Edit tour

Windows Analysis Report
http://creationtch.com

Overview

General Information

Sample URL:	http://creationtch.com
Analysis ID:	1523492
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1940,i,6973925189769928710,6796612593531634411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://creationtch.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: http://www.creationtch.com/

HTTP Parser: Base64 decoded: cre=1727795916&tcid=www.creationtch.com66fc12cc6d4f74.99552610&task=search&domain=creationtch.com&a_id=1&session=dDmDs3kkMvN3GbMh-Pcs&trackquery=1

Source: http://www.creationtch.com/	HTTP Parser: No favicon
Source: http://www.creationtch.com/	HTTP Parser: No favicon
Source: http://www.creationtch.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49742 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.creationtch.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /templates/images/hero_nc.svg HTTP/1.1Host: img.sedoparking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://www.creationtch.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /templates/images/hero_nc.svg HTTP/1.1Host: img.sedoparking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/ads/i/iframe.html HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: http://www.creationtch.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/ads?adsafe=low&adtest=off&psid=3259787283&channel=exp-0051%2Cauxa-control-1%2C44786252&client=dp-sedo80_3ph&r=m&hl=en&ivt=1&rpbu=http%3A%2F%2Fwww.creationtch.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjc3OTU5MTYmdGNpZD13d3cuY3JlYXRpb250Y2guY29tNjZmYzEyY2M2ZDRmNzQuOTk1NTI2MTAmdGFzaz1zZWFyY2gmZG9tYWluPWNyZWF0aW9udGNoLmNvbSZhX2lkPTMmc2Vzc2lvbj1kRG1EczNra012TjNHYk1oLVBjcw%3D%3D&type=3&uiopt=false&swp=as-drid-2280784292183247&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=8001727795916463&num=0&output=afd_ads&domain_name=www.creationtch.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1727795916468&u_w=1280&u_h=1024&biw=1263&bih=907&psw=1263&psh=1146&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&nfp=1&jsv=678245571&rurl=http%3A%2F%2Fwww.creationtch.com%2F HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: http://www.creationtch.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?pac=0 HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://syndicatedsearch.goog/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?pac=0 HTTP/1.1Host: syndicatedsearch.googConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2 HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://syndicatedsearch.goog/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://syndicatedsearch.goog/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=cufb1kveew19&aqid=zhL8Zqy0JrGhxdwPktzPsQ0&psid=3259787283&pbt=bs&adbx=385.203125&adby=413.015625&adbh=571&adbw=493&adbah=212%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo80_3ph&errv=678245571&csala=8%7C0%7C1224%7C1232%7C29&lle=0&ifv=1&hpt=0 HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://www.creationtch.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2 HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=xa37wg2xt4y0&aqid=zhL8Zqy0JrGhxdwPktzPsQ0&pbt=bs&adbx=481.5&adby=986.015625&adbh=16&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo80_3ph&errv=678245571&csala=3%7C0%7C1229%7C1232%7C29&lle=0&ifv=0&hpt=0 HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://www.creationtch.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=vk7amg39g97w&aqid=zhL8Zqy0JrGhxdwPktzPsQ0&psid=3259787283&pbt=bv&adbx=385.203125&adby=413.015625&adbh=571&adbw=493&adbah=212%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo80_3ph&errv=678245571&csala=8%7C0%7C1224%7C1232%7C29&lle=0&ifv=1&hpt=0 HTTP/1.1Host: syndicatedsearch.googConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://www.creationtch.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eRHCpk4Rnu28O7z&MD=CXskTKKm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eRHCpk4Rnu28O7z&MD=CXskTKKm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: creationtch.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.creationtch.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /templates/bg/arrows-curved.png HTTP/1.1Host: img.sedoparking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.creationtch.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /templates/bg/arrows-curved.png HTTP/1.1Host: img.sedoparking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /search/tsc.php?ses=ogcSA4H0k2oRlqNjppsa16mMM6tGSicreVZ4J2GgFLbXnWlTQ-bNCtQ8Ma-6Ai86Oj6TRrbkuGpbHKKRoqOrYn76CgMdPyQOeK-9bYtObn0cDJ2x5fmZqo452a1GqZswqaq95CxXMekLC4HBI1v5NiBhw1hVaAFV2haooO-WzxgR7PaCjsUJbW9cwEg8LhsGn996kmo8EGF6oLoUXAIPu1Tvu4jUMcknC7wEOlte1-v4A-998OqE-0H8fAbR75BfU-BpnloE2Gok3cDdWmFO_nKuM9GaEDiB-FofTPeB8Zj14nEn8S7Z39cDHr08vRgPIzRGQq3iaNtJ0-dGGPM5z6AzCfMhcQEnHAvxmDJSUG8FlF0p22RNs3CqkI7&cv=2 HTTP/1.1Host: www.creationtch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.creationtch.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /search/tsc.php?ses=ogcSA4H0k2oRlqNjppsa16mMM6tGSicreVZ4J2GgFLbXnWlTQ-bNCtQ8Ma-6Ai86Oj6TRrbkuGpbHKKRoqOrYn76CgMdPyQOeK-9bYtObn0cDJ2x5fmZqo452a1GqZswqaq95CxXMekLC4HBI1v5NiBhw1hVaAFV2haooO-WzxgR7PaCjsUJbW9cwEg8LhsGn996kmo8EGF6oLoUXAIPu1Tvu4jUMcknC7wEOlte1-v4A-998OqE-0H8fAbR75BfU-BpnloE2Gok3cDdWmFO_nKuM9GaEDiB-FofTPeB8Zj14nEn8S7Z39cDHr08vRgPIzRGQq3iaNtJ0-dGGPM5z6AzCfMhcQEnHAvxmDJSUG8FlF0p22RNs3CqkI7&cv=2 HTTP/1.1Host: www.creationtch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /templates/logos/sedo_logo.png HTTP/1.1Host: img.sedoparking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.creationtch.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /templates/logos/sedo_logo.png HTTP/1.1Host: img.sedoparking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: creationtch.com
Source: global traffic	DNS traffic detected: DNS query: www.creationtch.com
Source: global traffic	DNS traffic detected: DNS query: img.sedoparking.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: syndicatedsearch.goog
Source: global traffic	DNS traffic detected: DNS query: afs.googleusercontent.com

Source: chromecache_67.1.dr, chromecache_73.1.dr, chromecache_72.1.dr, chromecache_83.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=
Source: chromecache_67.1.dr, chromecache_73.1.dr, chromecache_72.1.dr, chromecache_83.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_67.1.dr, chromecache_73.1.dr, chromecache_72.1.dr, chromecache_83.1.dr	String found in binary or memory: https://partner.googleadservices.com/gampad/cookie.js
Source: chromecache_67.1.dr, chromecache_73.1.dr, chromecache_72.1.dr, chromecache_83.1.dr	String found in binary or memory: https://syndicatedsearch.goog
Source: chromecache_67.1.dr, chromecache_73.1.dr, chromecache_72.1.dr, chromecache_83.1.dr	String found in binary or memory: https://www.google.com/pagead/1p-conversion/16521530460/?gad_source=1&adview_type=5
Source: chromecache_67.1.dr, chromecache_73.1.dr, chromecache_72.1.dr, chromecache_83.1.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/16521530460/?gad_source=1&adview_type=3

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49742 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/38@30/14

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1940,i,6973925189769928710,6796612593531634411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://creationtch.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1940,i,6973925189769928710,6796612593531634411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://syndicatedsearch.goog	0%	URL Reputation	safe
https://syndicatedsearch.goog/adsense/domains/caf.js?pac=0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
creationtch.com	192.64.119.117	true	false	unknown
vip1.g5.cachefly.net	204.93.142.142	true	false	unknown
syndicatedsearch.goog	142.250.186.46	true	false	unknown
parkingpage.namecheap.com	91.195.240.19	true	false	unknown
www.google.com	216.58.206.36	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	unknown
img.sedoparking.com	unknown	unknown	false	unknown
afs.googleusercontent.com	unknown	unknown	false	unknown
www.creationtch.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://syndicatedsearch.goog/afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=cufb1kveew19&aqid=zhL8Zqy0JrGhxdwPktzPsQ0&psid=3259787283&pbt=bs&adbx=385.203125&adby=413.015625&adbh=571&adbw=493&adbah=212%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo80_3ph&errv=678245571&csala=8%7C0%7C1224%7C1232%7C29&lle=0&ifv=1&hpt=0	false		unknown
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2	false		unknown
http://www.creationtch.com/search/tsc.php?ses=ogcSA4H0k2oRlqNjppsa16mMM6tGSicreVZ4J2GgFLbXnWlTQ-bNCtQ8Ma-6Ai86Oj6TRrbkuGpbHKKRoqOrYn76CgMdPyQOeK-9bYtObn0cDJ2x5fmZqo452a1GqZswqaq95CxXMekLC4HBI1v5NiBhw1hVaAFV2haooO-WzxgR7PaCjsUJbW9cwEg8LhsGn996kmo8EGF6oLoUXAIPu1Tvu4jUMcknC7wEOlte1-v4A-998OqE-0H8fAbR75BfU-BpnloE2Gok3cDdWmFO_nKuM9GaEDiB-FofTPeB8Zj14nEn8S7Z39cDHr08vRgPIzRGQq3iaNtJ0-dGGPM5z6AzCfMhcQEnHAvxmDJSUG8FlF0p22RNs3CqkI7&cv=2	false		unknown
http://www.creationtch.com/	false		unknown
https://www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true	false		unknown
https://syndicatedsearch.goog/adsense/domains/caf.js?pac=0	false	URL Reputation: safe	unknown
http://creationtch.com/	false		unknown
http://img.sedoparking.com/templates/bg/arrows-curved.png	false		unknown
https://syndicatedsearch.goog/afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=xa37wg2xt4y0&aqid=zhL8Zqy0JrGhxdwPktzPsQ0&pbt=bs&adbx=481.5&adby=986.015625&adbh=16&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo80_3ph&errv=678245571&csala=3%7C0%7C1229%7C1232%7C29&lle=0&ifv=0&hpt=0	false		unknown
https://img.sedoparking.com/templates/images/hero_nc.svg	false		unknown
https://syndicatedsearch.goog/afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=vk7amg39g97w&aqid=zhL8Zqy0JrGhxdwPktzPsQ0&psid=3259787283&pbt=bv&adbx=385.203125&adby=413.015625&adbh=571&adbw=493&adbah=212%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo80_3ph&errv=678245571&csala=8%7C0%7C1224%7C1232%7C29&lle=0&ifv=1&hpt=0	false		unknown
http://img.sedoparking.com/templates/logos/sedo_logo.png	false		unknown
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff	false		unknown
https://syndicatedsearch.goog/afs/ads/i/iframe.html	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://syndicatedsearch.goog	chromecache_67.1.dr, chromecache_73.1.dr, chromecache_72.1.dr, chromecache_83.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/pagead/1p-conversion/16521530460/?gad_source=1&adview_type=5	chromecache_67.1.dr, chromecache_73.1.dr, chromecache_72.1.dr, chromecache_83.1.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	syndicatedsearch.goog	United States	15169	GOOGLEUS	false
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
91.195.240.19	parkingpage.namecheap.com	Germany	47846	SEDO-ASDE	false
205.234.175.175	unknown	United States	30081	CACHENETWORKSUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.225	unknown	United States	15169	GOOGLEUS	false
204.93.142.142	vip1.g5.cachefly.net	United States	30081	CACHENETWORKSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
192.64.119.117	creationtch.com	United States	22612	NAMECHEAP-NETUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523492
Start date and time:	2024-10-01 17:18:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://creationtch.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@18/38@30/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.131, 142.250.186.110, 142.251.173.84, 34.104.35.123, 172.217.16.194, 142.250.186.98, 216.58.212.138, 216.58.206.74, 142.250.186.106, 142.250.185.74, 142.250.185.106, 172.217.23.106, 142.250.185.138, 142.250.74.202, 142.250.186.138, 142.250.184.234, 142.250.185.234, 172.217.18.106, 172.217.16.202, 142.250.185.170, 172.217.18.10, 142.250.185.202, 142.250.186.170, 142.250.186.42, 142.250.184.202, 142.250.184.195, 216.58.206.78
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, slscr.update.microsoft.com, partner.googleadservices.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://creationtch.com

