxbYSn/6vG5Fo=</HostId></Error>

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	1213
Entropy (8bit):	7.489151771344614
Encrypted:	false
SSDEEP:	24:rQ1rfE5kJrUVJf2tnTKWxSB7pVR5Ei0J2CD18C:r6g5kJwr2tn2VHp0/RN
MD5:	2DE30A10C20BCC98F7867700293F262E
SHA1:	328F73399FB619883D2CCC4EA940E1FC98DE7AA9
SHA-256:	9E635B7070E72D77B84265595782E6EF4CFACD37CD478BE5C8EF6221A933660E
SHA-512:	82FBFEDE9DB04C7A107261B842212FA4D69958B9D7DA259A18EEF43082798ACFAC75204285A0C88277E76B1EDE94D2BF5FB31A6C8D200855AA33F107FC3474D9
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQnbYJwOVEpGQoZdc5ICYMuMcKbdbsjG2kFLPO7sxE&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@.."......................................=..........................1.!AQa."q...2..B......3CERbdr...............................................................?.u.M.I..NL2.d.3....1.x...~.M.3h....j.%b........d...G....0C.X......x.H.^4.......B9....x_. ...E....(1(.2..$.........L[....t.9...AV&.E...tsma^...[.:!....=.v..C.K..s!.<.....47........<.R..>...5j.W.O~s.T.\|%...k.....P.E7...B.D.%C}..P..j....{..~[....D...8..N.[...PMA\{.F.>M.r7s....:..=.q.....e.*s..4.u.:8..=8.!....B.>...u..s.YNT../...'.......JRy.>.o.O.,..s..X!=z..D.y.1PQ{.KO+.M..'.N.wf.E..Z.".M.....9.....en....1p...T..>.xeL0.....=.W...k........:..I..q%V..H....&.QmA...C.0....4...D....{...e..O.)9.H.I....J.9K........X....PFq4[.T.w..(../O8Ztg.E.zG.P.`Nc.. .U...lK. .]..OyJ.....hlE6.3...}.B).. n.....Rh._../s.r.....ja..).P...ag.65N.....2...9u.\|8

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x36, components 3
Category:	downloaded
Size (bytes):	1278
Entropy (8bit):	7.528634326919268
Encrypted:	false
SSDEEP:	24:rQYghX2cWLyj4YcFcitdLtfQECG9QMQfdEJC1RIQc9zM90:rCXVsYKcU5Q0pXJC/IX9U0
MD5:	2AC02FB5F257089A51737B87F9AEE129
SHA1:	3DEA3A54DE8BDAFAB050DB2169009318B1AF7B13
SHA-256:	897B896EFA410B7CBEAD578477E01A88C1DFC315675647AF81EED167DC7A8736
SHA-512:	AA8EA90DFB2944D19526676F13CDC6029F39F827852F2833FA33BEC31B21767378AAAA8D874D9EAB6930079AF0DE6AFD02ABB38DEE75040B152CA79AC62A8731
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTYCTe3dcc5mkJfG7_zdRiFQUk5FMr39iV8XxTudf8&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......$.@..".................................................................!1..AQ.."aq2..................................."......................!..1....."............?..W).G.!a.......l0OY.YK.P>R..E,r.(..G`@<\.~..<..u.+.VH$.e.j.>V{...c.............f...`.=Y.O ..VgE=......._.j..\...F.carO......-T..&f...T.......4..+E.H.oC.~..UL......fn.......hZ.....N..E..~`T.z....t.)d....H.T..w..s...DAY+.=.$...<[......9.2...2H[V...s.....O.'\.mM.Z.(x...A.....]......].p.....vYP.......8[S..toW...mE.?a..5$.e.S.^..Cnn...>.......u(..@ba.=D. ...Q.%.!..j8'........f,..@.....i.T.:@M.H.)?a.(....C)...\."...+k...>p.c.8....q.e;..D.d_...c"..r..t..x.I.....ZB..CmLorvQ..4.......Z`h{a....<....?."e.R3.J...h..m}. [.\.>wbif..)i.\|."..!t.Q...;.?\|0L.....4.....P..mG.v...D..lE..q..2...Z...j..Dj..k):...K.....0..I..+@.,./..4HQl..q..