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: http://www.creationtch.com/ Model: jbxai	{ "brand":["namecheap"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Learn more", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: http://www.creationtch.com/ Model: jbxai	{ "brand":["namecheap"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Learn more", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 14:18:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9854034650622845
Encrypted:	false
SSDEEP:	48:83d30TXYc2EHVidAKZdA1FehwiZUklqehzxy+3:8ynT2xy
MD5:	B1DE252080879E24F11CF21B94212B96
SHA1:	93B2AD0BC9630E76C1C47847CF01159EACF57672
SHA-256:	7FADE1B842306F2D13BFDEDB7DC31E50B75908566E447FA47936FED56308638E
SHA-512:	45D88F8C12AB451CF8F2051EC4DA0CB6126B5F985306C9B6137381D1B2121B6D340B2BC51C67205E6B08C99B5CAFE805DF677DD3F1F5CB24A9FD65BFD4874036
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....d."/....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYHz....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAYQz....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAYQz....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAYQz..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAYRz...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 14:18:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.0000151041006395
Encrypted:	false
SSDEEP:	48:8mfd30TXYc2EHVidAKZdA1seh/iZUkAQkqehmxy+2:8mKn99Qhxy
MD5:	338957E2909718827E96DB33D8919503
SHA1:	170B6344601F032AB6B395B46373FF47AAC3B1A3
SHA-256:	3BE40914DAAA9E4E4688335B77DF36ECBC8D920396FCB49D190C3CA23AB85CFA
SHA-512:	B26DCA513E09F0D59214992C052F6F3A65ADF18AF22EE5524E649A1B4C004E670AC55BA0FD0EC9D105A0DC648DD24AA58C68B5980B97E844598A30A9C2CFEB2D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....i../....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYHz....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAYQz....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAYQz....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAYQz..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAYRz...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.010219742655611
Encrypted:	false
SSDEEP:	48:8wd30TXYcAHVidAKZdA14meh7sFiZUkmgqeh7sExy+BX:8/nMnKxy
MD5:	B42DBAE1EA950B1168D55F5C353F500C
SHA1:	052DF627ED5D12511522A46CFF0249F708C9E864
SHA-256:	A0F0531DE6AD4FDC15BE98A6033F25B43FB1BAD3A57F208B4DD075E73FD8F669
SHA-512:	95BBB9A34E25E2FEC88AD653B986A2EB3EF207209A6AFA156ED56D6176E4CE88FE5688F4BC0A62A274BF58B1D2A52156572747B61F9FC69212029F04EA35F450
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYHz....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAYQz....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAYQz....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAYQz..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 14:18:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9983011551262604
Encrypted:	false
SSDEEP:	48:8od30TXYc2EHVidAKZdA1TehDiZUkwqehixy+R:8nnO8xy
MD5:	AB488BC5C3E782E19BE0CEBC17FF0E49
SHA1:	C28D27189CD305AD7C6810946DAF33992DFBD83C
SHA-256:	93776BD60905F644645115D11F45EB7073CA38CFED831AE22FFCC035B25CBB8E
SHA-512:	D319351B1A4D452AE519D433E170A2FC9DCDCED2FF64CD042ED6D1162849D84688955C18FE608623333FC390BC6CE3584922694C053C4F5B2743393D12DC669C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......./....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYHz....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAYQz....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAYQz....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAYQz..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAYRz...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 14:18:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9884660812208144
Encrypted:	false
SSDEEP:	48:8nd30TXYc2EHVidAKZdA1dehBiZUk1W1qehYxy+C:8Cne94xy
MD5:	E7D3B1F839E1BCF30D5C052FDAEAE83E
SHA1:	7B5907B16BEFE0149BFA2E4A6BB2E54C2A04F1FF
SHA-256:	2454A3EFC187F8A542FB366888DCBFEF6701C8B27C7CD535465449EE8ABCD312
SHA-512:	23F8D4D265AFE8428F4AFFA729FFD1C47DB239962067EA202FC638C765F0B424E07F5F10E888F60E97B8BFEDC4D8388AFFED42263AC883D5A81E7268B32B0D1E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......./....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYHz....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAYQz....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAYQz....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAYQz..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAYRz...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 14:18:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9973148976915875
Encrypted:	false
SSDEEP:	48:8/d30TXYc2EHVidAKZdA1duTeehOuTbbiZUk5OjqehOuTbKxy+yT+:8qnUTfTbxWOvTbKxy7T
MD5:	BAEF26845FCEBDA62A07923DDBEF814F
SHA1:	487E813CB2E1D7AEEE3BBF6CA4F8338EB98AA2D2
SHA-256:	D3C72ED0556E4723D5A08FD95EDCFB650A949919691047D9FFB8F5F80D4E8092
SHA-512:	303D19098633E52A689CFBD1F6A37F817AEAD1D8E45B31BFB9B2A1E2DB35207518167CBE7DF9A3CABB67DF98A98B61733779E4BCC78EF8219B12F8A9E2447C14
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......./....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYHz....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAYQz....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAYQz....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAYQz..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAYRz...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	200
Entropy (8bit):	5.025855206845441
Encrypted:	false
SSDEEP:	6:t6wfDpmc4slhohC/vmI4SmK0xhFELE47zF:t6qnoU/vmRI0xQTF
MD5:	11B3089D616633CA6B73B57AA877EEB4
SHA1:	07632F63E06B30D9B63C97177D3A8122629BDA9B
SHA-256:	809FB4619D2A2F1A85DBDA8CC69A7F1659215212D708A098D62150EEE57070C1
SHA-512:	079B0E35B479DFDBE64A987661000F4A034B10688E26F2A5FE6AAA807E81CCC5593D40609B731AB3340E687D83DD08DE4B8B1E01CDAC9D4523A9F6BB3ACFCBA0
Malicious:	false
Reputation:	low
URL:	https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
Preview:	<svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M0 0h24v24H0z" fill="none"/><path d="M5.88 4.12L13.76 12l-7.88 7.88L8 22l10-10L8 2z"/></svg>

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:HrPyY:zyY
MD5:	6CEA4FAAAFA38FD40BB35DE6589E85F6
SHA1:	8105D649FBDC85604236E65C53E97BCF0CBF5A36
SHA-256:	FC11A6B80A3B077C6ABCF624E3331E30045DEA7896F6539A7CB263E74964F5C0
SHA-512:	7DB4FBAAE22AA961987C0750E13E1B7A3CDEE6C0502A7C5093D4FAAE84454EF6709F8690278FF2AF9ED984601FDD8FFC59E887A34AE723C5BCAAE54125F4FCD4
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnSJW7vv5SE4hIFDVKKSaM=?alt=proto
Preview:	CgkKBw1SikmjGgA=

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	48097
Entropy (8bit):	4.541259077514592
Encrypted:	false
SSDEEP:	768:cfppX5/9YbZIqEGYbGqnq77SdMOsZff7pUbGA+dHeSZKFwj:CKYw3A9+
MD5:	5A2C392E7ACDF6E9DE6E00129500503C
SHA1:	C8D0F80381E4CE180B5EB3C4C98539907292A7BB
SHA-256:	878DA09A057EC8F1775CDC522E5F7EC44966DF547A87A9C29826BA114833C24B
SHA-512:	52223B04EB9121F05442DBC48519A95FDABB81C414772EE43DC837B58F797B97314796EF6D77EA6B7A1F3FEE5937EC039E617FCDF8B146822792ACCD2534E141
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">. Creator: CorelDRAW 2018 (64-Bit) -->.<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="1440px" height="140px" version="1.1" style="shape-rendering:geometricPrecision; text-rendering:geometricPrecision; image-rendering:optimizeQuality; fill-rule:evenodd; clip-rule:evenodd".viewBox="0 0 1451.085 141.382". xmlns:xlink="http://www.w3.org/1999/xlink">. <defs>. <font id="FontID0" horiz-adv-x="666" font-variant="normal" style="fill-rule:nonzero" font-weight="400">..<font-face ...font-family="Arial">...<font-face-src>....<font-face-name name="Arial"/>...</font-face-src>..</font-face>. <missing-glyph><path d="M0 0z"/></missing-glyph>. <glyph unicode=" " horiz-adv-x="277" d=""/>. <glyph unicode="." horiz-adv-x="277" d="M90.9909 0l0 99.9962 99.9962 0 0 -99.9962 -99.9962 0z"/>. <glyph unicode="?" horiz-adv-x="556" d="M231.002 175.

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1879)
Category:	downloaded
Size (bytes):	153214
Entropy (8bit):	5.5436425399747336
Encrypted:	false
SSDEEP:	1536:5ni6+zNKofjr9PyfpK7fDH+7pSU6GZvu85pistHWvR3+2xwHzgmcfpUWgQABuucP:hqM7vptHWpu22H9dBuDj3dmChm9Abj
MD5:	F5B7C2B515720924FA63037CEF10BA02
SHA1:	205A8C037532CC669803599827543FD131277138
SHA-256:	EFAEADE5A7436B576EDA114ABCB86CED39F97724F8EEBB505E34A950E72D8A89
SHA-512:	8A3B966B1F2A415CA1370A8A04D04AC916D7DCAD425D155DCECBD37775240B754DF8C60A5AFA13CC7E9D59C9DC2A836B744414ED48383B80BB2364B500AFE480
Malicious:	false
Reputation:	low
URL:	https://syndicatedsearch.goog/adsense/domains/caf.js?pac=0
Preview:	if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"syndicatedsearch.goog",hash:"17383633464370615553",packages:"domains",module:"ads",version:"1",m:{cei:"17301437,17301439,17301442,17301511,17301515,17301516,17301266",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_disableAdRequestForNewConsentStrategy":true,"_enableNewConsentStrategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",cdl:false,cdh:"syndicatedsearch.goog",cdem:{"afs_aa_baseline":500,"afs_chatbot":0,"afs_gpp_api":0}}};var n;function ba(a){var b=0;return functi

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1559)
Category:	downloaded
Size (bytes):	1560
Entropy (8bit):	5.338774974804375
Encrypted:	false
SSDEEP:	48:0JhcOnK8lwSb6YS4tyPWp2PXihm0wQR2FgbnYfblV:8VDbL1tzAXr+0P
MD5:	973E552E52B35968A918C48A3A019922
SHA1:	077FE40C4A9B4CC77A304209378B614C800C8DE3
SHA-256:	D57BF312C53CF7A7E125D5025906E736A8B5BD38556492D7FB9A0C8B58AA469C
SHA-512:	F47DC5093B51B0A3B486797CE688F3D23EFAC0D69429D7C1945017CC97DE0707A4F7B45BA8273F22D80391029659FE3DB6DEE823E23C45B66DC6065B3F89ED0F
Malicious:	false
Reputation:	low
URL:	https://syndicatedsearch.goog/afs/ads/i/iframe.html
Preview:	<!doctype html><html><head><meta name="ROBOTS" content="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta content="origin" name="referrer"></head><body><div id="adBlock"></div><script nonce="hQQpXoOzMxplnCpFScep6Q">if (window.name.match(/^{"name":"master-\d+"/)) {var script = document.createElement('script');script.src = "/adsense/search/ads.js";var href = window.location.href;if (!!href && (href.indexOf('?pac=') > 0 \|\| href.indexOf('&pac=') > 0)) {if (href.indexOf('?pac=1') > 0 \|\| href.indexOf('&pac=1') > 0) {script.src += '?pac=1';} else if (href.indexOf('?pac=2') > 0 \|\| href.indexOf('&pac=2') > 0) {script.src += '?pac=2';} else {script.src += '?pac=0';}}document.head.appendChild(script);window.IS_GOOGLE_AFS_IFRAME_ = true;}function populate(el) {var adBlock = document.getElementById('adBlock');adBlock.innerHTML += el;}function getMaster() {var m = null;var pIndex = window.name.indexOf('\|');if (pIndex > -1 && window.name.charAt(0) != '{') {try {m = window.