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
Category:	downloaded
Size (bytes):	1117
Entropy (8bit):	7.324842396298114
Encrypted:	false
SSDEEP:	24:rQUClBJFBlsC/vC+sOYC15TLb6c2DEj6Vq2U1xZ3e0QBd:rUzJvaC/vC+t11Ge4qrZO0e
MD5:	0C02A14A007A56E32F9BC43DBDFA27F0
SHA1:	5C4866B07C2959C8B84FC5F67109A4DE52605AFE
SHA-256:	7A474CCE3268ABED8A4D6B78F453F410E4DB4BD752CFE4D61F3A95DBAFD70D03
SHA-512:	B8BF351C63B66CE4ABA803A2BAFE077E961B8E7B5ABFA92B4126FFEB96E5DF226FA6886352F8E95E2553542BCD88CE1927E25D3CF8BA618A44F9DBB08AB2BFA7
Malicious:	false
Reputation:	low
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRZCJ3kCr-ZpiLO2A6P0wSUF-eKqsvuauV2DDo9xjc&s=10
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......@.@.........................................../..........................!1a.Qq..."2A...#br........................................................!1.."q.2AQa.................?..h......P..@(.J....-...%%@.\|.b........P..@(.V..Ff.j..0..Z.-.W....H..;g.F.v.........u.....Q.......0.!M...@.;....,..E.p..i..M..T.~H.7.m^..Io{..N..''....X.%.i.s94.....?._Cw[..P..@y..VK...!.!..x..e..?..[.s...,u9..%e...\..y.s.]},...%7..YmN....3.P..o...&$.U...5e.j7.."Q1qZAu.......$`...#.sSt..YG...I..+.o.u..O!1.:&.I.[\|...s..<..J....@...NJ0.s.D....e?..%T..P....5...`.bS[^De~....X.z..8i.7.K....._.......cST..9....Nx....V..gE..-T.1\|u.......=..%O.8.`._P\|.v..8..4Pv...s.q..0.}.j.9u...1.%..?.rP...$....-Kh..n....(z....&.....@qd...*.M...l.L:..zm'r~....>.l..E.&......).;..x.X.._..o4.....$...Z.......Gr@HHum...C=.xp.v.9..;c&......0.{5....I.4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 17:47:44.499939919 CEST	49682	80	192.168.2.17	192.229.211.108
Aug 27, 2024 17:47:45.648515940 CEST	49680	443	192.168.2.17	20.189.173.13
Aug 27, 2024 17:47:50.654992104 CEST	49722	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:50.655066967 CEST	443	49722	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:50.655131102 CEST	49722	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:50.657073021 CEST	49722	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:50.657116890 CEST	443	49722	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:51.399735928 CEST	443	49722	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:51.400075912 CEST	49722	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:51.400090933 CEST	443	49722	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:51.401177883 CEST	443	49722	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:51.401240110 CEST	49722	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:51.402344942 CEST	49722	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:51.402447939 CEST	443	49722	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:51.402573109 CEST	49722	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:51.402580023 CEST	443	49722	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:51.456151009 CEST	49722	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:52.058516026 CEST	443	49722	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:52.058662891 CEST	443	49722	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:52.058768034 CEST	49722	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:52.059508085 CEST	49722	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:52.059530973 CEST	443	49722	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:52.184416056 CEST	49724	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:52.184472084 CEST	443	49724	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:52.184556007 CEST	49724	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:52.185913086 CEST	49724	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:52.185930014 CEST	443	49724	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:52.938364029 CEST	443	49724	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:52.938735962 CEST	49724	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:52.938752890 CEST	443	49724	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:52.939151049 CEST	443	49724	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:52.939498901 CEST	49724	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:52.939558983 CEST	443	49724	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:52.939744949 CEST	49724	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:52.984493017 CEST	443	49724	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:53.618129969 CEST	443	49724	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:53.618285894 CEST	443	49724	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:53.618387938 CEST	49724	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:53.619244099 CEST	49724	443	192.168.2.17	13.32.118.214
Aug 27, 2024 17:47:53.619276047 CEST	443	49724	13.32.118.214	192.168.2.17
Aug 27, 2024 17:47:54.106515884 CEST	49682	80	192.168.2.17	192.229.211.108
Aug 27, 2024 17:47:55.393806934 CEST	49727	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:47:55.393846035 CEST	443	49727	172.217.23.100	192.168.2.17
Aug 27, 2024 17:47:55.393949032 CEST	49727	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:47:55.394273043 CEST	49727	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:47:55.394284010 CEST	443	49727	172.217.23.100	192.168.2.17
Aug 27, 2024 17:47:55.750439882 CEST	49691	443	192.168.2.17	204.79.197.200
Aug 27, 2024 17:47:55.755697966 CEST	443	49691	204.79.197.200	192.168.2.17
Aug 27, 2024 17:47:55.848155022 CEST	443	49691	204.79.197.200	192.168.2.17
Aug 27, 2024 17:47:55.848220110 CEST	49691	443	192.168.2.17	204.79.197.200
Aug 27, 2024 17:47:55.849769115 CEST	49691	443	192.168.2.17	204.79.197.200
Aug 27, 2024 17:47:55.850317001 CEST	49691	443	192.168.2.17	204.79.197.200
Aug 27, 2024 17:47:55.850416899 CEST	49691	443	192.168.2.17	204.79.197.200
Aug 27, 2024 17:47:55.852610111 CEST	49691	443	192.168.2.17	204.79.197.200
Aug 27, 2024 17:47:55.852703094 CEST	49691	443	192.168.2.17	204.79.197.200
Aug 27, 2024 17:47:55.855361938 CEST	443	49691	204.79.197.200	192.168.2.17
Aug 27, 2024 17:47:55.855489969 CEST	443	49691	204.79.197.200	192.168.2.17
Aug 27, 2024 17:47:55.855633974 CEST	443	49691	204.79.197.200	192.168.2.17
Aug 27, 2024 17:47:55.855755091 CEST	443	49691	204.79.197.200	192.168.2.17
Aug 27, 2024 17:47:55.857876062 CEST	443	49691	204.79.197.200	192.168.2.17
Aug 27, 2024 17:47:55.858402967 CEST	443	49691	204.79.197.200	192.168.2.17
Aug 27, 2024 17:47:55.946988106 CEST	443	49691	204.79.197.200	192.168.2.17
Aug 27, 2024 17:47:55.947065115 CEST	49691	443	192.168.2.17	204.79.197.200
Aug 27, 2024 17:47:56.034452915 CEST	443	49727	172.217.23.100	192.168.2.17
Aug 27, 2024 17:47:56.034765959 CEST	49727	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:47:56.034787893 CEST	443	49727	172.217.23.100	192.168.2.17
Aug 27, 2024 17:47:56.035945892 CEST	443	49727	172.217.23.100	192.168.2.17
Aug 27, 2024 17:47:56.036026955 CEST	49727	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:47:56.037422895 CEST	49727	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:47:56.037511110 CEST	443	49727	172.217.23.100	192.168.2.17
Aug 27, 2024 17:47:56.082303047 CEST	443	49691	204.79.197.200	192.168.2.17
Aug 27, 2024 17:47:56.082356930 CEST	49691	443	192.168.2.17	204.79.197.200
Aug 27, 2024 17:47:56.085480928 CEST	49727	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:47:56.085500002 CEST	443	49727	172.217.23.100	192.168.2.17
Aug 27, 2024 17:47:56.133491993 CEST	49727	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:05.945614100 CEST	443	49727	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:05.945696115 CEST	443	49727	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:05.945791960 CEST	49727	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:06.840348959 CEST	49727	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:06.840373039 CEST	443	49727	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:11.118093014 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:11.118143082 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:11.118228912 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:11.118500948 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:11.118511915 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:11.754807949 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:11.755249023 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:11.755263090 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:11.755599022 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:11.755924940 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:11.755980015 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:11.756068945 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:11.796513081 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.059250116 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.059294939 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.059365034 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:12.059376001 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.060137987 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.060194016 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:12.060199976 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.060606956 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.060657978 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:12.060663939 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.066669941 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.066741943 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:12.066920042 CEST	49728	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:12.066934109 CEST	443	49728	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.682735920 CEST	49729	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:12.682785034 CEST	443	49729	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:12.682874918 CEST	49729	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:12.683155060 CEST	49729	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:12.683172941 CEST	443	49729	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:13.326977968 CEST	443	49729	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:13.327372074 CEST	49729	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:13.327414036 CEST	443	49729	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:13.327766895 CEST	443	49729	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:13.328115940 CEST	49729	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:13.328265905 CEST	49729	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:13.328270912 CEST	443	49729	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:13.328568935 CEST	443	49729	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:13.375729084 CEST	49729	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:13.637768984 CEST	443	49729	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:13.640944958 CEST	443	49729	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:13.641143084 CEST	49729	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:13.642333984 CEST	49729	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:13.642359018 CEST	443	49729	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.283397913 CEST	49730	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.283438921 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.283514023 CEST	49730	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.283838034 CEST	49730	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.283853054 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.539911032 CEST	49731	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.539952993 CEST	443	49731	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.540031910 CEST	49731	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.540308952 CEST	49731	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.540323973 CEST	443	49731	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.939429998 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.939482927 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.939595938 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.939835072 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.939846992 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.944340944 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.944607019 CEST	49730	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.944616079 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.944979906 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.945286989 CEST	49730	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.945346117 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:14.945404053 CEST	49730	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:14.988501072 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.196014881 CEST	443	49731	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.196394920 CEST	49731	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.196435928 CEST	443	49731	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.196791887 CEST	443	49731	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.198821068 CEST	49731	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.198885918 CEST	443	49731	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.238625050 CEST	49731	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.280823946 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.334647894 CEST	49730	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.334686041 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.373563051 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.373651028 CEST	49730	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.373794079 CEST	49730	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.373814106 CEST	443	49730	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.585007906 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.585429907 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.585455894 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.586491108 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.586620092 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.586920023 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.586981058 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.638670921 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.638689995 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.686614037 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.705621004 CEST	49731	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.748501062 CEST	443	49731	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.818178892 CEST	49731	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.818178892 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.818281889 CEST	443	49731	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:15.818342924 CEST	49731	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:15.860498905 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:16.182929993 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:16.188285112 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:16.188385010 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:16.189424992 CEST	49732	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:16.189443111 CEST	443	49732	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:17.428750038 CEST	49734	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:17.428797960 CEST	443	49734	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:17.428919077 CEST	49734	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:17.429161072 CEST	49734	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:17.429176092 CEST	443	49734	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.093231916 CEST	443	49734	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.093764067 CEST	49734	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.093801022 CEST	443	49734	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.094168901 CEST	443	49734	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.094487906 CEST	49734	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.094553947 CEST	443	49734	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.094630003 CEST	49734	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.097563982 CEST	49734	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.097585917 CEST	443	49734	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.097639084 CEST	443	49734	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.097693920 CEST	49734	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.098496914 CEST	49735	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.098540068 CEST	443	49735	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.098630905 CEST	49735	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.098829985 CEST	49735	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.098840952 CEST	443	49735	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.543751001 CEST	49736	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.543797016 CEST	443	49736	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.543911934 CEST	49736	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.544217110 CEST	49736	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.544234037 CEST	443	49736	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.759526968 CEST	443	49735	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.760016918 CEST	49735	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.760039091 CEST	443	49735	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.761133909 CEST	443	49735	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.761213064 CEST	49735	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.761493921 CEST	49735	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.761550903 CEST	443	49735	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.761631012 CEST	49735	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.761637926 CEST	443	49735	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.781033039 CEST	49735	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.781084061 CEST	443	49735	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.781155109 CEST	49735	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.781923056 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.781960011 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:18.782037973 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.782250881 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:18.782269955 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.230618000 CEST	443	49736	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.231051922 CEST	49736	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:19.231079102 CEST	443	49736	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.231400967 CEST	443	49736	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.231739998 CEST	49736	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:19.231800079 CEST	443	49736	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.231884003 CEST	49736	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:19.276498079 CEST	443	49736	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.451667070 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.451996088 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:19.452023029 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.453175068 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.453269958 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:19.453890085 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:19.454036951 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.498658895 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:19.498697996 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.546623945 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:19.562755108 CEST	443	49736	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.563502073 CEST	443	49736	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:19.563596010 CEST	49736	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:19.564769030 CEST	49736	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:19.564788103 CEST	443	49736	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:20.329370022 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:20.372503996 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:20.569664001 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:20.572881937 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:20.573129892 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:20.574018002 CEST	49737	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:20.574039936 CEST	443	49737	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:20.678780079 CEST	49738	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:20.678829908 CEST	443	49738	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:20.678945065 CEST	49738	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:20.679233074 CEST	49738	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:20.679254055 CEST	443	49738	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:20.901273966 CEST	49739	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:20.901328087 CEST	443	49739	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:20.901402950 CEST	49739	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:20.901702881 CEST	49739	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:20.901717901 CEST	443	49739	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.339454889 CEST	443	49738	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.339839935 CEST	49738	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.339869022 CEST	443	49738	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.340228081 CEST	443	49738	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.340557098 CEST	49738	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.340611935 CEST	443	49738	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.340739965 CEST	49738	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.377954006 CEST	49738	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.377981901 CEST	443	49738	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.378067970 CEST	443	49738	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.378127098 CEST	49738	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.381165028 CEST	49740	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.381202936 CEST	443	49740	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.381308079 CEST	49740	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.381560087 CEST	49740	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.381575108 CEST	443	49740	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.562556028 CEST	443	49739	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.562978983 CEST	49739	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.563004017 CEST	443	49739	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.563373089 CEST	443	49739	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.563793898 CEST	49739	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.563841105 CEST	49739	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.563848972 CEST	443	49739	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.563872099 CEST	443	49739	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.614645958 CEST	49739	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.759686947 CEST	49739	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.759804010 CEST	443	49739	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.759875059 CEST	49739	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.760895967 CEST	49741	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.760934114 CEST	443	49741	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:21.761017084 CEST	49741	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.761248112 CEST	49741	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:21.761269093 CEST	443	49741	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.020761013 CEST	443	49740	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.021130085 CEST	49740	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.021155119 CEST	443	49740	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.022243977 CEST	443	49740	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.022327900 CEST	49740	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.022630930 CEST	49740	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.022696018 CEST	443	49740	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.022804976 CEST	49740	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.022814035 CEST	443	49740	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.075697899 CEST	49740	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.189543962 CEST	49740	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.189647913 CEST	443	49740	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.189749956 CEST	49740	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.190495968 CEST	49742	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.190541029 CEST	443	49742	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.190628052 CEST	49742	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.190867901 CEST	49742	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.190881014 CEST	443	49742	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.397365093 CEST	443	49741	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.398257017 CEST	49741	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.398291111 CEST	443	49741	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.399332047 CEST	443	49741	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.399410009 CEST	49741	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.400057077 CEST	49741	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.400116920 CEST	443	49741	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.401644945 CEST	49741	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.401654959 CEST	443	49741	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.416227102 CEST	49741	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.416291952 CEST	443	49741	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.416362047 CEST	49741	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.417314053 CEST	49743	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.417351961 CEST	443	49743	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.417423010 CEST	49743	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.417701006 CEST	49743	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.417714119 CEST	443	49743	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.572882891 CEST	49744	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.572926998 CEST	443	49744	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.573040009 CEST	49744	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.573261023 CEST	49744	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.573271990 CEST	443	49744	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.828551054 CEST	443	49742	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.828897953 CEST	49742	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.828937054 CEST	443	49742	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.829999924 CEST	443	49742	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.830111027 CEST	49742	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.830382109 CEST	49742	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.830447912 CEST	443	49742	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.830543995 CEST	49742	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:22.830558062 CEST	443	49742	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:22.870625973 CEST	49742	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.049547911 CEST	443	49743	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.050431967 CEST	49743	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.050441980 CEST	443	49743	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.051496029 CEST	443	49743	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.051574945 CEST	49743	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.052011013 CEST	49743	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.052071095 CEST	443	49743	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.093643904 CEST	49743	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.093653917 CEST	443	49743	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.133728027 CEST	443	49742	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.134664059 CEST	443	49742	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.134742975 CEST	49742	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.135545969 CEST	49742	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.135565996 CEST	443	49742	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.141616106 CEST	49743	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.205216885 CEST	443	49744	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.205574989 CEST	49744	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.205595016 CEST	443	49744	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.205931902 CEST	443	49744	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.206362009 CEST	49744	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.206439972 CEST	443	49744	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:23.253863096 CEST	49744	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:23.303811073 CEST	49745	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.303854942 CEST	443	49745	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.303949118 CEST	49745	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.304342985 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.304349899 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.304408073 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.304552078 CEST	49745	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.304564953 CEST	443	49745	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.304689884 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.304697990 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.876816034 CEST	443	49745	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.877204895 CEST	49745	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.877230883 CEST	443	49745	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.878508091 CEST	443	49745	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.878628016 CEST	49745	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.879260063 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.879517078 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.879525900 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.879688025 CEST	49745	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.879825115 CEST	443	49745	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.879890919 CEST	49745	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.879898071 CEST	443	49745	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.880738020 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.880806923 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.881535053 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.881602049 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.921704054 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.921704054 CEST	49745	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.921725035 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.968662977 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.988416910 CEST	443	49745	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.988603115 CEST	443	49745	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:23.988753080 CEST	49745	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.989692926 CEST	49745	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:48:23.989712954 CEST	443	49745	34.197.100.133	192.168.2.17