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (384), with no line terminators
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.437930558133947
Encrypted:	false
SSDEEP:	6:xWzPE+RT7O3l1p0ZdV2ZJP7qF7M+dreT7O3hd52J++JJV2ZJP7qFAen:xWVRT7WPpgSs7HKT7W3QJSs7n
MD5:	12708A6D1409BAA43C4B94AEF48474E3
SHA1:	48570E3E8C506BB6F026E86C258DA90F2BB8C369
SHA-256:	7A94F7B6B1FA40489C4680AF0F315CEEB6A29E343CBA0A1ABA8AA94163A7D53B
SHA-512:	F8B892AB8E3DBD8164726380B3117551AA717659823B1FF8130790B90549F89AAD3AB97DD0C7F672F290E0040BB1E0CC476A44BA74506D01DE9A64C9AB86AF2F
Malicious:	false
Reputation:	low
Preview:	__sasCookie({"_cookies_":[{"_value_":"ID=4266d6c4d7bdb0c8:T=1727795919:RT=1727795919:S=ALNI_MaNnD3WzKA3uwgR4pJQCbAtblfYbQ","_expires_":1761491919,"_path_":"/","_domain_":"creationtch.com","_version_":1},{"_value_":"UID=00000f00a9a6c4ef:T=1727795919:RT=1727795919:S=ALNI_MY7sFHn8k90w6AsvJyUcaYrpTsjQQ","_expires_":1761491919,"_path_":"/","_domain_":"creationtch.com","_version_":2}]});

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 413 x 594, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13502
Entropy (8bit):	7.912202553387551
Encrypted:	false
SSDEEP:	384:/mKXXNN5Jr7k18sA6pXsox1amFbraxPpkJ:euNN3r7SJZRGmgxPC
MD5:	107694EE1E94990D97B7E58651FFD6A0
SHA1:	7DD9AE7BADF78BE01EA0623DF1E90171348716FF
SHA-256:	7AA2A3E9A9575A27F5593C3B0357423128C468A46ED20D284CE5A21555EE67BC
SHA-512:	5D695545E1516D28CA05933C88AEC08CA324A61804BD662102A1EEB7A515BA543343AD24FDA53ABA329AE803F622664B29D5A3461BCCBD264EC8950E8CA51002
Malicious:	false
Reputation:	low
URL:	http://img.sedoparking.com/templates/bg/arrows-curved.png
Preview:	.PNG........IHDR.......R........^....pHYs.................sRGB.........gAMA......a...4SIDATx....\.y........F.U.b.U....A...#V.......J..?....w..UD&.A...P&.....Q...#..qA.d\.E[...Y.....'...;....{.......+_....<.y.9.k.o.-J..%.C)I3..7o..e..........0....f.<.6/J...&.}.S..n.%...1........'........'X..+...4Z..;JTf.JV........)S-e.'Z.dO...y.'....a{mM.C...r...1.V.....L.K..@...:...H..N^.}..ex....N...\/k..l..P....\...j..:vr........_.3..n...!..n.?t....8.pNX...5.Dwd....8...`iB..Q=...L.:...`.b...L+Ne.....7tF.....V..x..S.e{.....:.....H..........]...!..`6.........ooqN......i......x.N.h......z1...%....T?.V.lD..+Bg9zZ..NB...D..-.U[%...~../..D.J......?..F.)5................J....k.I...W....5..ns.....^..%!o.}..g/.~.....<@......8.J'....T?.\E......X..........\|.vS.`....hY."....`.h..}?...J'^..y...7[....@.tP..5.ZQ....5...F.`,......&.&.6.....`VT:.T3.......A.`jy.....7.....z.0.*.T.p.7.G tP).........S...tP76..8@.`a........C.`.L;W).....~......t...Y."A...<.f!_... T

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	48097
Entropy (8bit):	4.541259077514592
Encrypted:	false
SSDEEP:	768:cfppX5/9YbZIqEGYbGqnq77SdMOsZff7pUbGA+dHeSZKFwj:CKYw3A9+
MD5:	5A2C392E7ACDF6E9DE6E00129500503C
SHA1:	C8D0F80381E4CE180B5EB3C4C98539907292A7BB
SHA-256:	878DA09A057EC8F1775CDC522E5F7EC44966DF547A87A9C29826BA114833C24B
SHA-512:	52223B04EB9121F05442DBC48519A95FDABB81C414772EE43DC837B58F797B97314796EF6D77EA6B7A1F3FEE5937EC039E617FCDF8B146822792ACCD2534E141
Malicious:	false
Reputation:	low
URL:	https://img.sedoparking.com/templates/images/hero_nc.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">. Creator: CorelDRAW 2018 (64-Bit) -->.<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="1440px" height="140px" version="1.1" style="shape-rendering:geometricPrecision; text-rendering:geometricPrecision; image-rendering:optimizeQuality; fill-rule:evenodd; clip-rule:evenodd".viewBox="0 0 1451.085 141.382". xmlns:xlink="http://www.w3.org/1999/xlink">. <defs>. <font id="FontID0" horiz-adv-x="666" font-variant="normal" style="fill-rule:nonzero" font-weight="400">..<font-face ...font-family="Arial">...<font-face-src>....<font-face-name name="Arial"/>...</font-face-src>..</font-face>. <missing-glyph><path d="M0 0z"/></missing-glyph>. <glyph unicode=" " horiz-adv-x="277" d=""/>. <glyph unicode="." horiz-adv-x="277" d="M90.9909 0l0 99.9962 99.9962 0 0 -99.9962 -99.9962 0z"/>. <glyph unicode="?" horiz-adv-x="556" d="M231.002 175.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1879)
Category:	downloaded
Size (bytes):	153198
Entropy (8bit):	5.543571700420608
Encrypted:	false
SSDEEP:	1536:rni6+zNKofjr9PyfpK7fDH+7pSU6GZvu85pistHWvR3+2xwHzgmcfpUWgQABuucP:LqM7vptHWpu22H9dBuDj3dmChm9Abj
MD5:	77059989BB4D46F20857135E0B60B600
SHA1:	3FABADBF68AF07F0772A875A255CAF01E0A3CA4F
SHA-256:	C4A02BACCBB00423982F77FB09E58A76A68F9D0FD58CA382CBF6FC33AD7EB0D6
SHA-512:	578E5DA0BAB40C856662DA1E7508091BFD9B4E8E67AF2F37D4C1A2D6D51F92B10D2010F96130E64584D9FAD6C150A774B933BEDB92FCF59D2B4B9147AB5FEC9C
Malicious:	false
Reputation:	low
URL:	https://www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true
Preview:	if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"17383633464370615553",packages:"domains",module:"ads",version:"1",m:{cei:"17301437,17301439,17301442,17301511,17301516,17301266",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_disableAdRequestForNewConsentStrategy":true,"_enableNewConsentStrategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",cdl:false,cdh:"syndicatedsearch.goog",cdem:{"afs_aa_baseline":500,"afs_chatbot":0,"afs_gpp_api":0}}};var n;function ba(a){var b=0;return function(){return b<a.

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1879)
Category:	dropped
Size (bytes):	153214
Entropy (8bit):	5.543630481633971
Encrypted:	false
SSDEEP:	1536:sni6+zNKofjr9PyfpK7fDH+7pSU6GZvu85pistHWvR3+2xwHzgmcfpUWgQABuucP:gqM7vptHWpu22H9dBuDj3dmChm9Abj
MD5:	40530F1DED793B59E0D928D18CF39569
SHA1:	A0F3E2E77B57996C4AAFA678188064EFC979AA0C
SHA-256:	3FF8C01FF32ACE1D0DBD7F4DE73CB1C027E30FCC0A68CE8698193092C2A5E6E8
SHA-512:	E9164FE5D3A4692591F0AFF6B7560CF719301A0B3106CDA0DEFC47FF5D66CFAB5F95293B68BB8E131C066BDE77AE98D2F953CC6F5EB4D6CF79819DC879DDB0EB
Malicious:	false
Reputation:	low
Preview:	if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"syndicatedsearch.goog",hash:"17383633464370615553",packages:"domains",module:"ads",version:"1",m:{cei:"17301431,17301433,17301436,17301511,17301515,17301516,17301266",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_disableAdRequestForNewConsentStrategy":true,"_enableNewConsentStrategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",cdl:false,cdh:"syndicatedsearch.goog",cdem:{"afs_aa_baseline":500,"afs_chatbot":0,"afs_gpp_api":0}}};var n;function ba(a){var b=0;return functi