Aug 27, 2024 17:48:32.979022980 CEST	443	49743	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:32.979099035 CEST	443	49743	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:32.979152918 CEST	49743	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:33.117027044 CEST	443	49744	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:33.117104053 CEST	443	49744	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:33.117296934 CEST	49744	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:33.149888039 CEST	49743	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:33.149919987 CEST	443	49743	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:33.149941921 CEST	49744	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:33.149976015 CEST	443	49744	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:33.150350094 CEST	49748	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:33.150396109 CEST	443	49748	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:33.150522947 CEST	49748	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:33.150897026 CEST	49748	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:33.150909901 CEST	443	49748	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:33.805179119 CEST	443	49748	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:33.805516958 CEST	49748	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:33.805535078 CEST	443	49748	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:33.805907965 CEST	443	49748	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:33.806225061 CEST	49748	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:33.806282997 CEST	443	49748	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:33.806361914 CEST	49748	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:33.852498055 CEST	443	49748	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:34.115433931 CEST	443	49748	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:34.117408037 CEST	443	49748	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:34.117624998 CEST	49748	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:34.118590117 CEST	49748	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:34.118613958 CEST	443	49748	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:34.905987978 CEST	49704	80	192.168.2.17	199.232.214.172
Aug 27, 2024 17:48:35.209863901 CEST	49704	80	192.168.2.17	199.232.214.172
Aug 27, 2024 17:48:35.436039925 CEST	80	49704	199.232.214.172	192.168.2.17
Aug 27, 2024 17:48:35.436105967 CEST	80	49704	199.232.214.172	192.168.2.17
Aug 27, 2024 17:48:35.436338902 CEST	49704	80	192.168.2.17	199.232.214.172
Aug 27, 2024 17:48:35.436680079 CEST	80	49704	199.232.214.172	192.168.2.17
Aug 27, 2024 17:48:35.436728001 CEST	49704	80	192.168.2.17	199.232.214.172
Aug 27, 2024 17:48:35.441659927 CEST	80	49704	199.232.214.172	192.168.2.17
Aug 27, 2024 17:48:35.921737909 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:35.921797991 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:35.921906948 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:35.922173023 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:35.922187090 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:36.040008068 CEST	49750	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.040050030 CEST	443	49750	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.040234089 CEST	49750	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.040370941 CEST	49750	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.040385962 CEST	443	49750	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.144948959 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.144990921 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.145126104 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.145378113 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.145396948 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.408035040 CEST	49752	443	192.168.2.17	13.107.5.88
Aug 27, 2024 17:48:36.408087969 CEST	443	49752	13.107.5.88	192.168.2.17
Aug 27, 2024 17:48:36.408180952 CEST	49752	443	192.168.2.17	13.107.5.88
Aug 27, 2024 17:48:36.438945055 CEST	49752	443	192.168.2.17	13.107.5.88
Aug 27, 2024 17:48:36.438961983 CEST	443	49752	13.107.5.88	192.168.2.17
Aug 27, 2024 17:48:36.675831079 CEST	443	49750	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.676125050 CEST	49750	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.676151037 CEST	443	49750	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.676493883 CEST	443	49750	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.676887989 CEST	49750	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.676959038 CEST	443	49750	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.677062988 CEST	49750	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.724510908 CEST	443	49750	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.747656107 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:36.747745037 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:36.764610052 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:36.764620066 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:36.764978886 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:36.765464067 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:36.765502930 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:36.765532970 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:36.782193899 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.782533884 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.782556057 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.782918930 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.783246040 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.783312082 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.834688902 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.996512890 CEST	49750	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.996608019 CEST	443	49750	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:36.996680975 CEST	49750	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:36.997159958 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:37.001854897 CEST	443	49752	13.107.5.88	192.168.2.17
Aug 27, 2024 17:48:37.001936913 CEST	49752	443	192.168.2.17	13.107.5.88
Aug 27, 2024 17:48:37.006705046 CEST	49752	443	192.168.2.17	13.107.5.88
Aug 27, 2024 17:48:37.006722927 CEST	443	49752	13.107.5.88	192.168.2.17
Aug 27, 2024 17:48:37.006979942 CEST	443	49752	13.107.5.88	192.168.2.17
Aug 27, 2024 17:48:37.044497967 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:37.058746099 CEST	49752	443	192.168.2.17	13.107.5.88
Aug 27, 2024 17:48:37.089705944 CEST	49752	443	192.168.2.17	13.107.5.88
Aug 27, 2024 17:48:37.136501074 CEST	443	49752	13.107.5.88	192.168.2.17
Aug 27, 2024 17:48:37.357306957 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:37.357330084 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:37.357359886 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:37.357400894 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:37.357414007 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:37.357426882 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:37.357455015 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:37.357476950 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:37.357793093 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:37.357819080 CEST	49749	443	192.168.2.17	40.126.32.140
Aug 27, 2024 17:48:37.357821941 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:37.357826948 CEST	443	49749	40.126.32.140	192.168.2.17
Aug 27, 2024 17:48:37.357898951 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:37.357952118 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:37.358022928 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:37.358031988 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:37.407715082 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:37.411679029 CEST	49753	443	192.168.2.17	23.73.207.5
Aug 27, 2024 17:48:37.411717892 CEST	443	49753	23.73.207.5	192.168.2.17
Aug 27, 2024 17:48:37.411798954 CEST	49753	443	192.168.2.17	23.73.207.5
Aug 27, 2024 17:48:37.414448023 CEST	49753	443	192.168.2.17	23.73.207.5
Aug 27, 2024 17:48:37.414462090 CEST	443	49753	23.73.207.5	192.168.2.17
Aug 27, 2024 17:48:37.448616028 CEST	443	49752	13.107.5.88	192.168.2.17
Aug 27, 2024 17:48:37.449111938 CEST	443	49752	13.107.5.88	192.168.2.17
Aug 27, 2024 17:48:37.449174881 CEST	49752	443	192.168.2.17	13.107.5.88
Aug 27, 2024 17:48:37.452375889 CEST	49752	443	192.168.2.17	13.107.5.88
Aug 27, 2024 17:48:37.685116053 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:37.685339928 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:37.685384035 CEST	443	49751	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:37.685492992 CEST	49751	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:37.890599966 CEST	443	49753	23.73.207.5	192.168.2.17
Aug 27, 2024 17:48:37.890733957 CEST	49753	443	192.168.2.17	23.73.207.5
Aug 27, 2024 17:48:37.941605091 CEST	49753	443	192.168.2.17	23.73.207.5
Aug 27, 2024 17:48:37.941631079 CEST	443	49753	23.73.207.5	192.168.2.17
Aug 27, 2024 17:48:37.941979885 CEST	443	49753	23.73.207.5	192.168.2.17
Aug 27, 2024 17:48:37.942080975 CEST	49753	443	192.168.2.17	23.73.207.5
Aug 27, 2024 17:48:37.943969965 CEST	49753	443	192.168.2.17	23.73.207.5
Aug 27, 2024 17:48:37.944003105 CEST	443	49753	23.73.207.5	192.168.2.17
Aug 27, 2024 17:48:38.117791891 CEST	443	49753	23.73.207.5	192.168.2.17
Aug 27, 2024 17:48:38.117882013 CEST	443	49753	23.73.207.5	192.168.2.17
Aug 27, 2024 17:48:38.117955923 CEST	443	49753	23.73.207.5	192.168.2.17
Aug 27, 2024 17:48:38.117955923 CEST	49753	443	192.168.2.17	23.73.207.5
Aug 27, 2024 17:48:38.118006945 CEST	49753	443	192.168.2.17	23.73.207.5
Aug 27, 2024 17:48:38.120644093 CEST	49753	443	192.168.2.17	23.73.207.5
Aug 27, 2024 17:48:38.120663881 CEST	443	49753	23.73.207.5	192.168.2.17
Aug 27, 2024 17:48:40.013386965 CEST	49757	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:40.013421059 CEST	443	49757	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:40.013545036 CEST	49757	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:40.013804913 CEST	49757	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:40.013816118 CEST	443	49757	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:40.646511078 CEST	443	49757	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:40.646797895 CEST	49757	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:40.646826982 CEST	443	49757	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:40.647833109 CEST	443	49757	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:40.647903919 CEST	49757	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:40.648175955 CEST	49757	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:40.648232937 CEST	443	49757	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:40.648308039 CEST	49757	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:40.667470932 CEST	49757	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:40.667484999 CEST	443	49757	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:40.667537928 CEST	49757	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:41.386846066 CEST	49758	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:41.386898041 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:41.386990070 CEST	49758	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:41.387224913 CEST	49758	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:41.387236118 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:42.118554115 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:42.118921041 CEST	49758	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:42.118937969 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:42.119273901 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:42.119575024 CEST	49758	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:42.119636059 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:42.119739056 CEST	49758	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:42.164495945 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:42.438283920 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:42.485779047 CEST	49758	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:42.485810995 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:42.532815933 CEST	49758	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:42.769248962 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:42.769385099 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:42.769464970 CEST	49758	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:42.770085096 CEST	49758	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:42.770100117 CEST	443	49758	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:48.942289114 CEST	49759	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:48.942327023 CEST	443	49759	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:48.942425013 CEST	49759	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:48.942734003 CEST	49759	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:48.942744970 CEST	443	49759	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.052855968 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.052907944 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.053016901 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.053303003 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.053313971 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.279550076 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.279608011 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.279721975 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.279963970 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.279978991 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.600857019 CEST	443	49759	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.601274967 CEST	49759	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.601300001 CEST	443	49759	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.601605892 CEST	443	49759	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.601939917 CEST	49759	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.601999998 CEST	443	49759	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.602169991 CEST	49759	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.644501925 CEST	443	49759	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.729058027 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.729465961 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.729485989 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.732245922 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.732335091 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.732629061 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.732687950 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.772636890 CEST	49759	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.772725105 CEST	443	49759	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.772794962 CEST	49759	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.773330927 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.773341894 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.818758011 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.967267990 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.967606068 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.967619896 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.968545914 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:49.968615055 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.968919039 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:49.968995094 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.010801077 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.010823011 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.057267904 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.058764935 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.106741905 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.106756926 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.145848989 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.145946980 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.146064997 CEST	49760	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.146091938 CEST	443	49760	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.542541981 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.584498882 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.766496897 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.768958092 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.769021034 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.769953966 CEST	49761	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.769974947 CEST	443	49761	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.858525038 CEST	49763	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.858580112 CEST	443	49763	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:50.858670950 CEST	49763	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.858957052 CEST	49763	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:50.858975887 CEST	443	49763	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.192595005 CEST	49764	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.192636967 CEST	443	49764	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.192737103 CEST	49764	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.192980051 CEST	49764	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.192992926 CEST	443	49764	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.303947926 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.303987980 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.304069042 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.304353952 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.304367065 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.506732941 CEST	443	49763	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.506995916 CEST	49763	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.507015944 CEST	443	49763	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.507308006 CEST	443	49763	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.507613897 CEST	49763	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.507673025 CEST	443	49763	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.507742882 CEST	49763	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.548518896 CEST	443	49763	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.811110020 CEST	443	49763	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.812341928 CEST	443	49763	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.812417030 CEST	49763	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.813348055 CEST	49763	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.813369036 CEST	443	49763	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.861478090 CEST	443	49764	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.861884117 CEST	49764	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.861922979 CEST	443	49764	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.862226009 CEST	443	49764	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.862531900 CEST	49764	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.862596989 CEST	443	49764	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.906837940 CEST	49764	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.948695898 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.949110031 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.949129105 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.950036049 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:51.950118065 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.956561089 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:51.956674099 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:52.002811909 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:52.002830982 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:52.050769091 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:52.341603041 CEST	49764	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:52.372823000 CEST	49764	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:52.372844934 CEST	443	49764	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:52.372941017 CEST	443	49764	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:52.372998953 CEST	49764	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:52.451858044 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:52.496503115 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:52.667690992 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:52.669938087 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:52.670017958 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:52.670943975 CEST	49765	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:52.670968056 CEST	443	49765	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:53.330498934 CEST	49766	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:53.330544949 CEST	443	49766	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:53.330637932 CEST	49766	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:53.330882072 CEST	49766	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:53.330893040 CEST	443	49766	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:53.963428020 CEST	443	49766	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:53.963895082 CEST	49766	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:53.963913918 CEST	443	49766	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:53.964236021 CEST	443	49766	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:53.964570999 CEST	49766	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:53.964632988 CEST	443	49766	172.217.23.100	192.168.2.17
Aug 27, 2024 17:48:54.010868073 CEST	49766	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:48:58.845485926 CEST	49767	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:48:58.845554113 CEST	443	49767	23.82.12.31	192.168.2.17
Aug 27, 2024 17:48:58.845633030 CEST	49767	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:48:58.845792055 CEST	49768	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:48:58.845798969 CEST	443	49768	23.82.12.31	192.168.2.17
Aug 27, 2024 17:48:58.845849991 CEST	49768	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:48:58.847050905 CEST	49769	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:48:58.847111940 CEST	443	49769	23.82.12.31	192.168.2.17
Aug 27, 2024 17:48:58.847178936 CEST	49769	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:48:58.847394943 CEST	49769	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:48:58.847412109 CEST	443	49769	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:01.851602077 CEST	49767	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:01.851634026 CEST	443	49767	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:01.851696968 CEST	443	49767	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:01.852009058 CEST	49768	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:01.852027893 CEST	443	49768	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:01.852075100 CEST	443	49768	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:01.852497101 CEST	49770	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:01.852539062 CEST	443	49770	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:01.852622986 CEST	49770	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:01.852751017 CEST	49770	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:01.852763891 CEST	443	49770	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:01.852793932 CEST	443	49770	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:02.892616034 CEST	49771	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:02.892656088 CEST	443	49771	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:02.892749071 CEST	49771	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:02.892899990 CEST	49772	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:02.892942905 CEST	443	49772	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:02.892995119 CEST	49772	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:02.893126011 CEST	49771	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:02.893137932 CEST	443	49771	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:02.893179893 CEST	443	49771	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:03.869503975 CEST	443	49766	172.217.23.100	192.168.2.17
Aug 27, 2024 17:49:03.869580984 CEST	443	49766	172.217.23.100	192.168.2.17
Aug 27, 2024 17:49:03.869641066 CEST	49766	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:49:04.834667921 CEST	49766	443	192.168.2.17	172.217.23.100
Aug 27, 2024 17:49:04.834702015 CEST	443	49766	172.217.23.100	192.168.2.17
Aug 27, 2024 17:49:07.913836002 CEST	49773	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:07.913897991 CEST	443	49773	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:07.913985968 CEST	49773	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:07.914048910 CEST	49772	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:07.914072037 CEST	443	49772	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:07.914119959 CEST	443	49772	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:07.914347887 CEST	49773	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:07.914361954 CEST	443	49773	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:07.914398909 CEST	443	49773	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:07.914787054 CEST	49774	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:07.914803028 CEST	443	49774	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:07.914846897 CEST	49774	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:07.915040016 CEST	49774	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:07.915049076 CEST	443	49774	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:07.915066004 CEST	443	49774	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:08.926944971 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:49:08.926979065 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:49:19.414096117 CEST	49696	443	192.168.2.17	184.28.90.27
Aug 27, 2024 17:49:19.623092890 CEST	443	49696	184.28.90.27	192.168.2.17
Aug 27, 2024 17:49:19.623285055 CEST	49696	443	192.168.2.17	184.28.90.27
Aug 27, 2024 17:49:20.641184092 CEST	49697	443	192.168.2.17	184.28.90.27
Aug 27, 2024 17:49:20.647281885 CEST	443	49697	184.28.90.27	192.168.2.17
Aug 27, 2024 17:49:20.647475004 CEST	49697	443	192.168.2.17	184.28.90.27
Aug 27, 2024 17:49:20.754046917 CEST	443	49769	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:20.754441023 CEST	49769	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:20.754542112 CEST	443	49769	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:20.754695892 CEST	49769	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:20.754813910 CEST	49776	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:20.754868984 CEST	443	49776	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:20.754952908 CEST	49776	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:20.755202055 CEST	49776	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:20.755212069 CEST	443	49776	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:21.709372044 CEST	443	49776	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:21.709693909 CEST	49776	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:21.709819078 CEST	443	49776	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:21.709896088 CEST	49776	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:23.702270031 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:49:23.702483892 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:49:23.702687979 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:49:24.841722012 CEST	49746	443	192.168.2.17	34.197.100.133
Aug 27, 2024 17:49:24.841758013 CEST	443	49746	34.197.100.133	192.168.2.17
Aug 27, 2024 17:49:37.936296940 CEST	49777	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:37.936347961 CEST	443	49777	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:37.936474085 CEST	49777	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:37.936947107 CEST	49777	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:37.936960936 CEST	443	49777	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:37.937025070 CEST	443	49777	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:37.970911980 CEST	49778	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:37.970948935 CEST	49779	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:37.970958948 CEST	443	49778	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:37.970987082 CEST	443	49779	23.82.12.31	192.168.2.17