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	391
Entropy (8bit):	4.72645217666044
Encrypted:	false
SSDEEP:	6:t6F3Ci9mc4slzTPl2O4UYaeLIT4W+KS4S1UpMTQpi6jUs8sh6B+BSmK0C:t6F3H9FPUPkHSt1UiT6i6jUs8b0I0C
MD5:	A6AD6E65373DB8C1B1F154C4C83F8CE5
SHA1:	84CC007D6D682C589E1E1F87482A5278830F3000
SHA-256:	920A378947204498C122722933B3A4B67788A2B6FADE8BD0D47CF830EEEE0563
SHA-512:	09B6D4711C284B1A04C9C4D874F3D1DDFC876C1491FB2AA283A13505BCDBFE90B02731D0B7AD5F492B1DDA2161A4AFE20040801EA634D2727CDE84319ADFB1D2
Malicious:	false
Reputation:	low
Preview:	<svg fill='#1967d2' xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 24 24"><path d="M15.5 14h-.79l-.28-.27C15.41 12.59 16 11.11 16 9.5 16 5.91 13.09 3 9.5 3S3 5.91 3 9.5 5.91 16 9.5 16c1.61 0 3.09-.59 4.23-1.57l.27.28v.79l5 4.99L20.49 19l-4.99-5zm-6 0C7.01 14 5 11.99 5 9.5S7.01 5 9.5 5 14 7.01 14 9.5 11.99 14 9.5 14z"/><path d="M0 0h24v24H0z" fill="none"/></svg>.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.090787153125625
Encrypted:	false
SSDEEP:	192:jiHSINqv0tJ30DezSfPAXTZwC3D2N2xp1Fd/ar/+zi3LHZNwkQH0iWpXDt3TN8rB:jzAnP9j
MD5:	DEF00C11B1596DB4EFEE6A9FBE64FC27
SHA1:	BD298981E6D8D7E4FFA18ABCF687041F4246672D
SHA-256:	95C427FA3143B1896FAF42A6406686CE7602CB39052081BB32D12B51C9E047E4
SHA-512:	C056E95DBFA1AAB3A50DFF18C6D577DBFFEA72C93316FFC53B6B7AA41DCC7707A810D563894589A7305DE0B76610F88150B2034670DE368773B2B356F14AD30F
Malicious:	false
Reputation:	low
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$...................................................@...@...@...........................@...A...A. .A. .A. .A...A. .A. .A...@.......................@...@...@...........................................................................@...@...@...............@...A...A.U.@...@...@..@..@..@..@..@...@...@...@..@..@..@..@...@.}.A.U.A. .@...........@...@...............................................................@...........@...A...@.j.@...@..@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@..@.}.A...........@...@...................................................@.......A. .@.}.@..@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...A.G.....@...@...........................................@.......A.U.@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 413 x 594, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13502
Entropy (8bit):	7.912202553387551
Encrypted:	false
SSDEEP:	384:/mKXXNN5Jr7k18sA6pXsox1amFbraxPpkJ:euNN3r7SJZRGmgxPC
MD5:	107694EE1E94990D97B7E58651FFD6A0
SHA1:	7DD9AE7BADF78BE01EA0623DF1E90171348716FF
SHA-256:	7AA2A3E9A9575A27F5593C3B0357423128C468A46ED20D284CE5A21555EE67BC
SHA-512:	5D695545E1516D28CA05933C88AEC08CA324A61804BD662102A1EEB7A515BA543343AD24FDA53ABA329AE803F622664B29D5A3461BCCBD264EC8950E8CA51002
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......R........^....pHYs.................sRGB.........gAMA......a...4SIDATx....\.y........F.U.b.U....A...#V.......J..?....w..UD&.A...P&.....Q...#..qA.d\.E[...Y.....'...;....{.......+_....<.y.9.k.o.-J..%.C)I3..7o..e..........0....f.<.6/J...&.}.S..n.%...1........'........'X..+...4Z..;JTf.JV........)S-e.'Z.dO...y.'....a{mM.C...r...1.V.....L.K..@...:...H..N^.}..ex....N...\/k..l..P....\...j..:vr........_.3..n...!..n.?t....8.pNX...5.Dwd....8...`iB..Q=...L.:...`.b...L+Ne.....7tF.....V..x..S.e{.....:.....H..........]...!..`6.........ooqN......i......x.N.h......z1...%....T?.V.lD..+Bg9zZ..NB...D..-.U[%...~../..D.J......?..F.)5................J....k.I...W....5..ns.....^..%!o.}..g/.~.....<@......8.J'....T?.\E......X..........\|.vS.`....hY."....`.h..}?...J'^..y...7[....@.tP..5.ZQ....5...F.`,......&.&.6.....`VT:.T3.......A.`jy.....7.....z.0.*.T.p.7.G tP).........S...tP76..8@.`a........C.`.L;W).....~......t...Y."A...<.f!_... T

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	15086
Entropy (8bit):	3.090787153125625
Encrypted:	false
SSDEEP:	192:jiHSINqv0tJ30DezSfPAXTZwC3D2N2xp1Fd/ar/+zi3LHZNwkQH0iWpXDt3TN8rB:jzAnP9j
MD5:	DEF00C11B1596DB4EFEE6A9FBE64FC27
SHA1:	BD298981E6D8D7E4FFA18ABCF687041F4246672D
SHA-256:	95C427FA3143B1896FAF42A6406686CE7602CB39052081BB32D12B51C9E047E4
SHA-512:	C056E95DBFA1AAB3A50DFF18C6D577DBFFEA72C93316FFC53B6B7AA41DCC7707A810D563894589A7305DE0B76610F88150B2034670DE368773B2B356F14AD30F
Malicious:	false
Reputation:	low
URL:	http://img.sedoparking.com/templates/logos/sedo_logo.png
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$...................................................@...@...@...........................@...A...A. .A. .A. .A...A. .A. .A...@.......................@...@...@...........................................................................@...@...@...............@...A...A.U.@...@...@..@..@..@..@..@...@...@...@..@..@..@..@...@.}.A.U.A. .@...........@...@...............................................................@...........@...A...@.j.@...@..@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@..@.}.A...........@...@...................................................@.......A. .@.}.@..@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...A.G.....@...@...........................................@.......A.U.@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (384), with no line terminators
Category:	downloaded
Size (bytes):	384
Entropy (8bit):	5.489548725522123
Encrypted:	false
SSDEEP:	6:xWzPXI6RrPxUnJSI4V2mP7qF7M+d5HGe6RrwRPaaXX2mP7qFAen:xWLI6RrJ2F4K7HZ36RrwRS7n
MD5:	3B2E9F596DC8322E76507E357EB5CAF3
SHA1:	816C3F8E0D4900B0DB76BEE7BEE8F8EB1AA33836
SHA-256:	22A22552B7103D9CCC4BCA55F24C99A4FAFD2A6CBC7EF8523FD47686A08F5570
SHA-512:	F774154122A245BADBF43D1504E0038E89AF879DCFFBB907D6836DD6F2D815140010B4BBE1C2AC47AD235BE204C0F43CC818BAC4CB4565C854ECC3E0C99FB18A
Malicious:	false
Reputation:	low
URL:	https://partner.googleadservices.com/gampad/cookie.js?domain=www.creationtch.com&client=dp-sedo80_3ph&product=SAS&callback=__sasCookie&cookie_types=v1%2Cv2
Preview:	__sasCookie({"_cookies_":[{"_value_":"ID=50bb2c729b40dc9f:T=1727795918:RT=1727795918:S=ALNI_MZ0MKXMrXqBl1z6AcpvuVIVof_jEw","_expires_":1761491918,"_path_":"/","_domain_":"creationtch.com","_version_":1},{"_value_":"UID=00000f00aa76adbb:T=1727795918:RT=1727795918:S=ALNI_MZv86OI66PkYUKef9jFXDgBCnwS5g","_expires_":1761491918,"_path_":"/","_domain_":"creationtch.com","_version_":2}]});

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:HrPyY:zyY
MD5:	6CEA4FAAAFA38FD40BB35DE6589E85F6
SHA1:	8105D649FBDC85604236E65C53E97BCF0CBF5A36
SHA-256:	FC11A6B80A3B077C6ABCF624E3331E30045DEA7896F6539A7CB263E74964F5C0
SHA-512:	7DB4FBAAE22AA961987C0750E13E1B7A3CDEE6C0502A7C5093D4FAAE84454EF6709F8690278FF2AF9ED984601FDD8FFC59E887A34AE723C5BCAAE54125F4FCD4
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnSJW7vv5SE4hIFDVKKSaM=?alt=proto
Preview:	CgkKBw1SikmjGgA=

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.025855206845441
Encrypted:	false
SSDEEP:	6:t6wfDpmc4slhohC/vmI4SmK0xhFELE47zF:t6qnoU/vmRI0xQTF
MD5:	11B3089D616633CA6B73B57AA877EEB4
SHA1:	07632F63E06B30D9B63C97177D3A8122629BDA9B
SHA-256:	809FB4619D2A2F1A85DBDA8CC69A7F1659215212D708A098D62150EEE57070C1
SHA-512:	079B0E35B479DFDBE64A987661000F4A034B10688E26F2A5FE6AAA807E81CCC5593D40609B731AB3340E687D83DD08DE4B8B1E01CDAC9D4523A9F6BB3ACFCBA0
Malicious:	false
Reputation:	low
Preview:	<svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M0 0h24v24H0z" fill="none"/><path d="M5.88 4.12L13.76 12l-7.88 7.88L8 22l10-10L8 2z"/></svg>

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	391
Entropy (8bit):	4.72645217666044
Encrypted:	false
SSDEEP:	6:t6F3Ci9mc4slzTPl2O4UYaeLIT4W+KS4S1UpMTQpi6jUs8sh6B+BSmK0C:t6F3H9FPUPkHSt1UiT6i6jUs8b0I0C
MD5:	A6AD6E65373DB8C1B1F154C4C83F8CE5
SHA1:	84CC007D6D682C589E1E1F87482A5278830F3000
SHA-256:	920A378947204498C122722933B3A4B67788A2B6FADE8BD0D47CF830EEEE0563
SHA-512:	09B6D4711C284B1A04C9C4D874F3D1DDFC876C1491FB2AA283A13505BCDBFE90B02731D0B7AD5F492B1DDA2161A4AFE20040801EA634D2727CDE84319ADFB1D2
Malicious:	false
Reputation:	low
URL:	https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2
Preview:	<svg fill='#1967d2' xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 24 24"><path d="M15.5 14h-.79l-.28-.27C15.41 12.59 16 11.11 16 9.5 16 5.91 13.09 3 9.5 3S3 5.91 3 9.5 5.91 16 9.5 16c1.61 0 3.09-.59 4.23-1.57l.27.28v.79l5 4.99L20.49 19l-4.99-5zm-6 0C7.01 14 5 11.99 5 9.5S7.01 5 9.5 5 14 7.01 14 9.5 11.99 14 9.5 14z"/><path d="M0 0h24v24H0z" fill="none"/></svg>.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (13755)
Category:	downloaded
Size (bytes):	14556
Entropy (8bit):	5.412083320471913
Encrypted:	false
SSDEEP:	96:2E/yk2iIlb5lphMzwronbkz/MBhshv/NYrq02pMMDtAw96DsVMMDRw96DvDMMDqF:2E12iMpgbkzMBhsV/WrT2p7jOQ2fuOf
MD5:	2B4BBA82F49D70C5563DB985ACFC22E7
SHA1:	C25D28F34F3C9CA31EB0ED9C65795FF083D8FA90
SHA-256:	DD0290CAF8A5D1504ADA7909BEC47F9C85AC33017331400D2C97E9BCE021716E
SHA-512:	FAC82CDAE7A91224D648E3C7B2788A170E6A21CB51DFAC1812FEED1B75E67F974CD6D34077CFFC6F6F4BB564A4D1A1CE9F192BC1770C03C8E0FEFB264E194106
Malicious:	false
Reputation:	low
URL:	https://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=3259787283&channel=exp-0051%2Cauxa-control-1%2C44786252&client=dp-sedo80_3ph&r=m&hl=en&ivt=1&rpbu=http%3A%2F%2Fwww.creationtch.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjc3OTU5MTYmdGNpZD13d3cuY3JlYXRpb250Y2guY29tNjZmYzEyY2M2ZDRmNzQuOTk1NTI2MTAmdGFzaz1zZWFyY2gmZG9tYWluPWNyZWF0aW9udGNoLmNvbSZhX2lkPTMmc2Vzc2lvbj1kRG1EczNra012TjNHYk1oLVBjcw%3D%3D&type=3&uiopt=false&swp=as-drid-2280784292183247&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=8001727795916463&num=0&output=afd_ads&domain_name=www.creationtch.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1727795916468&u_w=1280&u_h=1024&biw=1263&bih=907&psw=1263&psh=1146&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&nfp=1&jsv=678245571&rurl=http%3A%2F%2Fwww.creationtch.com%2F
Preview:	<!doctype html><html lang="en"> <head> <style id="ssr-boilerplate">body{-webkit-text-size-adjust:100%; font-family:arial,sans-serif; margin:0;}.div{-webkit-box-flex:0 0; -webkit-flex-shrink:0; flex-shrink:0;max-width:100%;}.span:last-child, .div:last-child{-webkit-box-flex:1 0; -webkit-flex-shrink:1; flex-shrink:1;}.a{text-decoration:none; text-transform:none; color:inherit; display:inline-block;}.span{-webkit-box-flex:0 0; -webkit-flex-shrink:0; flex-shrink:0;display:inline-block; overflow:hidden; text-transform:none;}.img{border:none; max-width:100%; max-height:100%;}.i_{display:-ms-flexbox; display:-webkit-box; display:-webkit-flex; display:flex;-ms-flex-align:start; -webkit-box-align:start; -webkit-align-items:flex-start; align-items:flex-start;box-sizing:border-box; overflow:hidden;}.v_{-webkit-box-flex:1 0; -webkit-flex-shrink:1; flex-shrink:1;}.j_>span:last-child, .j_>div:last-child, .w_, .w_:last-child{-webkit-box-flex:0 0; -webkit-flex-shrink:0; flex-shrink:0;}.l_{-ms-overflow