Aug 27, 2024 17:49:37.971133947 CEST	49778	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:37.971498966 CEST	49779	443	192.168.2.17	23.82.12.31
Aug 27, 2024 17:49:42.077886105 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.077929974 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.078031063 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.078269005 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.078282118 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.308641911 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.308701038 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.308804989 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.309020996 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.309035063 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.724502087 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.724879980 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.724900961 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.725261927 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.725594997 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.725667953 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.725750923 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.768500090 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.979028940 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.979338884 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.979357958 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.979696989 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:42.980005980 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:42.980062962 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.023042917 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.056726933 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.056783915 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.056843042 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.056857109 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.105907917 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.105925083 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.153031111 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.251837969 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.252109051 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.252178907 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.253463030 CEST	49780	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.253484011 CEST	443	49780	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.270344019 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:43.270376921 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:43.270433903 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:43.270637035 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:43.270652056 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:43.538383961 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.584507942 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.772599936 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.772650957 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.772707939 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.772725105 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.774255991 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.774319887 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.774327993 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.775333881 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.775420904 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.775459051 CEST	49781	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.775474072 CEST	443	49781	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.870505095 CEST	49789	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.870547056 CEST	443	49789	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.870636940 CEST	49789	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.870852947 CEST	49789	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:43.870874882 CEST	443	49789	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:43.945341110 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:43.945534945 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:43.945550919 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:43.945975065 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:43.945991993 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:43.946057081 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:43.946064949 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:43.946113110 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:43.946755886 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:43.947812080 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:43.947877884 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:43.947915077 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:43.992513895 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:43.997030973 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:43.997040033 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:44.044044018 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:44.046816111 CEST	49790	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.046849966 CEST	443	49790	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.046942949 CEST	49790	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.047153950 CEST	49790	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.047171116 CEST	443	49790	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.206418037 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.206455946 CEST	443	49792	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.206528902 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.206756115 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.206768036 CEST	443	49792	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.213092089 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:44.214035034 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:44.214102983 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:44.214113951 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:44.217190027 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:44.217263937 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:44.217273951 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:44.224005938 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:44.224067926 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:44.224076033 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:44.224270105 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:44.224309921 CEST	443	49785	172.217.23.97	192.168.2.17
Aug 27, 2024 17:49:44.224370003 CEST	49785	443	192.168.2.17	172.217.23.97
Aug 27, 2024 17:49:44.430742979 CEST	49795	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.430773973 CEST	443	49795	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.430846930 CEST	49795	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.431050062 CEST	49795	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.431061029 CEST	443	49795	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.530153036 CEST	443	49789	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.530446053 CEST	49789	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.530462980 CEST	443	49789	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.530814886 CEST	443	49789	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.531135082 CEST	49789	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.531203032 CEST	443	49789	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.531279087 CEST	49789	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.558511972 CEST	49789	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.558532000 CEST	443	49789	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.558561087 CEST	443	49789	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.558605909 CEST	49789	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.559550047 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.559581041 CEST	443	49796	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.559659004 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.559895039 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.559906960 CEST	443	49796	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.684338093 CEST	443	49790	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.684694052 CEST	49790	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.684712887 CEST	443	49790	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.685086012 CEST	443	49790	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.685461044 CEST	49790	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.685539007 CEST	443	49790	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.685652971 CEST	49790	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.732495070 CEST	443	49790	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.840709925 CEST	443	49792	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.840981960 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.840991974 CEST	443	49792	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.842091084 CEST	443	49792	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.842158079 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.842467070 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.842554092 CEST	443	49792	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.892050028 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.892057896 CEST	443	49792	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.939052105 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.941099882 CEST	49790	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.941205978 CEST	443	49790	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.941276073 CEST	49790	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.941823006 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.972769022 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:44.972781897 CEST	443	49792	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.972882032 CEST	443	49792	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:44.972939014 CEST	49792	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.052134991 CEST	49799	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.052180052 CEST	443	49799	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.052258968 CEST	49799	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.052496910 CEST	49799	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.052511930 CEST	443	49799	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.074623108 CEST	443	49795	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.074870110 CEST	49795	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.074884892 CEST	443	49795	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.075941086 CEST	443	49795	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.076026917 CEST	49795	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.076345921 CEST	49795	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.076412916 CEST	443	49795	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.076497078 CEST	49795	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.076503992 CEST	443	49795	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.100878954 CEST	49795	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.101064920 CEST	443	49795	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.101128101 CEST	49795	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.163965940 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.163992882 CEST	443	49800	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.164083958 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.164345026 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.164357901 CEST	443	49800	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.192764044 CEST	443	49796	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.193032026 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.193046093 CEST	443	49796	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.194083929 CEST	443	49796	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.194156885 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.194458008 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.194518089 CEST	443	49796	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.194586039 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.236502886 CEST	443	49796	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.243066072 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.243088007 CEST	443	49796	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.291057110 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.310898066 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.311012030 CEST	443	49796	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.311101913 CEST	49796	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.311865091 CEST	49801	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.311903000 CEST	443	49801	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.311975002 CEST	49801	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.312218904 CEST	49801	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.312235117 CEST	443	49801	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.692810059 CEST	49802	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.692850113 CEST	443	49802	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.692941904 CEST	49802	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.693022966 CEST	443	49799	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.693186998 CEST	49802	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.693200111 CEST	443	49802	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.693317890 CEST	49799	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.693331957 CEST	443	49799	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.694365025 CEST	443	49799	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.694436073 CEST	49799	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.694701910 CEST	49799	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.694765091 CEST	443	49799	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.694822073 CEST	49799	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.694832087 CEST	443	49799	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.738261938 CEST	49799	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.801394939 CEST	443	49800	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.801742077 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.801763058 CEST	443	49800	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.803965092 CEST	443	49800	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.804074049 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.804403067 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.804536104 CEST	443	49800	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.848057032 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:45.848071098 CEST	443	49800	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:45.896070004 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.025734901 CEST	49799	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.025844097 CEST	443	49799	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.025906086 CEST	49799	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.026494980 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.072496891 CEST	443	49800	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.138190985 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.138250113 CEST	443	49800	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.138314009 CEST	49800	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.139168978 CEST	443	49801	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.139230967 CEST	49803	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.139261961 CEST	443	49803	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.139332056 CEST	49803	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.139462948 CEST	49801	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.139477015 CEST	443	49801	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.139678001 CEST	49803	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.139689922 CEST	443	49803	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.140814066 CEST	443	49801	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.140881062 CEST	49801	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.141221046 CEST	49801	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.141288042 CEST	443	49801	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.141356945 CEST	49801	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.141364098 CEST	443	49801	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.183171988 CEST	49801	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.348349094 CEST	49801	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.348433971 CEST	443	49801	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.348506927 CEST	49801	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.349273920 CEST	49804	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.349299908 CEST	443	49804	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.349374056 CEST	49804	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.349667072 CEST	49804	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.349677086 CEST	443	49804	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.375294924 CEST	443	49802	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.375822067 CEST	49802	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.375833035 CEST	443	49802	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.376200914 CEST	443	49802	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.376532078 CEST	49802	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.376595020 CEST	443	49802	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.376673937 CEST	49802	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.424499035 CEST	443	49802	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.712908983 CEST	49802	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.713009119 CEST	443	49802	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.713085890 CEST	49802	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.714253902 CEST	49805	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.714289904 CEST	443	49805	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.714381933 CEST	49805	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.714637041 CEST	49805	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.714651108 CEST	443	49805	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.829468966 CEST	443	49803	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.829864025 CEST	49803	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.829883099 CEST	443	49803	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.831053019 CEST	443	49803	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.831160069 CEST	49803	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.831551075 CEST	49803	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.831613064 CEST	443	49803	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.831713915 CEST	49803	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.831722021 CEST	443	49803	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.855915070 CEST	49803	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.855990887 CEST	443	49803	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.856103897 CEST	49803	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.856796980 CEST	49806	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.856829882 CEST	443	49806	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.856913090 CEST	49806	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.857173920 CEST	49806	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.857187033 CEST	443	49806	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.997636080 CEST	49807	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.997684956 CEST	443	49807	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:46.997770071 CEST	49807	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.997983932 CEST	49807	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:46.997997046 CEST	443	49807	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.125912905 CEST	443	49804	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.126219034 CEST	49804	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.126235962 CEST	443	49804	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.127274990 CEST	443	49804	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.127347946 CEST	49804	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.127628088 CEST	49804	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.127693892 CEST	443	49804	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.127772093 CEST	49804	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.127779961 CEST	443	49804	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.171044111 CEST	49804	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.378704071 CEST	443	49805	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.379045963 CEST	49805	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.379065990 CEST	443	49805	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.380064964 CEST	443	49805	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.380131006 CEST	49805	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.380423069 CEST	49805	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.380496025 CEST	443	49805	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.427069902 CEST	49805	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.427093983 CEST	443	49805	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.432301044 CEST	443	49804	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.434104919 CEST	443	49804	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.434185982 CEST	49804	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.434961081 CEST	49804	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.434993982 CEST	443	49804	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.475058079 CEST	49805	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.770502090 CEST	443	49806	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.770840883 CEST	49806	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.770858049 CEST	443	49806	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.772583008 CEST	443	49806	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.772655010 CEST	49806	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.772933960 CEST	49806	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.773008108 CEST	443	49806	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.777609110 CEST	443	49807	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.777789116 CEST	49807	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.777813911 CEST	443	49807	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.778136015 CEST	443	49807	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.778389931 CEST	49807	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.778449059 CEST	443	49807	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.827043056 CEST	49806	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.827056885 CEST	443	49806	142.250.186.100	192.168.2.17
Aug 27, 2024 17:49:47.827095032 CEST	49807	443	192.168.2.17	142.250.186.100
Aug 27, 2024 17:49:47.875056028 CEST	49806	443	192.168.2.17	142.250.186.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 17:47:50.574289083 CEST	63666	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:47:50.584774017 CEST	53	59547	1.1.1.1	192.168.2.17
Aug 27, 2024 17:47:50.587567091 CEST	64831	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:47:50.590590000 CEST	53	63666	1.1.1.1	192.168.2.17
Aug 27, 2024 17:47:50.602494001 CEST	53	64831	1.1.1.1	192.168.2.17
Aug 27, 2024 17:47:50.636601925 CEST	53	57591	1.1.1.1	192.168.2.17
Aug 27, 2024 17:47:51.715193033 CEST	53	52110	1.1.1.1	192.168.2.17
Aug 27, 2024 17:47:55.383686066 CEST	51884	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:47:55.383872032 CEST	62508	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:47:55.391031027 CEST	53	62508	1.1.1.1	192.168.2.17
Aug 27, 2024 17:47:55.392685890 CEST	53	51884	1.1.1.1	192.168.2.17
Aug 27, 2024 17:48:08.691293955 CEST	53	63544	1.1.1.1	192.168.2.17
Aug 27, 2024 17:48:15.384279966 CEST	53	55723	1.1.1.1	192.168.2.17
Aug 27, 2024 17:48:23.262486935 CEST	61325	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:48:23.262687922 CEST	57009	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:48:23.284519911 CEST	53	57009	1.1.1.1	192.168.2.17
Aug 27, 2024 17:48:23.303216934 CEST	53	61325	1.1.1.1	192.168.2.17
Aug 27, 2024 17:48:23.928855896 CEST	138	138	192.168.2.17	192.168.2.255
Aug 27, 2024 17:48:27.367216110 CEST	53	55765	1.1.1.1	192.168.2.17
Aug 27, 2024 17:48:50.213229895 CEST	53	58265	1.1.1.1	192.168.2.17
Aug 27, 2024 17:48:50.568319082 CEST	53	52021	1.1.1.1	192.168.2.17
Aug 27, 2024 17:49:18.401505947 CEST	53	63094	1.1.1.1	192.168.2.17
Aug 27, 2024 17:49:42.069853067 CEST	56821	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:49:42.069993973 CEST	56405	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:49:42.077131987 CEST	53	56821	1.1.1.1	192.168.2.17
Aug 27, 2024 17:49:42.077208042 CEST	53	56405	1.1.1.1	192.168.2.17
Aug 27, 2024 17:49:43.261965036 CEST	65128	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:49:43.262195110 CEST	56529	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:49:43.267693996 CEST	53	51884	1.1.1.1	192.168.2.17
Aug 27, 2024 17:49:43.269740105 CEST	53	65128	1.1.1.1	192.168.2.17
Aug 27, 2024 17:49:43.269820929 CEST	53	56529	1.1.1.1	192.168.2.17
Aug 27, 2024 17:49:47.470825911 CEST	56835	53	192.168.2.17	1.1.1.1
Aug 27, 2024 17:49:47.471029043 CEST	61537	53	192.168.2.17	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 27, 2024 17:49:47.588860035 CEST	192.168.2.17	1.1.1.1	c276	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 27, 2024 17:47:50.574289083 CEST	192.168.2.17	1.1.1.1	0xc476	Standard query (0)	d3k0gij77b1jti.cloudfront.net	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:47:50.587567091 CEST	192.168.2.17	1.1.1.1	0xbcfb	Standard query (0)	d3k0gij77b1jti.cloudfront.net	65	IN (0x0001)	false
Aug 27, 2024 17:47:55.383686066 CEST	192.168.2.17	1.1.1.1	0x958d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:47:55.383872032 CEST	192.168.2.17	1.1.1.1	0xfa71	Standard query (0)	www.google.com	65	IN (0x0001)	false
Aug 27, 2024 17:48:23.262486935 CEST	192.168.2.17	1.1.1.1	0xcc39	Standard query (0)	esd80n7apv.beauty	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:48:23.262687922 CEST	192.168.2.17	1.1.1.1	0x7841	Standard query (0)	esd80n7apv.beauty	65	IN (0x0001)	false
Aug 27, 2024 17:49:42.069853067 CEST	192.168.2.17	1.1.1.1	0x260c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:49:42.069993973 CEST	192.168.2.17	1.1.1.1	0x7a3c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Aug 27, 2024 17:49:43.261965036 CEST	192.168.2.17	1.1.1.1	0xe427	Standard query (0)	lh5.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:49:43.262195110 CEST	192.168.2.17	1.1.1.1	0x2332	Standard query (0)	lh5.googleusercontent.com	65	IN (0x0001)	false
Aug 27, 2024 17:49:47.470825911 CEST	192.168.2.17	1.1.1.1	0x3794	Standard query (0)	pb-logs.media.net	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:49:47.471029043 CEST	192.168.2.17	1.1.1.1	0x66d4	Standard query (0)	pb-logs.media.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 27, 2024 17:47:50.590590000 CEST	1.1.1.1	192.168.2.17	0xc476	No error (0)	d3k0gij77b1jti.cloudfront.net		13.32.118.214	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:47:50.590590000 CEST	1.1.1.1	192.168.2.17	0xc476	No error (0)	d3k0gij77b1jti.cloudfront.net		13.32.118.55	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:47:50.590590000 CEST	1.1.1.1	192.168.2.17	0xc476	No error (0)	d3k0gij77b1jti.cloudfront.net		13.32.118.228	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:47:50.590590000 CEST	1.1.1.1	192.168.2.17	0xc476	No error (0)	d3k0gij77b1jti.cloudfront.net		13.32.118.181	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:47:55.391031027 CEST	1.1.1.1	192.168.2.17	0xfa71	No error (0)	www.google.com			65	IN (0x0001)	false
Aug 27, 2024 17:47:55.392685890 CEST	1.1.1.1	192.168.2.17	0x958d	No error (0)	www.google.com		172.217.23.100	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:48:23.303216934 CEST	1.1.1.1	192.168.2.17	0xcc39	No error (0)	esd80n7apv.beauty		34.197.100.133	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:48:23.303216934 CEST	1.1.1.1	192.168.2.17	0xcc39	No error (0)	esd80n7apv.beauty		54.80.116.239	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:49:42.077131987 CEST	1.1.1.1	192.168.2.17	0x260c	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:49:42.077208042 CEST	1.1.1.1	192.168.2.17	0x7a3c	No error (0)	www.google.com			65	IN (0x0001)	false
Aug 27, 2024 17:49:43.269740105 CEST	1.1.1.1	192.168.2.17	0xe427	No error (0)	lh5.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 17:49:43.269740105 CEST	1.1.1.1	192.168.2.17	0xe427	No error (0)	googlehosted.l.googleusercontent.com		172.217.23.97	A (IP address)	IN (0x0001)	false
Aug 27, 2024 17:49:43.269820929 CEST	1.1.1.1	192.168.2.17	0x2332	No error (0)	lh5.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 17:49:47.485057116 CEST	1.1.1.1	192.168.2.17	0x3794	No error (0)	pb-logs.media.net	star.media.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 17:49:47.588797092 CEST	1.1.1.1	192.168.2.17	0x66d4	No error (0)	pb-logs.media.net	star.media.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

d3k0gij77b1jti.cloudfront.net

https:

www.google.com

esd80n7apv.beauty

evoke-windowsservices-tas.msedge.net

www.bing.com

lh5.googleusercontent.com

23.82.12.31:443

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49767	23.82.12.31	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 17:49:01.851602077 CEST	430	OUT	GET / HTTP/1.1 Host: 23.82.12.31:443 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49768	23.82.12.31	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 17:49:01.852009058 CEST	430	OUT	GET / HTTP/1.1 Host: 23.82.12.31:443 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49770	23.82.12.31	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 17:49:01.852751017 CEST	430	OUT	GET / HTTP/1.1 Host: 23.82.12.31:443 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49771	23.82.12.31	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 17:49:02.893126011 CEST	456	OUT	GET / HTTP/1.1 Host: 23.82.12.31:443 Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49772	23.82.12.31	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 17:49:07.914048910 CEST	456	OUT	GET / HTTP/1.1 Host: 23.82.12.31:443 Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49773	23.82.12.31	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 17:49:07.914347887 CEST	456	OUT	GET / HTTP/1.1 Host: 23.82.12.31:443 Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49774	23.82.12.31	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 17:49:07.915040016 CEST	456	OUT	GET / HTTP/1.1 Host: 23.82.12.31:443 Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49777	23.82.12.31	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 17:49:37.936947107 CEST	456	OUT	GET / HTTP/1.1 Host: 23.82.12.31:443 Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49722	13.32.118.214	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:47:51 UTC	672	OUT	GET / HTTP/1.1 Host: d3k0gij77b1jti.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:47:52 UTC	403	IN	HTTP/1.1 403 Forbidden Content-Type: application/xml Transfer-Encoding: chunked Connection: close x-amz-bucket-region: us-east-1 Server: AmazonS3 Date: Tue, 27 Aug 2024 15:47:51 GMT X-Cache: Error from cloudfront Via: 1.1 a300dbfb49a2eb50edb83038642c9f82.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P1 X-Amz-Cf-Id: 30lcifOdbnZsFPMvl6XqdQJ8zPrsASFgNCvT8i64ZQYffOw5CGjpHw== Vary: Origin
2024-08-27 15:47:52 UTC	249	IN	Data Raw: 66 33 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 36 58 41 35 34 35 42 54 48 37 57 41 53 59 35 57 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 39 67 45 77 38 64 41 4b 43 37 66 77 33 39 6e 46 6a 75 6d 2f 49 49 71 4c 49 6a 52 51 4d 56 78 58 65 55 31 59 6a 30 63 36 41 72 33 2b 41 2b 71 48 39 43 4b 74 64 44 37 31 41 50 67 58 41 39 66 78 62 59 53 6e 2f 36 76 47 35 46 6f 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e 0d 0a Data Ascii: f3<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>6XA545BTH7WASY5W</RequestId><HostId>9gEw8dAKC7fw39nFjum/IIqLIjRQMVxXeU1Yj0c6Ar3+A+qH9CKtdD71APgXA9fxbYSn/6vG5Fo=</HostId></Error>
2024-08-27 15:47:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49724	13.32.118.214	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:47:52 UTC	614	OUT	GET /favicon.ico HTTP/1.1 Host: d3k0gij77b1jti.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://d3k0gij77b1jti.cloudfront.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:47:53 UTC	371	IN	HTTP/1.1 403 Forbidden Content-Type: application/xml Transfer-Encoding: chunked Connection: close Server: AmazonS3 Date: Tue, 27 Aug 2024 15:47:53 GMT X-Cache: Error from cloudfront Via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P1 X-Amz-Cf-Id: 4g9FV9rhzhmsWUP3q9EYQ3w3rg7pB9cvhRdkCTEK6L3Eh1H4QNyFuA== Vary: Origin
2024-08-27 15:47:53 UTC	249	IN	Data Raw: 66 33 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 56 58 59 45 54 51 54 4b 30 57 5a 38 34 47 4a 4a 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 4e 57 53 4e 34 7a 61 41 58 78 34 6d 43 51 72 63 38 6a 6b 6c 38 62 71 71 4f 51 6f 68 5a 4a 59 41 6e 54 6d 70 6b 69 61 4d 68 53 52 55 34 50 68 61 45 79 69 45 44 70 45 2f 6e 4e 6e 44 77 58 70 53 34 71 56 72 52 52 4a 65 38 30 6b 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e 0d 0a Data Ascii: f3<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>VXYETQTK0WZ84GJJ</RequestId><HostId>NWSN4zaAXx4mCQrc8jkl8bqqOQohZJYAnTmpkiaMhSRU4PhaEyiEDpE/nNnDwXpS4qVrRRJe80k=</HostId></Error>
2024-08-27 15:47:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49728	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:11 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:12 UTC	1191	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:11 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-2EtFrd_Wg0-tnx7C3aLlWg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:12 UTC	199	IN	Data Raw: 62 65 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 76 69 64 69 61 20 73 74 6f 63 6b 20 65 61 72 6e 69 6e 67 73 22 2c 22 63 6c 65 76 65 6c 61 6e 64 20 62 72 6f 77 6e 73 22 2c 22 6a 6f 73 68 20 68 6f 6d 6d 65 22 2c 22 72 65 66 6c 65 63 74 20 6f 72 62 69 74 61 6c 20 73 75 6e 6c 69 67 68 74 20 61 66 74 65 72 20 64 61 72 6b 22 2c 22 73 70 61 63 65 78 20 6c 61 75 6e 63 68 20 70 6f 6c 61 72 69 73 20 64 61 77 6e 22 2c 22 6d 61 6e 75 65 6c 20 75 67 61 72 74 65 20 74 72 61 6e 73 66 65 72 20 6e 65 77 73 22 2c 22 6c 69 73 62 6f 6e 20 70 6f 72 74 75 67 61 6c 20 65 61 72 74 68 71 75 61 6b 65 20 74 6f 64 Data Ascii: be0)]}'["",["nvidia stock earnings","cleveland browns","josh homme","reflect orbital sunlight after dark","spacex launch polaris dawn","manuel ugarte transfer news","lisbon portugal earthquake tod
2024-08-27 15:48:12 UTC	1390	IN	Data Raw: 61 79 22 2c 22 63 69 72 71 75 65 20 64 75 20 73 6f 6c 65 69 6c 20 6b 6f 6f 7a 61 20 70 6f 72 74 6c 61 6e 64 20 61 63 63 69 64 65 6e 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 67 76 62 53 38 77 Data Ascii: ay","cirque du soleil kooza portland accident"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CggvbS8w
2024-08-27 15:48:12 UTC	1390	IN	Data Raw: 49 4f 46 5a 79 51 32 70 45 63 6b 64 68 64 33 46 4a 64 46 4e 72 4d 6d 52 68 64 32 70 48 53 6b 56 76 4c 30 6c 76 51 31 6c 6f 64 46 59 7a 63 6c 5a 7a 56 45 56 33 4d 45 78 69 52 43 39 56 5a 33 51 34 53 45 4a 33 63 6b 4a 73 4f 55 4e 4b 64 45 74 75 51 58 4a 59 4e 44 6c 70 56 6e 6c 76 59 6c 41 31 54 57 52 6a 62 48 56 77 4e 56 5a 4e 56 45 64 74 56 32 78 48 53 6d 35 4c 52 55 68 6a 53 56 68 50 62 54 68 4f 55 47 34 7a 64 6a 6c 51 63 46 70 56 52 6c 64 71 51 33 52 42 5a 48 70 4d 55 6b 4e 51 62 57 77 72 54 33 5a 34 59 55 78 53 4e 7a 49 33 5a 6a 6c 5a 61 6d 39 75 51 58 6c 53 4e 45 52 79 4c 31 5a 72 64 55 5a 6e 59 6b 38 30 59 6d 56 74 59 56 68 78 5a 56 4e 6c 4d 6b 6c 4d 62 44 64 4e 4f 46 52 43 5a 6a 59 76 59 6a 5a 30 5a 53 74 61 5a 55 4e 4c 55 6b 74 54 4d 47 78 56 4d 57 Data Ascii: IOFZyQ2pEckdhd3FJdFNrMmRhd2pHSkVvL0lvQ1lodFYzclZzVEV3MExiRC9VZ3Q4SEJ3ckJsOUNKdEtuQXJYNDlpVnlvYlA1TWRjbHVwNVZNVEdtV2xHSm5LRUhjSVhPbThOUG4zdjlQcFpVRldqQ3RBZHpMUkNQbWwrT3Z4YUxSNzI3ZjlZam9uQXlSNERyL1ZrdUZnYk80YmVtYVhxZVNlMklMbDdNOFRCZjYvYjZ0ZStaZUNLUktTMGxVMW
2024-08-27 15:48:12 UTC	68	IN	Data Raw: 56 68 57 55 31 68 70 55 45 45 34 54 32 78 79 53 47 78 58 4d 30 46 32 59 6e 6c 44 51 6d 64 6c 63 53 39 49 52 44 46 79 61 6d 35 33 52 30 64 5a 61 30 34 30 59 32 38 34 53 6d 4a 58 53 6e 42 73 62 54 64 0d 0a Data Ascii: VhWU1hpUEE4T2xySGxXM0F2YnlDQmdlcS9IRDFyam53R0dZa040Y284SmJXSnBsbTd
2024-08-27 15:48:12 UTC	1390	IN	Data Raw: 65 61 32 0d 0a 4c 52 55 4e 73 65 6c 68 79 63 6c 4e 54 64 53 73 79 56 6c 63 76 5a 44 6c 76 55 33 42 59 4e 30 74 58 61 6d 39 6e 65 47 6f 76 65 53 38 30 65 43 39 68 57 6a 52 4e 4e 56 59 76 55 48 68 4f 55 55 46 42 51 55 46 43 53 6c 4a 56 4e 55 56 79 61 30 70 6e 5a 32 63 39 50 54 6f 51 51 32 78 6c 64 6d 56 73 59 57 35 6b 49 45 4a 79 62 33 64 75 63 30 6f 48 49 32 45 7a 4d 6a 59 77 4d 46 49 36 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 45 52 51 4d 56 52 6a 64 33 4a 44 61 45 78 4e 62 55 51 77 52 57 74 71 54 31 4e 54 4d 55 78 36 56 57 35 4e 55 7a 46 47 53 55 74 7a 62 33 5a 36 65 58 4e 48 51 55 67 7a 4d 6b 4e 5a 54 58 41 48 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 6f 76 62 53 38 77 4d Data Ascii: ea2LRUNselhyclNTdSsyVlcvZDlvU3BYN0tXam9neGoveS80eC9hWjRNNVYvUHhOUUFBQUFCSlJVNUVya0pnZ2c9PToQQ2xldmVsYW5kIEJyb3duc0oHI2EzMjYwMFI6Z3Nfc3NwPWVKemo0dERQMVRjd3JDaExNbUQwRWtqT1NTMUx6VW5NUzFGSUtzb3Z6eXNHQUgzMkNZTXAH","zl":10002},{"google:entityinfo":"CgovbS8wM
2024-08-27 15:48:12 UTC	1390	IN	Data Raw: 4f 47 46 31 4e 7a 46 56 63 6a 46 47 54 57 39 77 63 7a 42 6e 51 56 64 6c 62 6d 52 32 5a 47 74 59 62 30 4e 6c 63 57 35 6d 55 7a 52 48 4d 69 73 7a 65 6b 78 71 52 32 52 73 53 31 64 54 61 44 64 5a 53 6b 4e 4d 52 6b 52 79 57 57 4a 44 4e 46 56 78 59 6b 67 76 61 6b 63 77 63 55 51 33 57 46 5a 74 53 53 38 31 56 45 31 76 54 6c 52 56 4f 47 35 36 51 31 4e 50 4c 33 42 78 56 54 64 43 62 44 56 6e 4d 69 39 30 57 58 56 55 4d 47 74 68 64 32 70 56 65 48 68 56 61 6a 41 33 55 6b 70 34 57 6b 56 55 61 46 56 57 54 47 56 35 63 54 46 79 52 6e 5a 45 4d 32 56 69 5a 45 4a 6c 4d 6a 64 58 53 54 5a 7a 63 6d 77 35 55 45 64 72 64 46 52 47 4e 31 4a 57 55 31 64 73 62 47 4e 69 65 55 35 77 4e 55 74 50 5a 7a 4a 42 51 58 5a 7a 51 6a 46 50 4b 30 6c 71 4d 6d 68 61 65 55 46 57 59 6b 30 32 61 47 52 Data Ascii: OGF1NzFVcjFGTW9wczBnQVdlbmR2ZGtYb0NlcW5mUzRHMiszekxqR2RsS1dTaDdZSkNMRkRyWWJDNFVxYkgvakcwcUQ3WFZtSS81VE1vTlRVOG56Q1NPL3BxVTdCbDVnMi90WXVUMGthd2pVeHhVajA3Ukp4WkVUaFVWTGV5cTFyRnZEM2ViZEJlMjdXSTZzcmw5UEdrdFRGN1JWU1dsbGNieU5wNUtPZzJBQXZzQjFPK0lqMmhaeUFWYk02aGR
2024-08-27 15:48:12 UTC	973	IN	Data Raw: 5a 43 52 45 64 76 63 33 4e 61 51 6b 52 6e 54 44 5a 43 63 6d 73 33 62 6d 4a 33 65 48 6b 35 63 6b 74 52 55 32 4a 45 64 6e 64 6c 5a 33 4a 77 54 58 52 36 51 32 78 79 4e 46 4e 6b 5a 45 35 4c 63 32 39 30 65 6b 35 71 59 32 6f 78 52 7a 4e 79 61 57 6c 56 63 46 70 4f 56 47 52 4d 52 48 59 76 59 6c 52 4a 63 46 70 4a 57 48 70 51 53 7a 52 55 53 6b 6c 43 5a 57 56 47 54 32 4a 71 64 6c 68 34 4f 45 39 32 62 6e 70 33 59 30 64 6c 61 45 6c 42 61 31 56 6f 56 55 34 78 54 30 39 79 64 6d 30 34 56 6b 78 72 4e 31 59 32 53 31 6f 77 4e 46 6c 6c 53 6c 56 51 4f 47 31 78 4d 6d 74 45 65 6e 56 4f 4f 47 4d 72 65 6c 52 4c 65 46 68 48 59 6b 31 50 53 45 5a 43 56 6c 4e 59 5a 56 64 48 53 6c 4e 46 59 6e 4a 35 55 46 68 34 64 6e 59 7a 57 55 52 73 4e 69 73 32 4d 45 67 78 5a 54 4e 74 55 6d 4a 4c 56 Data Ascii: ZCREdvc3NaQkRnTDZCcms3bmJ3eHk5cktRU2JEdndlZ3JwTXR6Q2xyNFNkZE5Lc290ek5qY2oxRzNyaWlVcFpOVGRMRHYvYlRJcFpJWHpQSzRUSklCZWVGT2Jqdlh4OE92bnp3Y0dlaElBa1VoVU4xT09ydm04VkxrN1Y2S1owNFllSlVQOG1xMmtEenVOOGMrelRLeFhHYk1PSEZCVlNYZVdHSlNFYnJ5UFh4dnYzWURsNis2MEgxZTNtUmJLV
2024-08-27 15:48:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49729	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:13 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:13 UTC	1231	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:13 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-vxlJ-AheONMrS0hDPLbGFQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:13 UTC	159	IN	Data Raw: 33 34 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 61 6c 6d 61 72 74 20 72 65 63 61 6c 6c 73 20 61 70 70 6c 65 20 6a 75 69 63 65 22 2c 22 6a 61 20 6d 61 72 72 20 63 68 61 73 65 20 62 65 6e 67 61 6c 73 20 63 6f 6e 74 72 61 63 74 22 2c 22 67 65 6e 65 72 61 6c 20 68 6f 73 70 69 74 61 6c 20 73 70 6f 69 6c 65 72 73 20 6e 65 78 74 20 77 65 65 6b 22 2c 22 6e 6f 72 74 68 65 61 73 74 20 6f 68 69 6f 20 73 63 68 6f 6f 6c 20 63 6c 6f 73 69 6e 67 73 20 68 65 61 74 22 2c 22 6e 69 6e 74 Data Ascii: 34c)]}'["",["walmart recalls apple juice","ja marr chase bengals contract","general hospital spoilers next week","northeast ohio school closings heat","nint
2024-08-27 15:48:13 UTC	692	IN	Data Raw: 65 6e 64 6f 20 64 69 72 65 63 74 20 70 61 72 74 6e 65 72 20 73 68 6f 77 63 61 73 65 22 2c 22 6d 69 6e 6e 65 73 6f 74 61 20 73 74 61 74 65 20 66 61 69 72 20 73 74 6f 72 6d 20 64 61 6d 61 67 65 22 2c 22 70 75 6d 70 6b 69 6e 20 73 70 69 63 65 20 6c 61 74 74 65 20 64 75 6e 6b 69 6e 20 64 6f 6e 75 74 73 22 2c 22 70 67 61 20 74 6f 75 72 20 63 68 61 6d 70 69 6f 6e 73 68 69 70 20 32 30 32 34 20 65 61 73 74 20 6c 61 6b 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c Data Ascii: endo direct partner showcase","minnesota state fair storm damage","pumpkin spice latte dunkin donuts","pga tour championship 2024 east lake"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJl
2024-08-27 15:48:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49730	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:14 UTC	657	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd&oit=1&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:15 UTC	1231	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:15 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-OvFQw6qMA9afGdHNZMpnxw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:15 UTC	159	IN	Data Raw: 33 61 63 0d 0a 29 5d 7d 27 0a 5b 22 65 73 64 22 2c 5b 22 65 73 64 22 2c 22 65 73 64 65 61 74 68 22 2c 22 65 73 64 20 6d 65 61 6e 69 6e 67 22 2c 22 65 73 64 20 77 61 22 2c 22 65 73 64 20 6c 6f 67 69 6e 22 2c 22 65 73 64 20 70 65 64 69 61 74 72 69 63 73 22 2c 22 65 73 64 20 77 72 69 73 74 20 73 74 72 61 70 22 2c 22 65 73 64 20 6d 61 74 22 2c 22 65 73 64 20 73 74 72 61 70 22 2c 22 65 73 64 20 73 74 75 64 65 6e 74 20 70 6f 72 74 61 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 Data Ascii: 3ac)]}'["esd",["esd","esdeath","esd meaning","esd wa","esd login","esd pediatrics","esd wrist strap","esd mat","esd strap","esd student portal"],["","","","
2024-08-27 15:48:15 UTC	788	IN	Data Raw: 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 30 76 5a 79 38 78 4d 57 59 77 58 32 4e 6a 61 6e 63 35 45 67 41 79 5a 47 68 30 64 48 42 7a 4f 69 38 76 5a 57 35 6a 63 6e 6c 77 64 47 56 6b 4c 58 52 69 62 6a 41 75 5a 33 4e 30 59 58 52 70 59 79 35 6a 62 32 30 76 61 57 31 68 5a 32 56 7a 50 33 45 39 64 47 4a 75 4f 6b 46 4f 5a 44 6c 48 59 31 4a 6d 4e 6d 78 71 61 56 64 36 61 6b 73 79 51 32 39 4f 59 6d 52 57 4d 31 64 42 65 6e 55 35 54 30 68 47 5a 58 45 Data Ascii: ","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"Cg0vZy8xMWYwX2Njanc5EgAyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1JmNmxqaVd6aksyQ29OYmRWM1dBenU5T0hGZXE
2024-08-27 15:48:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49731	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:15 UTC	658	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd8&oit=1&cp=4&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49732	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:15 UTC	659	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80&oit=1&cp=5&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:16 UTC	1231	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-II2CFQFk3L2SXxVucUHBDw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:16 UTC	159	IN	Data Raw: 32 32 38 0d 0a 29 5d 7d 27 0a 5b 22 65 73 64 38 30 22 2c 5b 22 65 73 64 38 30 30 34 6d 75 74 61 67 22 2c 22 65 73 64 38 30 31 31 6d 75 74 35 67 22 2c 22 65 73 64 20 38 30 34 30 20 6d 75 74 61 67 22 2c 22 65 73 64 38 30 30 34 22 2c 22 65 73 20 38 30 30 30 20 73 74 6f 72 65 66 72 6f 6e 74 22 2c 22 65 73 20 38 30 30 30 74 22 2c 22 65 73 64 20 38 30 30 20 6b 65 79 22 2c 22 65 73 20 38 30 30 30 74 20 6e 6f 61 22 2c 22 65 73 20 38 30 30 30 20 6e 6f 61 22 2c 22 65 73 20 38 30 22 Data Ascii: 228)]}'["esd80",["esd8004mutag","esd8011mut5g","esd 8040 mutag","esd8004","es 8000 storefront","es 8000t","esd 800 key","es 8000t noa","es 8000 noa","es 80"
2024-08-27 15:48:16 UTC	400	IN	Data Raw: 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 33 30 31 2c 31 30 30 30 2c 37 35 30 2c 37 30 30 2c 36 35 30 2c 36 30 31 2c 36 30 30 2c 35 35 32 2c 35 35 31 2c 35 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 35 31 32 5d 2c 5b 35 31 32 5d 2c 5b 35 31 32 2c 31 30 5d 2c 5b 35 31 32 5d 2c 5b 35 31 32 2c 31 30 5d 2c 5b 35 31 32 2c 31 30 5d 2c 5b 35 31 32 2c 31 30 5d 2c 5b 35 31 32 2c 31 30 5d 2c 5b 35 31 32 2c 31 30 5d 2c 5b 35 31 Data Ascii: ],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[1301,1000,750,700,650,601,600,552,551,550],"google:suggestsubtypes":[[512],[512],[512,10],[512],[512,10],[512,10],[512,10],[512,10],[512,10],[51
2024-08-27 15:48:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49734	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:18 UTC	660	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n&oit=1&cp=6&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49735	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:18 UTC	662	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7a&oit=1&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49736	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:19 UTC	663	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7ap&oit=1&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:19 UTC	1231	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-UEoCGll1zQz0Oswj1tJMAg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:19 UTC	159	IN	Data Raw: 31 36 66 0d 0a 29 5d 7d 27 0a 5b 22 65 73 64 38 30 6e 37 61 70 22 2c 5b 22 65 73 64 38 30 31 31 22 2c 22 65 73 64 38 30 32 61 22 2c 22 65 73 64 38 30 31 31 6d 75 74 35 67 22 2c 22 65 73 64 38 30 30 36 22 2c 22 65 73 64 38 30 30 34 6d 75 74 61 67 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 Data Ascii: 16f)]}'["esd80n7ap",["esd8011","esd802a","esd8011mut5g","esd8006","esd8004mutag"],["","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google
2024-08-27 15:48:19 UTC	215	IN	Data Raw: 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 36 30 31 2c 36 30 30 2c 35 35 32 2c 35 35 31 2c 35 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 35 31 32 2c 35 34 36 5d 2c 5b 36 34 39 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: :suggestrelevance":[601,600,552,551,550],"google:suggestsubtypes":[[512,546],[649,546],[512,546],[512,546],[512,546]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":851}]
2024-08-27 15:48:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49737	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:20 UTC	665	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv&oit=1&cp=10&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:20 UTC	1191	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:20 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ndA4Pgo5ZfZJQJSIjbFPig' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:20 UTC	199	IN	Data Raw: 31 37 30 0d 0a 29 5d 7d 27 0a 5b 22 65 73 64 38 30 6e 37 61 70 76 22 2c 5b 22 65 73 64 38 30 31 31 22 2c 22 65 73 64 38 30 32 61 22 2c 22 65 73 64 38 30 31 31 6d 75 74 35 67 22 2c 22 65 73 64 38 30 30 34 6d 75 74 61 67 22 2c 22 65 73 64 38 30 30 36 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 36 30 31 2c 36 30 30 2c 35 35 32 2c 35 35 31 2c 35 35 30 Data Ascii: 170)]}'["esd80n7apv",["esd8011","esd802a","esd8011mut5g","esd8004mutag","esd8006"],["","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,552,551,550
2024-08-27 15:48:20 UTC	176	IN	Data Raw: 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 35 31 32 2c 35 34 36 5d 2c 5b 36 34 39 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 2c 5b 35 31 32 2c 35 34 36 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: ],"google:suggestsubtypes":[[512,546],[649,546],[512,546],[512,546],[512,546]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":851}]
2024-08-27 15:48:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49738	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:21 UTC	667	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.b&oit=1&cp=12&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49739	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:21 UTC	668	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.be&oit=3&cp=13&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49740	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:22 UTC	669	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.bea&oit=1&cp=14&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49741	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:22 UTC	670	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.beau&oit=1&cp=15&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49742	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:22 UTC	672	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=esd80n7apv.beauty&oit=3&cp=17&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:23 UTC	1191	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:23 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-e9o5K44YLvO2QWwh7BsgPA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:23 UTC	143	IN	Data Raw: 38 39 0d 0a 29 5d 7d 27 0a 5b 22 65 73 64 38 30 6e 37 61 70 76 2e 62 65 61 75 74 79 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 74 72 75 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: 89)]}'["esd80n7apv.beauty",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]
2024-08-27 15:48:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49745	34.197.100.133	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:23 UTC	660	OUT	GET / HTTP/1.1 Host: esd80n7apv.beauty Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:23 UTC	253	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 15:48:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 139 Connection: close Access-Control-Allow-Origin: * Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff
2024-08-27 15:48:23 UTC	139	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /</pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49748	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:33 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:34 UTC	1231	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:34 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-q_SOAPQukP1EazLuSQV1QA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:34 UTC	159	IN	Data Raw: 33 32 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 65 61 74 74 6c 65 20 73 65 61 68 61 77 6b 73 20 72 6f 73 74 65 72 22 2c 22 32 30 32 35 20 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 63 6f 6c 61 20 69 6e 63 72 65 61 73 65 22 2c 22 32 30 32 35 20 7a 66 6f 72 63 65 20 7a 31 30 22 2c 22 70 65 74 63 6f 20 6e 61 74 69 6f 6e 61 6c 20 64 6f 67 20 64 61 79 22 2c 22 67 61 72 6d 69 6e 20 66 65 6e 69 78 20 38 20 72 65 76 69 65 77 22 2c 22 6c 61 6b 65 20 6d 61 72 79 20 6c 69 74 Data Ascii: 324)]}'["",["seattle seahawks roster","2025 social security cola increase","2025 zforce z10","petco national dog day","garmin fenix 8 review","lake mary lit
2024-08-27 15:48:34 UTC	652	IN	Data Raw: 74 6c 65 20 6c 65 61 67 75 65 20 77 6f 72 6c 64 20 73 65 72 69 65 73 22 2c 22 73 75 72 70 72 69 73 65 20 61 72 69 7a 6f 6e 61 20 63 69 74 79 20 63 6f 75 6e 63 69 6c 20 6d 65 65 74 69 6e 67 22 2c 22 6d 69 6e 6e 65 73 6f 74 61 20 73 74 61 74 65 20 66 61 69 72 20 73 74 6f 72 6d 20 64 61 6d 61 67 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 Data Ascii: tle league world series","surprise arizona city council meeting","minnesota state fair storm damage"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sugge
2024-08-27 15:48:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49750	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:36 UTC	656	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23&oit=4&cp=2&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.17	49749	40.126.32.140	443