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1879)
Category:	dropped
Size (bytes):	153198
Entropy (8bit):	5.543571700420608
Encrypted:	false
SSDEEP:	1536:rni6+zNKofjr9PyfpK7fDH+7pSU6GZvu85pistHWvR3+2xwHzgmcfpUWgQABuucP:LqM7vptHWpu22H9dBuDj3dmChm9Abj
MD5:	77059989BB4D46F20857135E0B60B600
SHA1:	3FABADBF68AF07F0772A875A255CAF01E0A3CA4F
SHA-256:	C4A02BACCBB00423982F77FB09E58A76A68F9D0FD58CA382CBF6FC33AD7EB0D6
SHA-512:	578E5DA0BAB40C856662DA1E7508091BFD9B4E8E67AF2F37D4C1A2D6D51F92B10D2010F96130E64584D9FAD6C150A774B933BEDB92FCF59D2B4B9147AB5FEC9C
Malicious:	false
Reputation:	low
Preview:	if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"17383633464370615553",packages:"domains",module:"ads",version:"1",m:{cei:"17301437,17301439,17301442,17301511,17301516,17301266",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_disableAdRequestForNewConsentStrategy":true,"_enableNewConsentStrategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",cdl:false,cdh:"syndicatedsearch.goog",cdem:{"afs_aa_baseline":500,"afs_chatbot":0,"afs_gpp_api":0}}};var n;function ba(a){var b=0;return function(){return b<a.

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 17:18:35.334028006 CEST	49706	80	192.168.2.16	192.64.119.117
Oct 1, 2024 17:18:35.334350109 CEST	49707	80	192.168.2.16	192.64.119.117
Oct 1, 2024 17:18:35.338884115 CEST	80	49706	192.64.119.117	192.168.2.16
Oct 1, 2024 17:18:35.338946104 CEST	49706	80	192.168.2.16	192.64.119.117
Oct 1, 2024 17:18:35.339144945 CEST	80	49707	192.64.119.117	192.168.2.16
Oct 1, 2024 17:18:35.339157104 CEST	49706	80	192.168.2.16	192.64.119.117
Oct 1, 2024 17:18:35.339200020 CEST	49707	80	192.168.2.16	192.64.119.117
Oct 1, 2024 17:18:35.344027042 CEST	80	49706	192.64.119.117	192.168.2.16
Oct 1, 2024 17:18:35.838094950 CEST	80	49706	192.64.119.117	192.168.2.16
Oct 1, 2024 17:18:35.869168043 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:35.874078989 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:35.874191999 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:35.874362946 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:35.879276037 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:35.884744883 CEST	49706	80	192.168.2.16	192.64.119.117
Oct 1, 2024 17:18:36.548505068 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.548517942 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.548525095 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.548614979 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:36.549412966 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.549422026 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.549478054 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:36.549484968 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.549535036 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:36.549622059 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.549741983 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.549787998 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:36.549977064 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.549985886 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.550029993 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:36.553531885 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:36.571595907 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:36.571619034 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:36.571691990 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:36.571902990 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:36.571917057 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:36.588166952 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:36.588251114 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:36.588332891 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:36.588516951 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:36.588552952 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:36.590969086 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:36.595835924 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:36.595885992 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:36.596093893 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:36.600949049 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:36.605705976 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:37.206073046 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.206208944 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.206227064 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.206235886 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.206278086 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.206293106 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.206302881 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.206314087 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.206317902 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.206330061 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.206341028 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.206346035 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.206350088 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.206372023 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.206397057 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.211235046 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.211246014 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.211256027 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.211303949 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.244421005 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.244666100 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.244726896 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.245634079 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.245707989 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.246951103 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.247018099 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.247148037 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.247164965 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.255820990 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.287715912 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.292877913 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.311939955 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.317094088 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.317164898 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.317303896 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.322084904 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.335705042 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.443595886 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.443653107 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.443696022 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.443717003 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.443737030 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.443829060 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.443830013 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.443897963 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.443947077 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.448973894 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.449042082 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.449101925 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.449119091 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.453870058 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:37.453927994 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:37.454013109 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:37.454205036 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:37.454237938 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:37.455259085 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.455321074 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.455337048 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.461591005 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.461647034 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.461657047 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.463757992 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.463983059 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.463989973 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.465643883 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.465711117 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.465715885 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.465755939 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.466540098 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.466620922 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.466726065 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.466736078 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.511713028 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.511719942 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.534260035 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.534317017 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.534343004 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.534476995 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.534497976 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.534549952 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.540381908 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.544990063 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.545021057 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.545056105 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.545073032 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.545213938 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.553365946 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.557811975 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.557832956 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.557869911 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.557887077 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.558046103 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.566272020 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.571202040 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.571223974 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.571259975 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.571269989 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.571433067 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.576469898 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.582870960 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.582926989 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.582936049 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.588857889 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.588881016 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.588908911 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.588920116 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.588967085 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.594693899 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.594727993 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.594775915 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.594791889 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.620428085 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.620451927 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.620560884 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.620585918 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.620609999 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.620642900 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.620672941 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.620692015 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.621702909 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.625489950 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.625545979 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.625560999 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.630548000 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.630604982 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.630620003 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.635577917 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.635634899 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.635649920 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.636614084 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.636672974 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.636693001 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.636728048 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.636732101 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.636755943 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.636760950 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.636779070 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.636789083 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.636804104 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.636831045 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.640616894 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.640690088 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.640703917 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.645526886 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.645606041 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.645620108 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.650625944 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.650707960 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.650722980 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.655546904 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.655663967 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.655693054 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.660603046 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.660670996 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.660686016 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.665530920 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.665585995 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.665595055 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.670471907 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.670526981 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.670536041 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.674659014 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.674707890 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.674721003 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.679265976 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.679321051 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.679331064 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.683995962 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.684046030 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.684053898 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.688695908 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.688755989 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.688765049 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.693304062 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.693361998 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.693376064 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.696870089 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.696943045 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.696957111 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.701011896 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.701066971 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.701081038 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.704600096 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.704673052 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.704684973 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.708507061 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.708564043 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.708585024 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.712294102 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.712332010 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.712353945 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.712368965 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.712440968 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.714523077 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.716869116 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.716937065 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.716952085 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.719135046 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.719156027 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.719191074 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.719206095 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.719259977 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.721630096 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.721997976 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.722054958 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.722073078 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.722080946 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.722104073 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.722124100 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.724059105 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.724102020 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.724128962 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.724138975 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.724154949 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.724174023 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.724175930 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.724180937 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.724209070 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.724229097 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.724242926 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.724266052 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.724296093 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.724317074 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.724540949 CEST	49709	443	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:37.724550962 CEST	443	49709	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:37.726186991 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.728364944 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.728396893 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.728425026 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.728440046 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.728491068 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.730114937 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.733115911 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.733180046 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.733195066 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.735451937 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.735485077 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.735517025 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.735529900 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.735588074 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.737548113 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.738193989 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.738212109 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.738267899 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.738481045 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.738492966 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.739830017 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.739890099 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.739903927 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.742147923 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.742175102 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.742206097 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.742221117 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.742269039 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.744549990 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.746606112 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.746665001 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.746679068 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.746989965 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.747046947 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.747221947 CEST	49711	443	192.168.2.16	216.58.206.36
Oct 1, 2024 17:18:37.747246981 CEST	443	49711	216.58.206.36	192.168.2.16
Oct 1, 2024 17:18:37.758508921 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:37.758544922 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:37.758599997 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:37.758943081 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:37.758953094 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:37.775608063 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:37.782170057 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:37.782212973 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:37.782277107 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:37.782306910 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:37.782340050 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:37.782393932 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:37.782485008 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:37.782504082 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:37.782620907 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:37.782634020 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:37.782970905 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:37.793832064 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.794162989 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.794174910 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.794186115 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.794195890 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.794205904 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.794214964 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.794219971 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.794224977 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.794236898 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.794239044 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.794277906 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.794297934 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.794336081 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.800697088 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.800708055 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.800717115 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.800757885 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.843859911 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.881715059 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:37.923739910 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:37.976742983 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:38.017738104 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:38.029648066 CEST	49721	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:38.034491062 CEST	80	49721	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:38.034575939 CEST	49721	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:38.034699917 CEST	49721	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:38.039633989 CEST	80	49721	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:38.096004963 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:38.096272945 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:38.096304893 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:38.097183943 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:38.097256899 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:38.098102093 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:38.098167896 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:38.145721912 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:38.145736933 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:38.193720102 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:38.410631895 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.412782907 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.412802935 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.413678885 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.413753986 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.416650057 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.416707993 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.417033911 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.417042017 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.421613932 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.421849966 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.421863079 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.425905943 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.425991058 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.426012039 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.426059008 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.431041956 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.431159973 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.431169987 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.444542885 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.444868088 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.444895029 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.445785046 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.445856094 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.446162939 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.446221113 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.446295977 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.446304083 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.460707903 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.475400925 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.476293087 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.476530075 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.476552963 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.477180958 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.477189064 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.477427959 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.477489948 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.477895021 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.477947950 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.478041887 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.478049994 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.492712021 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.525300026 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.525302887 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.552565098 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.552622080 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.552643061 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.552660942 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.552699089 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.552719116 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.552834988 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.552834988 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.552834988 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.552850962 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.552896976 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.639317989 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.639377117 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.639415979 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.639424086 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.639465094 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.678834915 CEST	80	49721	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:38.686306000 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.686366081 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.686496973 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.686496973 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.686506987 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.686533928 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.686558008 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.686577082 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.686809063 CEST	49716	443	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:38.686817884 CEST	443	49716	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:38.691591024 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.691632986 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.691662073 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.691688061 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.691689968 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.691703081 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.691732883 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.697041988 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.697066069 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.697105885 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.697112083 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.697155952 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.697271109 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.702776909 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.702830076 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.702836037 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.709083080 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.709146023 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.709152937 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.726728916 CEST	49721	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:38.757797956 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.939925909 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.939943075 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.939977884 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.939984083 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.939992905 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940001011 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.940021038 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.940026999 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.940032005 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940031052 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.940038919 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.940052032 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940053940 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.940088987 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.940097094 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.940107107 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.940120935 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940124989 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.940125942 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.940131903 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.940134048 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.940141916 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.940144062 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940157890 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.940164089 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940179110 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.940207005 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.940335989 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940463066 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940490007 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940505981 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.940510035 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940531969 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940550089 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.940556049 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940593958 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.940696955 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940779924 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940810919 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.940814018 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940823078 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.940828085 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.940855980 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.940861940 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.940872908 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.940879107 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.941144943 CEST	80	49721	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:38.941193104 CEST	49721	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:38.941591978 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.941644907 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.941649914 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.946301937 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.946304083 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.946376085 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.946381092 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.946382046 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.946407080 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.946425915 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.946429014 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.946443081 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.946465015 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.946470976 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.946510077 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.947077036 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.947885036 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.947907925 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.947926044 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.947942972 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.947947979 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.947983027 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.948743105 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.948795080 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.948801041 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.949425936 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.949459076 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.949472904 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.949476957 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.949517012 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.949523926 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.950264931 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.950299025 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.950318098 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.950321913 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.950361967 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.950366020 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.951217890 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.951244116 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.951267004 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.951272964 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.951312065 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.952016115 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.952199936 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.952243090 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.952249050 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.953069925 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.953125954 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.953130960 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.953332901 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.953361988 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.953378916 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.953382969 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.953422070 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.953427076 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.954106092 CEST	49719	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.954129934 CEST	443	49719	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.954238892 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.954267025 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.954282045 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.954287052 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.954341888 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.955032110 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.955502033 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.955553055 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.955559015 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.955895901 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.955945969 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.955950975 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.955977917 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.956017017 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.956018925 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.956027031 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.956060886 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.956228018 CEST	49720	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.956239939 CEST	443	49720	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.956904888 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.957148075 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.957191944 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.957196951 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.957242966 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.957284927 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.957289934 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.957863092 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.957912922 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.957918882 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.959398985 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.959419966 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.959460020 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.959465981 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.959506989 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.961724043 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.964068890 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.964097023 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.964131117 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.964138031 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.964174032 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.964584112 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.964618921 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.964692116 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.964960098 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:38.964977026 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:38.966449976 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.968724012 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.968750000 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.968781948 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.968789101 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.968832970 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.971158028 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.973372936 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.973400116 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.973427057 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.973433018 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.973468065 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.975703001 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.978013992 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.978040934 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.978069067 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.978075981 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.978118896 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.980346918 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.982736111 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.982762098 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.982810974 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.982816935 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.982856989 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.985260963 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.987284899 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.987346888 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.987355947 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.989778042 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.989842892 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.989847898 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.992110014 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.992136955 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.992166042 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.992171049 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.992218971 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.994174957 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.994406939 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:38.994456053 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.994606018 CEST	49717	443	192.168.2.16	142.250.186.36
Oct 1, 2024 17:18:38.994617939 CEST	443	49717	142.250.186.36	192.168.2.16
Oct 1, 2024 17:18:39.197877884 CEST	49724	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:18:39.197936058 CEST	443	49724	172.217.18.4	192.168.2.16
Oct 1, 2024 17:18:39.198025942 CEST	49724	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:18:39.198198080 CEST	49724	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:18:39.198210001 CEST	443	49724	172.217.18.4	192.168.2.16
Oct 1, 2024 17:18:39.508007050 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 17:18:39.633085966 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.633316994 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:39.633337021 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.634459972 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.634774923 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:39.634888887 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:39.634949923 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.682724953 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:39.810810089 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 17:18:39.831130981 CEST	443	49724	172.217.18.4	192.168.2.16
Oct 1, 2024 17:18:39.831505060 CEST	49724	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:18:39.831532955 CEST	443	49724	172.217.18.4	192.168.2.16
Oct 1, 2024 17:18:39.832572937 CEST	443	49724	172.217.18.4	192.168.2.16
Oct 1, 2024 17:18:39.832642078 CEST	49724	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:18:39.833003044 CEST	49724	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:18:39.833065033 CEST	443	49724	172.217.18.4	192.168.2.16
Oct 1, 2024 17:18:39.874727011 CEST	49724	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:18:39.874757051 CEST	443	49724	172.217.18.4	192.168.2.16