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4788 Host: login.live.com
2024-08-27 15:48:36 UTC	4788	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-27 15:48:37 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 27 Aug 2024 15:47:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: a3623b3e-99ae-4061-ae2d-7589842cb6bd PPServer: PPV: 30 H: PH1PEPF000183BE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 27 Aug 2024 15:48:36 GMT Connection: close Content-Length: 11177
2024-08-27 15:48:37 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49751	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:36 UTC	659	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A&oit=4&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:37 UTC	1191	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:37 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-xOxHd7Xzkz9sexsS1Jehxw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:37 UTC	199	IN	Data Raw: 36 35 36 0d 0a 29 5d 7d 27 0a 5b 22 32 33 3a 22 2c 5b 22 32 33 20 61 6e 64 20 6d 65 22 2c 22 32 33 20 61 6e 64 20 6d 65 22 2c 22 32 33 20 62 6c 61 73 74 22 2c 22 32 33 20 6b 67 20 74 6f 20 6c 62 73 22 2c 22 32 33 20 6d 69 6e 75 74 65 20 74 69 6d 65 72 22 2c 22 32 33 20 63 6d 20 74 6f 20 69 6e 63 68 65 73 22 2c 22 32 33 20 69 6e 20 73 70 61 6e 69 73 68 22 2c 22 32 33 20 6a 75 6d 70 20 73 74 72 65 65 74 22 2c 22 32 33 20 61 6e 20 68 6f 75 72 20 69 73 20 68 6f 77 20 6d 75 63 68 20 61 20 79 65 61 72 22 2c 22 32 33 20 63 65 6c 73 69 75 73 20 74 6f 20 66 61 68 72 65 6e 68 65 69 74 22 5d 2c 5b 22 Data Ascii: 656)]}'["23:",["23 and me","23 and me","23 blast","23 kg to lbs","23 minute timer","23 cm to inches","23 in spanish","23 jump street","23 an hour is how much a year","23 celsius to fahrenheit"],["
2024-08-27 15:48:37 UTC	1390	IN	Data Raw: 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 6f 76 62 53 38 77 4d 6e 4a 66 61 6d 78 73 45 69 45 79 4d 32 46 75 5a 45 31 6c 49 4f 4b 41 6c 43 42 43 61 57 39 30 5a 57 4e 6f 62 6d 39 73 62 32 64 35 49 47 4e 76 62 58 42 68 62 6e 6b 79 5a 47 68 30 64 48 42 7a 4f 69 38 76 5a 57 35 6a 63 6e 6c 77 64 47 56 6b 4c 58 52 69 62 6a 41 75 5a 33 4e 30 59 58 52 70 59 79 35 6a 62 32 30 76 61 57 31 68 5a 32 56 7a 50 33 45 39 64 47 Data Ascii: ","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"CgovbS8wMnJfamxsEiEyM2FuZE1lIOKAlCBCaW90ZWNobm9sb2d5IGNvbXBhbnkyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dG
2024-08-27 15:48:37 UTC	40	IN	Data Raw: 52 59 22 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 31 32 30 33 7d 5d 0d 0a Data Ascii: RY"],"google:verbatimrelevance":1203}]
2024-08-27 15:48:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.17	49752	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:37 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-08-27 15:48:37 UTC	209	IN	HTTP/1.1 400 Bad Request X-MSEdge-Ref: Ref A: 824D4EDFF55C42BB92CF163C1C1F12AC Ref B: EWR311000104021 Ref C: 2024-08-27T15:48:37Z Date: Tue, 27 Aug 2024 15:48:37 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49753	23.73.207.5	443