Oct 1, 2024 17:18:39.916268110 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.916409969 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.916508913 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.916564941 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:39.916594028 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.916678905 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.916785002 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:39.916793108 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.916840076 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:39.921803951 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.921952009 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.922246933 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:39.922252893 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.922739983 CEST	49724	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:18:39.928098917 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.928159952 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:39.928168058 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.934395075 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.934458017 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:39.934463978 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:39.986704111 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.006787062 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.006946087 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.007016897 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.007025957 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.011701107 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.011797905 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.011873007 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.011881113 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.012393951 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.017771006 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.023952007 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.024035931 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.024223089 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.024233103 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.024293900 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.030412912 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.036561966 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.036618948 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.036626101 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.042357922 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.042459965 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.042514086 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.042521954 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.042954922 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.048157930 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.054168940 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.054234982 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.054240942 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.059999943 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.060081959 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.060154915 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.060162067 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.060384035 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.065814018 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.065949917 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.066004992 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.066011906 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.097050905 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.097114086 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.097121954 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.097206116 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.097264051 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.097270012 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.097470045 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.097560883 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.097614050 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.097620010 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.097848892 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.102061987 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.102734089 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.102790117 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.102796078 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.108799934 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.108856916 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.108863115 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.114617109 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.114690065 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.114696980 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.120337009 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.120395899 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.120402098 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.125721931 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.125780106 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.125787020 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.130956888 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.131108999 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.131118059 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.136687994 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.136744022 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.136750937 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.141616106 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.141686916 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.141695976 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.146770954 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.146830082 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.146842003 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.151103973 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.151153088 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.151159048 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.155524015 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.155589104 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.155595064 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.159868956 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.160552025 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.160558939 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.164463997 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.164518118 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.164524078 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.167916059 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.167968035 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.167973995 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.171663046 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.171720982 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.171727896 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.175537109 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.175592899 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.175599098 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.179373026 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.179435015 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.179440975 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.183456898 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.183516979 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.183521986 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.185687065 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.185743093 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.185749054 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.188014030 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.188065052 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.188071012 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.190257072 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.190310955 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.190323114 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.192547083 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.192605019 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.192610979 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.194902897 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.194966078 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.194971085 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.197258949 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.197315931 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.197323084 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.199615002 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.199680090 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.199685097 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.201796055 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.201852083 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.201858044 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.204000950 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.204056025 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.204061985 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.206320047 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.206377983 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.206382990 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.208646059 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.208700895 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.208707094 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.211007118 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.211062908 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.211069107 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.213357925 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.213416100 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.213422060 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.215701103 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.215754986 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.215760946 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.218034983 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.218089104 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.218095064 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.220451117 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.220511913 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.220516920 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.220972061 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.221066952 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.221210003 CEST	49722	443	192.168.2.16	142.250.186.142
Oct 1, 2024 17:18:40.221226931 CEST	443	49722	142.250.186.142	192.168.2.16
Oct 1, 2024 17:18:40.234378099 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:40.234436989 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:40.234512091 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:40.234697104 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:40.234714031 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:40.263340950 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:40.268378019 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.295243025 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.295296907 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.295367002 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.295366049 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.295423985 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.295578003 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.295591116 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.295607090 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.295758963 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.295773029 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.418818951 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 17:18:40.442411900 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.442425013 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.442435980 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.442487955 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:40.442543983 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.442656040 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.442698002 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:40.443265915 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.443275928 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.443286896 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.443296909 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.443320990 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:40.443347931 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:40.444266081 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.444309950 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.444319963 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.444365025 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:40.444432974 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.444488049 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.444530964 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:40.445710897 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.445797920 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:18:40.446002960 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:18:40.448401928 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:40.453205109 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.551542997 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.551662922 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.551672935 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.551681995 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.551693916 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.551711082 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.551826000 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:40.551826000 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:40.552488089 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.552680969 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.552690983 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.552702904 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.552735090 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:40.552748919 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:40.552808046 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.553227901 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.553239107 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.553248882 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.553276062 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:40.553297043 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:40.553308010 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:18:40.594732046 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:18:40.747399092 CEST	80	49707	192.64.119.117	192.168.2.16
Oct 1, 2024 17:18:40.748524904 CEST	49707	80	192.168.2.16	192.64.119.117
Oct 1, 2024 17:18:40.847570896 CEST	49707	80	192.168.2.16	192.64.119.117
Oct 1, 2024 17:18:40.852405071 CEST	80	49707	192.64.119.117	192.168.2.16
Oct 1, 2024 17:18:40.896182060 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:40.898228884 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:40.898257017 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:40.901695967 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:40.901794910 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:40.903054953 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:40.903139114 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:40.903181076 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:40.930423021 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.930799007 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.930830002 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.931138039 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.931149960 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.931195021 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.931204081 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.931235075 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.931258917 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.931765079 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.937952042 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.938007116 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.939989090 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.939997911 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:40.943430901 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:40.944432974 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:40.944439888 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:40.990730047 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:40.992269993 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.024202108 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.024693012 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:41.024755955 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.025141954 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.025156975 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.025222063 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:41.025243998 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.025293112 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:41.025866985 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.026042938 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:41.026117086 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.026401043 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:41.026415110 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.068712950 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:41.175008059 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.175136089 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.175194979 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.175219059 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.175321102 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.175368071 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.175375938 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.180628061 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.180702925 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.180710077 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.180778027 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.180829048 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.180835962 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.186834097 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.186914921 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.186923027 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.193229914 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.193289995 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.193298101 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.205281019 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.205833912 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.205904961 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:41.206140995 CEST	49726	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:41.206197977 CEST	443	49726	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.218261957 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.218288898 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.218354940 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.218535900 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.218545914 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.242722034 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.262125969 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.263537884 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.263617039 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.263626099 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.269748926 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.269818068 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.269831896 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.276005030 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.276065111 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.276072025 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.282216072 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.282291889 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.282299042 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.288606882 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.288702011 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.288703918 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.288729906 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.288778067 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.294734955 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.299478054 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.299607038 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.299668074 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:41.300225019 CEST	49727	443	192.168.2.16	172.217.18.1
Oct 1, 2024 17:18:41.300255060 CEST	443	49727	172.217.18.1	192.168.2.16
Oct 1, 2024 17:18:41.300472021 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.300523043 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.300529957 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.302709103 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.302752972 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.302850008 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.303047895 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.303066015 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.306420088 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.306484938 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.306492090 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.312351942 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.312416077 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.312422037 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.318198919 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.318259001 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.318264961 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.324095964 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.324156046 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.324162960 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.324250937 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.324300051 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.324306011 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.348809958 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.348879099 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.348891020 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.349066973 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.349114895 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.349121094 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.350265026 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.350334883 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.350341082 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.353559017 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.353621006 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.353627920 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.357940912 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.358004093 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.358011961 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.362857103 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.362921000 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.362930059 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.366497040 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.366552114 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.366559029 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.370827913 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.370893955 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.370901108 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.375159979 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.375220060 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.375226974 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.379730940 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.379796028 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.379802942 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.383790016 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.383871078 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.383877993 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.388263941 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.388341904 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.388349056 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.392560005 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.392622948 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.392630100 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.396706104 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.396775961 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.396781921 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.401118040 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.401176929 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.401184082 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.405472994 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.405550957 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.405560017 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.409791946 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.409856081 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.409862995 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.414025068 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.414098024 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.414107084 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.418229103 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.418287992 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.418294907 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.422466993 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.422532082 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.422538996 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.426897049 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.426958084 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.426965952 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.430286884 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.430342913 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.430351019 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.434120893 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.434192896 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.434199095 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.437859058 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.437916040 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.437922955 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.441134930 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.441200018 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.441206932 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.443766117 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.443896055 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.443902969 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.445663929 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.445722103 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.445729971 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.447313070 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.447371006 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.447377920 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.449863911 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.449933052 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.449940920 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.451773882 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.451818943 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.451827049 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.451834917 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.451873064 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.453946114 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.456372023 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.456407070 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.456423044 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.456433058 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.456487894 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.458476067 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.460735083 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.460767984 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.460796118 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.460804939 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.460855961 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.462939024 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.465009928 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.465061903 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.465069056 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.468522072 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.468556881 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.468575001 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.468583107 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.468625069 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.470069885 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.470462084 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.470524073 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.470654964 CEST	49725	443	192.168.2.16	142.250.184.238
Oct 1, 2024 17:18:41.470662117 CEST	443	49725	142.250.184.238	192.168.2.16
Oct 1, 2024 17:18:41.619719982 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 17:18:41.766196012 CEST	49734	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:41.766232967 CEST	443	49734	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:41.766304970 CEST	49734	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:41.766361952 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:41.766550064 CEST	49734	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:41.766562939 CEST	443	49734	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:41.811407089 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:41.864449978 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.864675999 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.864686966 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.864989042 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.865000010 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.865053892 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.865060091 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.865098953 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.865593910 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.865777016 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.865827084 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.865889072 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.865894079 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.906732082 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.947828054 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.948054075 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.948076963 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.948389053 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.948400021 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.948458910 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.948467970 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.948513031 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.948988914 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.949142933 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.949199915 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.949270964 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:41.949279070 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:41.967453957 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:41.967744112 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:41.967807055 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:41.967994928 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:41.968034029 CEST	443	49715	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:41.968060017 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:41.968099117 CEST	49715	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.002715111 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:42.070425034 CEST	49689	80	192.168.2.16	192.229.211.108
Oct 1, 2024 17:18:42.134979010 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:42.135055065 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:42.135116100 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:42.135822058 CEST	49730	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:42.135843039 CEST	443	49730	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:42.217689991 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:42.217952967 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:42.218008995 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:42.218640089 CEST	49731	443	192.168.2.16	142.250.185.225
Oct 1, 2024 17:18:42.218661070 CEST	443	49731	142.250.185.225	192.168.2.16
Oct 1, 2024 17:18:42.275727987 CEST	49735	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.275759935 CEST	443	49735	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.275839090 CEST	49735	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.276046038 CEST	49735	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.276062965 CEST	443	49735	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.404135942 CEST	443	49734	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.404457092 CEST	49734	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.404474974 CEST	443	49734	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.404808044 CEST	443	49734	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.405112982 CEST	49734	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.405170918 CEST	443	49734	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.405287981 CEST	49734	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.447406054 CEST	443	49734	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.695235014 CEST	443	49734	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.695688963 CEST	443	49734	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.695842028 CEST	49734	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.695842028 CEST	49734	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.695842028 CEST	49734	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.926354885 CEST	443	49735	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.926634073 CEST	49735	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.926650047 CEST	443	49735	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.926933050 CEST	443	49735	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.927320957 CEST	49735	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.927372932 CEST	443	49735	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.927460909 CEST	49735	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:42.975399971 CEST	443	49735	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:42.977102041 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:42.977185011 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:43.230154991 CEST	443	49735	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:43.230833054 CEST	49735	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:43.230869055 CEST	443	49735	142.250.186.46	192.168.2.16
Oct 1, 2024 17:18:43.230931044 CEST	49735	443	192.168.2.16	142.250.186.46
Oct 1, 2024 17:18:43.679524899 CEST	80	49721	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:43.679727077 CEST	49721	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:44.027715921 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 17:18:44.123317957 CEST	49721	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:44.123369932 CEST	49708	80	192.168.2.16	91.195.240.19
Oct 1, 2024 17:18:44.128240108 CEST	80	49721	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:44.128254890 CEST	80	49708	91.195.240.19	192.168.2.16
Oct 1, 2024 17:18:44.614483118 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:44.614521027 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:44.614659071 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:44.616215944 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:44.616226912 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.410393953 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.410461903 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.413328886 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.413337946 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.413597107 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.464704990 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.473293066 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.519407034 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.713675022 CEST	49740	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:45.713721037 CEST	443	49740	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:45.713807106 CEST	49740	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:45.714662075 CEST	49740	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:45.714680910 CEST	443	49740	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:45.743577003 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.743602037 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.743608952 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.743669033 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.743674994 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.743721008 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.743748903 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.743787050 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.743787050 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.743788958 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.743796110 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.743803024 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.743846893 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.743860006 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.744230032 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.744282007 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.754554987 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.754569054 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:45.754599094 CEST	49739	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:18:45.754604101 CEST	443	49739	4.175.87.197	192.168.2.16
Oct 1, 2024 17:18:46.359664917 CEST	443	49740	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:46.359745026 CEST	49740	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:46.362509966 CEST	49740	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:46.362524033 CEST	443	49740	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:46.362732887 CEST	443	49740	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:46.400039911 CEST	49740	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:46.443434000 CEST	443	49740	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:46.632636070 CEST	443	49740	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:46.632674932 CEST	443	49740	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:46.632736921 CEST	49740	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:46.632843971 CEST	49740	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:46.632843971 CEST	49740	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:46.632863998 CEST	443	49740	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:46.632874966 CEST	443	49740	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:46.675853014 CEST	49741	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:46.675889015 CEST	443	49741	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:46.675966024 CEST	49741	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:46.676197052 CEST	49741	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:46.676209927 CEST	443	49741	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:47.319612026 CEST	443	49741	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:47.319698095 CEST	49741	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:47.320926905 CEST	49741	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:47.320938110 CEST	443	49741	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:47.321166992 CEST	443	49741	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:47.322314024 CEST	49741	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:47.367402077 CEST	443	49741	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:47.606232882 CEST	443	49741	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:47.606302023 CEST	443	49741	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:47.606359005 CEST	49741	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:47.607004881 CEST	49741	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:47.607016087 CEST	443	49741	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:47.607024908 CEST	49741	443	192.168.2.16	184.28.90.27
Oct 1, 2024 17:18:47.607028961 CEST	443	49741	184.28.90.27	192.168.2.16
Oct 1, 2024 17:18:47.677037001 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 17:18:47.977758884 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 17:18:48.580796957 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 17:18:48.832736969 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 17:18:49.751256943 CEST	443	49724	172.217.18.4	192.168.2.16
Oct 1, 2024 17:18:49.751317978 CEST	443	49724	172.217.18.4	192.168.2.16
Oct 1, 2024 17:18:49.751375914 CEST	49724	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:18:49.786801100 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 17:18:50.618328094 CEST	49724	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:18:50.618388891 CEST	443	49724	172.217.18.4	192.168.2.16
Oct 1, 2024 17:18:50.852947950 CEST	80	49706	192.64.119.117	192.168.2.16
Oct 1, 2024 17:18:50.853082895 CEST	49706	80	192.168.2.16	192.64.119.117
Oct 1, 2024 17:18:52.149282932 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 17:18:52.196827888 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 17:18:52.357434034 CEST	49706	80	192.168.2.16	192.64.119.117
Oct 1, 2024 17:18:52.362272024 CEST	80	49706	192.64.119.117	192.168.2.16
Oct 1, 2024 17:18:52.452735901 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 17:18:53.058773994 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 17:18:54.269742012 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 17:18:56.683736086 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 17:18:57.002758026 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 17:18:58.440747023 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 17:19:01.492763996 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 17:19:06.616790056 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 17:19:11.103779078 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 17:19:22.095000029 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:22.095040083 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:22.095138073 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:22.095499039 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:22.095518112 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:22.440047979 CEST	49697	80	192.168.2.16	88.221.110.91
Oct 1, 2024 17:19:22.442301989 CEST	49698	80	192.168.2.16	88.221.110.91
Oct 1, 2024 17:19:22.445305109 CEST	80	49697	88.221.110.91	192.168.2.16
Oct 1, 2024 17:19:22.445390940 CEST	49697	80	192.168.2.16	88.221.110.91
Oct 1, 2024 17:19:22.447457075 CEST	80	49698	88.221.110.91	192.168.2.16
Oct 1, 2024 17:19:22.447513103 CEST	49698	80	192.168.2.16	88.221.110.91
Oct 1, 2024 17:19:22.895503044 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:22.895692110 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:22.897133112 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:22.897141933 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:22.897367954 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:22.898952961 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:22.943412066 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:23.239204884 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:23.239226103 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:23.239238977 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:23.239322901 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:23.239345074 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:23.239408970 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:23.240145922 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:23.240190983 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:23.240207911 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:23.240216017 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:23.240242004 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:23.240242958 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:23.240295887 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:23.242450953 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:23.242463112 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:23.242482901 CEST	49742	443	192.168.2.16	4.175.87.197
Oct 1, 2024 17:19:23.242487907 CEST	443	49742	4.175.87.197	192.168.2.16
Oct 1, 2024 17:19:25.453798056 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:19:25.458741903 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:19:25.565821886 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:19:25.570692062 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:19:39.254960060 CEST	49744	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:19:39.254998922 CEST	443	49744	172.217.18.4	192.168.2.16
Oct 1, 2024 17:19:39.255218983 CEST	49744	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:19:39.255368948 CEST	49744	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:19:39.255379915 CEST	443	49744	172.217.18.4	192.168.2.16
Oct 1, 2024 17:19:39.897489071 CEST	443	49744	172.217.18.4	192.168.2.16
Oct 1, 2024 17:19:39.897861004 CEST	49744	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:19:39.897875071 CEST	443	49744	172.217.18.4	192.168.2.16
Oct 1, 2024 17:19:39.898185015 CEST	443	49744	172.217.18.4	192.168.2.16
Oct 1, 2024 17:19:39.898577929 CEST	49744	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:19:39.898653030 CEST	443	49744	172.217.18.4	192.168.2.16
Oct 1, 2024 17:19:39.953807116 CEST	49744	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:19:49.825937033 CEST	443	49744	172.217.18.4	192.168.2.16
Oct 1, 2024 17:19:49.826004028 CEST	443	49744	172.217.18.4	192.168.2.16
Oct 1, 2024 17:19:49.826112986 CEST	49744	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:19:50.617327929 CEST	49744	443	192.168.2.16	172.217.18.4
Oct 1, 2024 17:19:50.617360115 CEST	443	49744	172.217.18.4	192.168.2.16
Oct 1, 2024 17:20:10.469060898 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:20:10.473993063 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:20:10.581132889 CEST	49714	80	192.168.2.16	205.234.175.175
Oct 1, 2024 17:20:10.585994959 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:20:12.737082005 CEST	49700	80	192.168.2.16	192.229.221.95
Oct 1, 2024 17:20:13.040898085 CEST	49700	80	192.168.2.16	192.229.221.95
Oct 1, 2024 17:20:13.501775980 CEST	80	49700	192.229.221.95	192.168.2.16
Oct 1, 2024 17:20:13.502245903 CEST	80	49700	192.229.221.95	192.168.2.16
Oct 1, 2024 17:20:13.502334118 CEST	49700	80	192.168.2.16	192.229.221.95
Oct 1, 2024 17:20:40.442327976 CEST	80	49712	204.93.142.142	192.168.2.16
Oct 1, 2024 17:20:40.443231106 CEST	49712	80	192.168.2.16	204.93.142.142
Oct 1, 2024 17:20:40.552094936 CEST	80	49714	205.234.175.175	192.168.2.16
Oct 1, 2024 17:20:40.552150011 CEST	49714	80	192.168.2.16	205.234.175.175