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:37 UTC	2603	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -240 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAXz4gFP3LXOIznPKU8iEhqKSNb0wVAnJXZ%2B5uInPTtYy4fQigZyvcEUqfsQJ3WUZPuI3hdUQTVhdT1z2bBNztpmsnynJTl7lfR1Ofob8k11hlFXRLehwFAFo9DSbIKq8OvOFeiEK%2BSqsrC0nTIUY7NGu4GWOmLiiDS7ytawm04XUTS6Xh3gkWZKviAcl7CGkIRzFVwdMIVLdmabRPzeb%2Bb4wRWlb4o/r%2BJu5GPJlA%2BZH7AONFS4vJei%2BczZQYMXlZKgLn2zHu5No86vJy%2B%2BDjzHYNwesDgobh6VDtAkJSnYvWMuVp%2BhhC4eDHxooDS69dtPtTKe60lC8%2BmWuo0c3vbgQZgAAECuBvfODLIrM3V1S8UqPQHawAcECzZYmLz9tbtPnQIw3EvyBIv2zQ9N1D54SFsCdAvGi5YwOtSVTt01BJClkjYwrL6lLtP/61Kba2aR7Af9bbHPzD%2BwEq%2BnxNp0sWBMBUr23RGK2y6%2BT7g/CFJ7NWSzON8kV%2BlA0zTIV4i1v9E0r5Xbi9NnEa4CY/mf9sFkzVuWhS8HwJIr2b3XKi69UoPZmMNdyW/xgVlEd%2BuOLhoYPtrgEUY4KjmJUliaqViAPLoRwHgKHqFKCuNfYkgTtuiXsICq2kiqxNVQxZoMi3IcsSWay5ZD4vCQWeKmR3/teVwrqDgtYOZZ0rhG6FfuyQnDrrgr8%2BEUz6ZsgkbH3Jc2e%2B5%2B74A1M6SQdYNVHBg407A%2BRXOEwVGwyWlFTepySFSqHgMMq4K1qE3pPfV8aaBqdiJj0kmHID6bazihmzyYs7pyLuTENyYM5ldg1jiDnzwOL0mHBZdQZuf17PlxoKV%2BKLsbechfZLxXVnaB2M0DJ82kueLxRTPmWh1dH3Q3%2BxFZtZ%2BIr7WhEHnSsCk0m072U7MozYcp1uKRZO [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1724773714 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: C33ECB60C65C4AF6BB8A6E46CF4B40AD X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-08-27 15:48:38 UTC	1148	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 66cdf5560a6346cf9487e37e5a1370fd X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Tue, 27 Aug 2024 15:48:38 GMT Connection: close Set-Cookie: _EDGE_S=SID=0D734F1E925A635B21385BF69373626E&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Sun, 21-Sep-2025 15:48:38 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=0D734F1E925A635B21385BF69373626E; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.869b3e17.1724773718.3f363aca
2024-08-27 15:48:38 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49757	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:40 UTC	664	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A82%3A&oit=4&cp=6&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	49758	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:42 UTC	669	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23%3A82%3A12%3A&oit=4&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:42 UTC	1191	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:42 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-6x_9U9NllZj2fghj1pyQew' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:42 UTC	136	IN	Data Raw: 38 32 0d 0a 29 5d 7d 27 0a 5b 22 32 33 3a 38 32 3a 31 32 3a 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: 82)]}'["23:82:12:",[],[],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggesttype":[],"google:verbatimrelevance":851}]
2024-08-27 15:48:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49759	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:49 UTC	657	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.&oit=4&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	49760	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:49 UTC	658	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.8&oit=4&cp=4&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:50 UTC	1231	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:49 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-IFvKOZK1fFbfXreTYtjVJA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:50 UTC	159	IN	Data Raw: 32 36 36 0d 0a 29 5d 7d 27 0a 5b 22 32 33 2e 38 22 2c 5b 22 32 33 2e 38 22 2c 22 32 33 2e 38 20 6b 67 20 74 6f 20 6c 62 73 22 2c 22 32 33 2e 38 30 20 61 6e 20 68 6f 75 72 20 69 73 20 68 6f 77 20 6d 75 63 68 20 61 20 79 65 61 72 22 2c 22 32 33 2e 38 20 69 6e 63 68 20 6d 6f 6e 69 74 6f 72 22 2c 22 32 33 2e 38 20 63 65 6c 73 69 75 73 20 74 6f 20 66 61 68 72 65 6e 68 65 69 74 22 2c 22 32 33 2e 38 6d 6d 20 74 6f 20 69 6e 63 68 65 73 22 2c 22 32 33 2e 38 35 20 61 6e 20 68 6f 75 Data Ascii: 266)]}'["23.8",["23.8","23.8 kg to lbs","23.80 an hour is how much a year","23.8 inch monitor","23.8 celsius to fahrenheit","23.8mm to inches","23.85 an hou
2024-08-27 15:48:50 UTC	462	IN	Data Raw: 72 20 69 73 20 68 6f 77 20 6d 75 63 68 20 61 20 79 65 61 72 22 2c 22 32 33 2e 38 20 62 6d 69 22 2c 22 32 33 2e 38 34 20 61 6e 20 68 6f 75 72 20 69 73 20 68 6f 77 20 6d 75 63 68 20 61 20 79 65 61 72 22 2c 22 32 33 2e 38 2f 32 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 33 30 30 2c 36 30 31 2c 36 30 30 2c 35 35 36 2c 35 35 35 2c 35 35 34 2c 35 35 33 2c 35 35 32 2c 35 35 31 2c 35 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b Data Ascii: r is how much a year","23.8 bmi","23.84 an hour is how much a year","23.8/2"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[1300,601,600,556,555,554,553,552,551,550],"google:suggestsubtypes":[
2024-08-27 15:48:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	49761	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:50 UTC	659	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82&oit=4&cp=5&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:50 UTC	1226	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:50 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-IDEeXvBL64GxxnjOeRhTMA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:50 UTC	164	IN	Data Raw: 32 37 62 0d 0a 29 5d 7d 27 0a 5b 22 32 33 2e 38 32 22 2c 5b 22 32 33 2e 38 32 22 2c 22 32 33 2e 38 32 20 61 6e 20 68 6f 75 72 20 69 73 20 68 6f 77 20 6d 75 63 68 20 61 20 79 65 61 72 22 2c 22 32 33 2e 38 32 20 62 6d 69 22 2c 22 32 33 2e 38 32 20 68 6f 75 72 73 22 2c 22 32 33 2e 38 32 20 69 6e 63 68 65 73 22 2c 22 32 33 2e 38 32 20 75 73 64 20 74 6f 20 63 61 64 22 2c 22 32 33 2e 38 32 36 20 74 6f 20 74 68 65 20 6e 65 61 72 65 73 74 20 77 68 6f 6c 65 20 6e 75 6d 62 65 72 22 2c 22 32 33 2e Data Ascii: 27b)]}'["23.82",["23.82","23.82 an hour is how much a year","23.82 bmi","23.82 hours","23.82 inches","23.82 usd to cad","23.826 to the nearest whole number","23.
2024-08-27 15:48:50 UTC	478	IN	Data Raw: 38 32 36 20 74 6f 20 74 77 6f 20 64 65 63 69 6d 61 6c 20 70 6c 61 63 65 73 22 2c 22 32 33 2e 38 32 36 20 74 6f 20 33 20 73 69 67 6e 69 66 69 63 61 6e 74 20 66 69 67 75 72 65 73 22 2c 22 32 33 2e 38 32 36 20 74 6f 20 74 68 72 65 65 20 73 69 67 6e 69 66 69 63 61 6e 74 20 66 69 67 75 72 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 33 30 30 2c 31 32 35 31 2c 31 32 35 30 2c 36 35 31 2c 36 35 30 2c 36 30 31 2c 36 30 30 2c 35 35 32 2c 35 35 31 2c 35 35 30 5d 2c 22 67 Data Ascii: 826 to two decimal places","23.826 to 3 significant figures","23.826 to three significant figures"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[1300,1251,1250,651,650,601,600,552,551,550],"g
2024-08-27 15:48:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	49763	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:51 UTC	662	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12&oit=4&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:51 UTC	1231	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:51 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Lth-IYmbtjsnQ9RQAa8tiA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:51 UTC	134	IN	Data Raw: 38 30 0d 0a 29 5d 7d 27 0a 5b 22 32 33 2e 38 32 2e 31 32 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 74 72 75 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: 80)]}'["23.82.12",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]
2024-08-27 15:48:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	49764	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:52 UTC	663	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12.&oit=4&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.17	49765	172.217.23.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:48:52 UTC	666	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=23.82.12.31&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:48:52 UTC	1191	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:48:52 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-DTKGjgQGZ8guhHipk9Mvhg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:48:52 UTC	137	IN	Data Raw: 38 33 0d 0a 29 5d 7d 27 0a 5b 22 32 33 2e 38 32 2e 31 32 2e 33 31 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 74 72 75 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: 83)]}'["23.82.12.31",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]
2024-08-27 15:48:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.17	49780	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:42 UTC	656	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb&oit=1&cp=2&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:49:43 UTC	1231	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:49:42 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tyExR_LPvy_STKmbtreQmw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:49:43 UTC	159	IN	Data Raw: 38 30 32 0d 0a 29 5d 7d 27 0a 5b 22 70 62 22 2c 5b 22 70 62 73 22 2c 22 70 62 73 20 6b 69 64 73 22 2c 22 70 62 69 73 22 2c 22 70 62 73 20 6b 69 64 73 20 67 61 6d 65 73 22 2c 22 70 62 69 73 20 72 65 77 61 72 64 73 22 2c 22 70 62 73 20 6e 65 77 73 68 6f 75 72 22 2c 22 70 62 73 20 6b 69 64 73 20 76 69 64 65 6f 73 22 2c 22 70 62 73 20 67 61 6d 65 73 22 2c 22 70 62 73 63 22 2c 22 70 62 69 73 20 6c 6f 67 69 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 Data Ascii: 802)]}'["pb",["pbs","pbs kids","pbis","pbs kids games","pbis rewards","pbs newshour","pbs kids videos","pbs games","pbsc","pbis login"],["","","","","","","
2024-08-27 15:49:43 UTC	1390	IN	Data Raw: 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 67 76 62 53 38 77 4e 58 68 69 65 42 49 66 51 6e 4a 76 59 57 52 6a 59 58 4e 30 61 57 35 6e 49 48 52 6c 62 47 56 32 61 58 4e 70 62 32 34 67 62 6d 56 30 64 32 39 79 61 7a 4a 6b 61 48 52 30 63 48 4d 36 4c 79 39 6c 62 6d 4e 79 65 58 42 30 5a 57 51 74 64 47 4a 75 4d 43 35 6e 63 33 52 68 64 47 6c 6a 4c 6d 4e 76 62 53 39 70 62 57 46 6e 5a 58 4d 2f 63 54 31 30 59 6d 34 36 51 55 35 6b 4f 55 64 6a 55 30 38 33 55 46 56 46 57 48 4e 79 54 47 35 Data Ascii: ","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{"google:entityinfo":"CggvbS8wNXhieBIfQnJvYWRjYXN0aW5nIHRlbGV2aXNpb24gbmV0d29yazJkaHR0cHM6Ly9lbmNyeXB0ZWQtdGJuMC5nc3RhdGljLmNvbS9pbWFnZXM/cT10Ym46QU5kOUdjU083UFVFWHNyTG5
2024-08-27 15:49:43 UTC	508	IN	Data Raw: 46 69 4e 47 52 58 4e 43 5a 7a 50 54 45 77 4f 67 52 77 59 6e 4e 6a 53 67 63 6a 4e 44 45 33 4d 57 45 7a 55 69 74 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 46 41 78 56 47 56 33 54 6b 4e 7a 63 30 31 36 52 6d 63 35 52 30 6c 77 55 30 4e 77 54 30 4a 6e 51 58 42 42 55 56 52 42 63 42 46 77 46 33 41 5a 22 7d 2c 7b 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 31 2c 31 32 35 30 2c 36 30 31 2c 36 30 30 2c 35 35 35 2c 35 35 34 2c 35 35 33 2c 35 35 32 2c 35 35 31 2c 35 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 35 31 32 2c 34 33 33 2c 31 33 31 2c 31 39 39 2c 34 36 35 5d 2c 5b 35 31 32 2c 34 33 33 2c 31 33 31 5d 2c 5b 35 31 32 2c 34 33 33 2c 31 33 31 5d 2c Data Ascii: FiNGRXNCZzPTEwOgRwYnNjSgcjNDE3MWEzUitnc19zc3A9ZUp6ajR0VFAxVGV3TkNzc016Rmc5R0lwU0NwT0JnQXBBUVRBcBFwF3AZ"},{}],"google:suggestrelevance":[1251,1250,601,600,555,554,553,552,551,550],"google:suggestsubtypes":[[512,433,131,199,465],[512,433,131],[512,433,131],
2024-08-27 15:49:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.17	49781	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:43 UTC	657	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-&oit=1&cp=3&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:49:43 UTC	1231	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:49:43 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-76fQlrxh1urOIHPMi5fcUg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:49:43 UTC	159	IN	Data Raw: 63 32 66 0d 0a 29 5d 7d 27 0a 5b 22 70 62 2d 22 2c 5b 22 70 62 2d 35 38 30 74 22 2c 22 70 62 2d 35 38 30 74 22 2c 22 70 62 2d 32 35 32 30 22 2c 22 70 62 2d 31 30 30 30 22 2c 22 70 62 2d 39 30 31 30 74 22 2c 22 70 62 2d 32 30 30 30 22 2c 22 70 62 2d 32 35 30 6c 6e 22 2c 22 70 62 2d 37 35 35 73 74 22 2c 22 70 62 2d 37 37 30 74 22 2c 22 70 62 2d 32 36 32 30 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 Data Ascii: c2f)]}'["pb-",["pb-580t","pb-580t","pb-2520","pb-1000","pb-9010t","pb-2000","pb-250ln","pb-755st","pb-770t","pb-2620"],["","","","","","","","","",""],[],{"
2024-08-27 15:49:43 UTC	1390	IN	Data Raw: 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 30 76 5a 79 38 78 4d 57 4d 78 63 6e 51 31 58 7a 56 6f 45 68 35 46 51 30 68 50 49 46 42 43 4c 54 55 34 4d 46 52 42 51 53 44 69 67 4a 51 67 54 47 56 68 5a 69 42 69 62 47 39 33 5a 58 49 79 5a 47 68 30 64 48 42 7a 4f 69 38 76 5a 57 35 6a 63 6e 6c 77 64 47 56 6b 4c 58 52 69 62 6a 41 75 5a 33 4e 30 59 58 52 70 59 79 35 6a 62 32 30 76 61 57 31 68 5a 32 56 7a 50 33 45 39 64 47 4a 75 4f 6b 46 4f 5a 44 6c 48 59 31 52 6f 55 6b 31 4b 51 30 67 74 4c 56 64 66 59 6a 6c 34 57 6e 56 74 55 Data Ascii: google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"Cg0vZy8xMWMxcnQ1XzVoEh5FQ0hPIFBCLTU4MFRBQSDigJQgTGVhZiBibG93ZXIyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1RoUk1KQ0gtLVdfYjl4WnVtU
2024-08-27 15:49:43 UTC	1390	IN	Data Raw: 79 45 67 6c 54 64 57 4a 33 62 32 39 6d 5a 58 49 79 5a 47 68 30 64 48 42 7a 4f 69 38 76 5a 57 35 6a 63 6e 6c 77 64 47 56 6b 4c 58 52 69 62 6a 41 75 5a 33 4e 30 59 58 52 70 59 79 35 6a 62 32 30 76 61 57 31 68 5a 32 56 7a 50 33 45 39 64 47 4a 75 4f 6b 46 4f 5a 44 6c 48 59 31 46 75 59 6c 6c 4b 64 30 39 57 52 58 42 48 55 57 39 61 5a 47 4d 31 53 55 4e 5a 54 58 56 4e 59 30 74 69 5a 47 4a 7a 61 6b 63 79 61 30 5a 4d 55 45 38 33 63 33 68 46 4a 6e 4d 39 4d 54 41 36 43 31 4e 57 55 79 42 51 51 69 30 79 4d 44 41 77 53 67 63 6a 4e 44 49 30 4d 6a 51 79 55 6a 56 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 6c 41 78 65 6d 4d 77 56 45 52 4a 64 6b 31 78 64 57 39 35 61 57 74 35 57 56 42 53 61 55 77 77 61 6c 4e 4f 56 45 6c 33 54 55 46 42 51 56 59 31 4e 45 64 72 64 33 Data Ascii: yEglTdWJ3b29mZXIyZGh0dHBzOi8vZW5jcnlwdGVkLXRibjAuZ3N0YXRpYy5jb20vaW1hZ2VzP3E9dGJuOkFOZDlHY1FuYllKd09WRXBHUW9aZGM1SUNZTXVNY0tiZGJzakcya0ZMUE83c3hFJnM9MTA6C1NWUyBQQi0yMDAwSgcjNDI0MjQyUjVnc19zc3A9ZUp6ajR0VlAxemMwVERJdk1xdW95aWt5WVBSaUwwalNOVEl3TUFBQVY1NEdrd3
2024-08-27 15:49:43 UTC	187	IN	Data Raw: 36 31 33 5d 2c 5b 35 31 32 2c 36 31 33 5d 2c 5b 35 31 32 2c 36 31 33 5d 2c 5b 35 31 32 2c 36 31 33 5d 2c 5b 35 31 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: 613],[512,613],[512,613],[512,613],[512]],"google:suggesttype":["QUERY","ENTITY","ENTITY","ENTITY","ENTITY","ENTITY","ENTITY","ENTITY","ENTITY","QUERY"],"google:verbatimrelevance":851}]
2024-08-27 15:49:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.17	49785	172.217.23.97	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:43 UTC	406	OUT	GET /p/AF1QipM1AF06CxaMLr3ogY34t4eZnkQ0EgX3PGYL8Iua=w92-h92-n-k-no HTTP/1.1 Host: lh5.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:49:44 UTC	533	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="unnamed.jpg" X-Content-Type-Options: nosniff Server: fife Content-Length: 7677 X-XSS-Protection: 0 Date: Tue, 27 Aug 2024 12:07:22 GMT Expires: Wed, 28 Aug 2024 12:07:22 GMT Cache-Control: public, max-age=86400, no-transform Age: 13342 ETag: "vc" Content-Type: image/jpeg Vary: Origin Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-27 15:49:44 UTC	857	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 8a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 04 00 0e 01 02 00 17 00 00 00 3e 00 00 00 31 01 02 00 07 00 00 00 55 00 00 00 3b 01 02 00 0b 00 00 00 5c 00 00 00 98 82 02 00 1a 00 00 00 67 00 00 00 00 00 00 00 4f 4c 59 4d 50 55 53 20 44 49 47 49 54 41 4c 20 43 41 4d 45 52 41 00 47 6f 6f 67 6c 65 00 5a 61 63 68 20 53 74 72 61 77 00 5a 61 63 68 61 72 79 20 53 74 72 61 77 20 50 68 6f 74 6f 67 72 61 70 68 79 00 00 ff e1 02 d1 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 Data Ascii: JFIFExifII*>1U;\gOLYMPUS DIGITAL CAMERAGoogleZach StrawZachary Straw Photographyhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpme
2024-08-27 15:49:44 UTC	1390	IN	Data Raw: 65 74 61 3e 20 20 20 3c 3f 78 70 61 63 6b 65 74 20 65 6e 64 3d 22 77 22 3f 3e ff db 00 84 00 03 02 02 09 09 02 0b 0a 0d 0f 0d 0b 0f 0b 08 0a 0e 0a 0e 0a 08 0a 08 0a 0b 0b 09 10 0b 0b 0d 09 0a 0b 0a 0b 0a 0a 0f 0a 0e 0a 08 08 08 0d 0d 08 08 0a 0a 0a 0a 0d 0b 0b 0d 0b 08 0d 0a 0b 0a 0d 01 03 04 04 06 05 06 0a 06 06 0a 10 0e 0b 0e 10 0f 0f 10 10 10 12 0f 0d 10 0f 0f 10 10 10 10 0f 10 10 10 0f 10 0e 10 0d 10 10 10 11 0f 0e 0d 0f 0f 0d 10 0f 10 0f 10 10 0f 0f 0d 0d 10 0f 0f 0d 0e ff c0 00 11 08 00 5c 00 5c 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 05 07 03 06 08 04 01 02 ff c4 00 46 10 00 02 02 00 04 04 03 05 03 06 09 0d 00 00 00 00 01 02 03 11 04 05 12 21 00 06 07 31 13 22 41 08 14 32 51 71 23 61 81 24 33 42 Data Ascii: eta> <?xpacket end="w"?>\\F!1"A2Qq#a$3B
2024-08-27 15:49:44 UTC	1390	IN	Data Raw: 5c c4 17 31 9f 6c 48 08 1f 6c 49 d0 9b e6 d2 67 50 26 d7 14 0e 5a e7 a6 4c ea 9e c0 f1 1b 4b 35 33 85 6b d2 b2 11 df ba 92 6d 87 ef 6e 16 b6 ef d0 ae 8c 1a 9d c3 2b 32 82 7b c9 d3 34 0b 94 9e 26 09 ca 7a 4e ea 60 d9 3f 5c 34 e6 29 2c 3e 92 12 a5 42 55 ac 49 b0 50 d7 80 cd c7 70 1d ea 83 17 95 e6 43 10 f8 d5 89 da 05 21 3c 41 87 94 c5 41 82 bb 6b 5b 5b 4f 31 66 ad 0b 4c a6 9b 57 1c b5 18 44 a9 84 82 0d ef a8 bd 8c 79 ff 00 34 fa ac 62 92 e9 80 0c 5a 6f 61 37 df bb 7d a9 e9 90 41 8e fe 09 a2 c7 c3 8b c5 61 c9 0c d0 61 57 dd 66 c2 b0 5d 64 89 5a 44 12 b0 6f 06 56 71 ad 0c 69 41 7c 36 1a 8d a8 c0 b4 86 06 64 82 4e a6 e0 c7 28 36 31 7d 0d f5 9a cd 77 dd 26 4f 84 47 8c 8b f0 37 d3 48 a9 b3 7e 7c c2 e6 38 37 57 c4 89 63 8f 08 0c 71 61 33 0c 44 13 45 31 69 19 e4 Data Ascii: \1lHlIgP&ZLK53kmn+2{4&zN`?\4),>BUIPpC!<AAk[[O1fLWDy4bZoa7}AaaWf]dZDoVqiA\|6dN(61}w&OG7H~\|87Wcqa3DE1i
2024-08-27 15:49:44 UTC	1390	IN	Data Raw: e4 a3 0a ac 72 40 91 78 0b 14 88 ee 9a 61 5d 21 64 44 b5 60 40 43 a6 51 a5 b7 36 8b 72 71 a3 1c f3 8a 54 12 46 fb 7c f0 f6 a5 ed 9b 84 41 6f 30 00 99 8b ee f9 af bd 65 0c d3 01 96 c3 ed 15 88 87 17 e5 81 a2 98 2d 49 26 1d 23 9e c3 46 49 42 58 20 48 e5 88 2b 38 52 c5 43 32 90 08 66 d9 6e 95 b0 95 4d 2b ed 46 bb 3c 42 92 9e 3b aa bf d2 fc be 36 eb 2c 92 47 6b 04 33 e2 8e 1d a9 9c 34 7a de 38 55 5d a8 b1 f0 99 58 9b 2e 40 a2 3c e4 f1 5e d5 78 06 14 91 a9 b7 bd 59 b2 d9 52 9e 4a c8 b0 bf f1 5b 9f 2c eb bb c7 d0 b0 e0 48 5a 08 4c 63 41 8c 40 34 06 45 d6 c5 81 5a 56 56 2a c8 c5 87 c3 a4 ec 14 82 c2 93 92 ff 00 05 39 e4 ca 4b 86 38 fe 6b 31 cb 2e 69 98 41 ee 78 59 23 65 8a 07 2a 8e d8 78 e4 55 01 8c b1 c7 2c e2 cd 05 69 1b ed 83 22 9d 4a 42 03 a5 87 65 b6 d2 9b Data Ascii: r@xa]!dD`@CQ6rqTF\|Ao0e-I&#FIBX H+8RC2fnM+F<B;6,Gk34z8U]X.@<^xYRJ[,HZLcA@4EZVV9K8k1.iAxY#exU,i"JBe
2024-08-27 15:49:44 UTC	1390	IN	Data Raw: 8c 06 28 06 f7 8c 14 9a 3d d2 48 e6 00 92 a3 c5 5f 79 8e 32 b2 23 2a 6e f0 85 65 62 55 a6 d2 47 01 c9 56 58 48 1a 8d 7f 78 27 42 6d a1 31 24 6a 08 e5 04 cf cf 2d 3c 75 17 8d f3 57 f6 80 f6 8d 7c e7 29 44 78 d5 3c 29 de 45 7d 43 51 0c 19 74 32 28 08 01 f2 39 2a 6c 11 a0 16 03 51 91 09 dd 52 12 2f 40 70 f8 cf f4 82 17 4d aa 36 65 d4 06 c5 c1 f2 d7 62 2d 59 49 d2 2f ee da 80 1b 25 51 ca 9b d2 65 69 9e 06 81 f3 37 3d e2 9f 3e 92 a5 94 00 ec a0 2c f2 22 e9 1b 69 a0 c0 69 f2 8b 15 44 80 4d 90 38 30 da 41 42 64 0b 5c 72 31 a8 e0 60 91 23 71 23 43 4a cf 99 71 67 99 a0 79 2e 24 8c de b6 f3 47 2e bb 03 70 11 98 7d 7c ea 9f 3f 2d fa 5f 12 76 e9 33 5f 30 48 58 8a 8b 05 23 47 8f d4 84 a3 02 69 91 8a 38 3b fc 2e b4 c2 be e2 08 e2 f6 89 ca 2b c7 c2 73 db e1 af 89 b5 34 Data Ascii: (=H_y2#nebUGVXHx'Bm1$j-<uW\|)Dx<)E}CQt2(9lQR/@pM6eb-YI/%Qei7=>,"iiDM80ABd\r1`#q#CJqgy.$G.p}\|?-_v3_0HX#Gi8;.+s4
2024-08-27 15:49:44 UTC	1260	IN	Data Raw: 28 fa f1 d6 5a db 78 77 52 17 98 09 e2 40 34 82 ad 94 e3 67 20 1a 5a 8a 74 5f 9c f0 99 6e 0f 14 5c 00 26 c1 49 19 25 fc 37 28 ea fa 95 7f 49 99 dd 60 8f 4a dd 83 7d 87 1c 8f 69 36 a5 04 36 d7 1b fe 35 fc d7 46 d8 ee 34 82 e3 8f 46 82 27 c6 63 8c d8 5a f5 9b 33 75 d3 95 a2 7e aa ad fd 4f f8 6f c6 b5 9e f5 07 03 bb 47 72 87 be 9f 91 b8 b9 47 ad 07 a6 1d e8 ee 05 56 fe ab 7f 23 c0 d8 3f aa 1d 3c ad f3 ce b7 05 7f f9 88 e7 e7 7a f3 1b 8a fe 37 41 7f a0 6e fd 0d 76 3f 4a f5 fa f6 e0 c4 de 87 51 be 6d c5 83 ca e0 7a 93 18 36 68 81 77 b7 cf f3 60 7a 6d 66 cd 71 53 e7 fd 54 0e 4a 3e 83 dc d5 8d 8e e2 cf 34 8f 7f 61 51 f2 6c 8c d9 43 26 f5 a6 d2 87 fb 4e 1b b6 f7 74 4d ed db bf 16 e1 8f 79 69 1a db d0 55 4e fd a9 3b af ea 6a d9 36 24 b7 2f 29 3d c5 fd 76 d8 9f da Data Ascii: (ZxwR@4g Zt_n\&I%7(I`J}i665F4F'cZ3u~OoGrGV#?<z7Anv?JQmz6hw`zmfqSTJ>4aQlC&NtMyiUN;j6$/)=v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.17	49789	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:44 UTC	661	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs&oit=1&cp=7&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.17	49790	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:44 UTC	662	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.&oit=1&cp=8&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.17	49792	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:44 UTC	663	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.m&oit=1&cp=9&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.17	49795	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:45 UTC	665	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.me&oit=3&cp=10&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.17	49796	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:45 UTC	666	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.med&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.17	49799	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:45 UTC	666	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.med&oit=3&cp=11&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.17	49800	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:46 UTC	667	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.medi&oit=1&cp=12&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.17	49801	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:46 UTC	668	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media&oit=3&cp=13&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.17	49802	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:46 UTC	669	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.&oit=3&cp=14&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.17	49803	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:46 UTC	670	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.n&oit=1&cp=15&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.17	49804	142.250.186.100	443	6160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 15:49:47 UTC	672	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=pb-logs.media.net&oit=3&cp=17&pgcl=4&gs_rn=42&psi=62JYTPuu1jgnXuqn&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 15:49:47 UTC	1191	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 15:49:47 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-AJkH6pkw2AfPVPIkFfj7EA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-08-27 15:49:47 UTC	143	IN	Data Raw: 38 39 0d 0a 29 5d 7d 27 0a 5b 22 70 62 2d 6c 6f 67 73 2e 6d 65 64 69 61 2e 6e 65 74 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 74 72 75 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: 89)]}'["pb-logs.media.net",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]
2024-08-27 15:49:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	11:47:48
Start date:	27/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://d3k0gij77b1jti.cloudfront.net/
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:47:49
Start date:	27/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1928,i,11253576738177546024,6209397194130133784,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://esd80n7apv.beauty/	HTTP Parser: No favicon
Source: https://pb-logs.media.net/	HTTP Parser: No favicon

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://d3k0gij77b1jti.cloudfront.net

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Windows Analysis Report
https://d3k0gij77b1jti.cloudfront.net