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 17:18:34.394781113 CEST	53	62987	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:34.427084923 CEST	53	51870	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:35.297982931 CEST	58336	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:35.298155069 CEST	63774	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:35.311496973 CEST	53	63774	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:35.333514929 CEST	53	58336	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:35.389318943 CEST	53	50256	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:35.841192961 CEST	56242	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:35.841332912 CEST	52214	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:35.862390041 CEST	53	56242	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:36.031114101 CEST	53	52214	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:36.563057899 CEST	57958	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:36.563189030 CEST	59086	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:36.570478916 CEST	53	57958	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:36.571079016 CEST	53	59086	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:36.580346107 CEST	57477	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:36.580490112 CEST	63009	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:36.582549095 CEST	63726	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:36.582771063 CEST	51760	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:36.587122917 CEST	53	57477	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:36.587518930 CEST	53	63009	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:36.589644909 CEST	53	63726	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:36.590570927 CEST	53	51760	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.297049999 CEST	53454	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.297224998 CEST	56129	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.306885004 CEST	53	56129	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.311497927 CEST	53	53454	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.445794106 CEST	52626	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.445945024 CEST	63673	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.452673912 CEST	53	52626	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.453262091 CEST	53	63673	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.727852106 CEST	63776	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.727983952 CEST	50884	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.737195969 CEST	53	50884	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.737664938 CEST	53	63776	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.749237061 CEST	50412	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.749378920 CEST	53890	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.757817984 CEST	53	50412	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.757951975 CEST	53	53890	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.770780087 CEST	55099	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.771163940 CEST	58594	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.779512882 CEST	53	55099	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.781827927 CEST	53	58594	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:37.980715990 CEST	61514	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:37.980860949 CEST	62494	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:38.028913021 CEST	53	62494	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:38.029215097 CEST	53	61514	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:39.189511061 CEST	64938	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:39.189651966 CEST	51201	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:39.196827888 CEST	53	51201	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:39.197268009 CEST	53	64938	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:40.225728035 CEST	64094	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:40.225864887 CEST	65051	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:40.232861996 CEST	53	64094	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:40.233778000 CEST	53	65051	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:40.286717892 CEST	59695	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:40.286850929 CEST	51212	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:40.293668032 CEST	53	59695	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:40.294832945 CEST	53	51212	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:40.349395990 CEST	53	62474	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:40.452080965 CEST	53	63765	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:41.208895922 CEST	63426	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:41.209094048 CEST	55694	53	192.168.2.16	1.1.1.1
Oct 1, 2024 17:18:41.216293097 CEST	53	63426	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:41.217889071 CEST	53	55694	1.1.1.1	192.168.2.16
Oct 1, 2024 17:18:52.364898920 CEST	53	59409	1.1.1.1	192.168.2.16
Oct 1, 2024 17:19:11.429600000 CEST	53	61530	1.1.1.1	192.168.2.16
Oct 1, 2024 17:19:34.358333111 CEST	53	60142	1.1.1.1	192.168.2.16
Oct 1, 2024 17:19:34.360043049 CEST	53	59483	1.1.1.1	192.168.2.16
Oct 1, 2024 17:19:43.842652082 CEST	138	138	192.168.2.16	192.168.2.255
Oct 1, 2024 17:20:02.389066935 CEST	53	57649	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 1, 2024 17:18:36.031183004 CEST	192.168.2.16	1.1.1.1	c25c	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 17:18:35.297982931 CEST	192.168.2.16	1.1.1.1	0xf365	Standard query (0)	creationtch.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:35.298155069 CEST	192.168.2.16	1.1.1.1	0x752e	Standard query (0)	creationtch.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:35.841192961 CEST	192.168.2.16	1.1.1.1	0xf958	Standard query (0)	www.creationtch.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:35.841332912 CEST	192.168.2.16	1.1.1.1	0xce0f	Standard query (0)	www.creationtch.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:36.563057899 CEST	192.168.2.16	1.1.1.1	0xdd5	Standard query (0)	img.sedoparking.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:36.563189030 CEST	192.168.2.16	1.1.1.1	0xc70d	Standard query (0)	img.sedoparking.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:36.580346107 CEST	192.168.2.16	1.1.1.1	0x4d9b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:36.580490112 CEST	192.168.2.16	1.1.1.1	0x6f2f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:36.582549095 CEST	192.168.2.16	1.1.1.1	0x4089	Standard query (0)	img.sedoparking.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:36.582771063 CEST	192.168.2.16	1.1.1.1	0x6a4	Standard query (0)	img.sedoparking.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:37.297049999 CEST	192.168.2.16	1.1.1.1	0xc913	Standard query (0)	img.sedoparking.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:37.297224998 CEST	192.168.2.16	1.1.1.1	0xeef3	Standard query (0)	img.sedoparking.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:37.445794106 CEST	192.168.2.16	1.1.1.1	0xdc11	Standard query (0)	syndicatedsearch.goog	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:37.445945024 CEST	192.168.2.16	1.1.1.1	0xaef0	Standard query (0)	syndicatedsearch.goog	65	IN (0x0001)	false
Oct 1, 2024 17:18:37.727852106 CEST	192.168.2.16	1.1.1.1	0x9957	Standard query (0)	img.sedoparking.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:37.727983952 CEST	192.168.2.16	1.1.1.1	0xb0a	Standard query (0)	img.sedoparking.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:37.749237061 CEST	192.168.2.16	1.1.1.1	0x6dc5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:37.749378920 CEST	192.168.2.16	1.1.1.1	0x6f9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:37.770780087 CEST	192.168.2.16	1.1.1.1	0x515f	Standard query (0)	syndicatedsearch.goog	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:37.771163940 CEST	192.168.2.16	1.1.1.1	0xe3d5	Standard query (0)	syndicatedsearch.goog	65	IN (0x0001)	false
Oct 1, 2024 17:18:37.980715990 CEST	192.168.2.16	1.1.1.1	0x8317	Standard query (0)	www.creationtch.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:37.980860949 CEST	192.168.2.16	1.1.1.1	0xe8b0	Standard query (0)	www.creationtch.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:39.189511061 CEST	192.168.2.16	1.1.1.1	0xd87a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:39.189651966 CEST	192.168.2.16	1.1.1.1	0x3dd8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:40.225728035 CEST	192.168.2.16	1.1.1.1	0x5ad7	Standard query (0)	syndicatedsearch.goog	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:40.225864887 CEST	192.168.2.16	1.1.1.1	0x7c14	Standard query (0)	syndicatedsearch.goog	65	IN (0x0001)	false
Oct 1, 2024 17:18:40.286717892 CEST	192.168.2.16	1.1.1.1	0x2b08	Standard query (0)	afs.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:40.286850929 CEST	192.168.2.16	1.1.1.1	0xa3	Standard query (0)	afs.googleusercontent.com	65	IN (0x0001)	false
Oct 1, 2024 17:18:41.208895922 CEST	192.168.2.16	1.1.1.1	0xa6d6	Standard query (0)	afs.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:41.209094048 CEST	192.168.2.16	1.1.1.1	0x2c41	Standard query (0)	afs.googleusercontent.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 17:18:35.333514929 CEST	1.1.1.1	192.168.2.16	0xf365	No error (0)	creationtch.com		192.64.119.117	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:35.862390041 CEST	1.1.1.1	192.168.2.16	0xf958	No error (0)	www.creationtch.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:35.862390041 CEST	1.1.1.1	192.168.2.16	0xf958	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:36.031114101 CEST	1.1.1.1	192.168.2.16	0xce0f	No error (0)	www.creationtch.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:36.570478916 CEST	1.1.1.1	192.168.2.16	0xdd5	No error (0)	img.sedoparking.com	sedo.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:36.570478916 CEST	1.1.1.1	192.168.2.16	0xdd5	No error (0)	sedo.cachefly.net	vip1.g5.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:36.570478916 CEST	1.1.1.1	192.168.2.16	0xdd5	No error (0)	vip1.g5.cachefly.net		204.93.142.142	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:36.571079016 CEST	1.1.1.1	192.168.2.16	0xc70d	No error (0)	img.sedoparking.com	sedo.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:36.571079016 CEST	1.1.1.1	192.168.2.16	0xc70d	No error (0)	sedo.cachefly.net	vip1.g5.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:36.587122917 CEST	1.1.1.1	192.168.2.16	0x4d9b	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:36.587518930 CEST	1.1.1.1	192.168.2.16	0x6f2f	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 1, 2024 17:18:36.589644909 CEST	1.1.1.1	192.168.2.16	0x4089	No error (0)	img.sedoparking.com	sedo.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:36.589644909 CEST	1.1.1.1	192.168.2.16	0x4089	No error (0)	sedo.cachefly.net	vip1.g5.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:36.589644909 CEST	1.1.1.1	192.168.2.16	0x4089	No error (0)	vip1.g5.cachefly.net		204.93.142.142	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:36.590570927 CEST	1.1.1.1	192.168.2.16	0x6a4	No error (0)	img.sedoparking.com	sedo.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:36.590570927 CEST	1.1.1.1	192.168.2.16	0x6a4	No error (0)	sedo.cachefly.net	vip1.g5.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:37.306885004 CEST	1.1.1.1	192.168.2.16	0xeef3	No error (0)	img.sedoparking.com	sedo.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:37.311497927 CEST	1.1.1.1	192.168.2.16	0xc913	No error (0)	img.sedoparking.com	sedo.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:37.311497927 CEST	1.1.1.1	192.168.2.16	0xc913	No error (0)	sedo.cachefly.net	vip1.g5.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:37.311497927 CEST	1.1.1.1	192.168.2.16	0xc913	No error (0)	vip1.g5.cachefly.net		205.234.175.175	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:37.452673912 CEST	1.1.1.1	192.168.2.16	0xdc11	No error (0)	syndicatedsearch.goog		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:37.737195969 CEST	1.1.1.1	192.168.2.16	0xb0a	No error (0)	img.sedoparking.com	sedo.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:37.737195969 CEST	1.1.1.1	192.168.2.16	0xb0a	No error (0)	sedo.cachefly.net	vip1.g5.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:37.737664938 CEST	1.1.1.1	192.168.2.16	0x9957	No error (0)	img.sedoparking.com	sedo.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:37.737664938 CEST	1.1.1.1	192.168.2.16	0x9957	No error (0)	sedo.cachefly.net	vip1.g5.cachefly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:37.737664938 CEST	1.1.1.1	192.168.2.16	0x9957	No error (0)	vip1.g5.cachefly.net		205.234.175.175	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:37.757817984 CEST	1.1.1.1	192.168.2.16	0x6dc5	No error (0)	www.google.com		142.250.186.36	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:37.757951975 CEST	1.1.1.1	192.168.2.16	0x6f9	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 1, 2024 17:18:37.779512882 CEST	1.1.1.1	192.168.2.16	0x515f	No error (0)	syndicatedsearch.goog		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:38.028913021 CEST	1.1.1.1	192.168.2.16	0xe8b0	No error (0)	www.creationtch.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:38.029215097 CEST	1.1.1.1	192.168.2.16	0x8317	No error (0)	www.creationtch.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:38.029215097 CEST	1.1.1.1	192.168.2.16	0x8317	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:39.196827888 CEST	1.1.1.1	192.168.2.16	0x3dd8	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 1, 2024 17:18:39.197268009 CEST	1.1.1.1	192.168.2.16	0xd87a	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:40.232861996 CEST	1.1.1.1	192.168.2.16	0x5ad7	No error (0)	syndicatedsearch.goog		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:40.293668032 CEST	1.1.1.1	192.168.2.16	0x2b08	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:40.293668032 CEST	1.1.1.1	192.168.2.16	0x2b08	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:40.294832945 CEST	1.1.1.1	192.168.2.16	0xa3	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:41.216293097 CEST	1.1.1.1	192.168.2.16	0xa6d6	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 17:18:41.216293097 CEST	1.1.1.1	192.168.2.16	0xa6d6	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.225	A (IP address)	IN (0x0001)	false
Oct 1, 2024 17:18:41.217889071 CEST	1.1.1.1	192.168.2.16	0x2c41	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

www.creationtch.com

www.google.com

img.sedoparking.com

syndicatedsearch.goog

https:

afs.googleusercontent.com

slscr.update.microsoft.com

fs.microsoft.com

creationtch.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49706	192.64.119.117	80	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 17:18:35.339157104 CEST	430	OUT	GET / HTTP/1.1 Host: creationtch.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 17:18:35.838094950 CEST	293	IN	HTTP/1.1 302 Found Date: Tue, 01 Oct 2024 15:18:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 50 Connection: keep-alive Location: http://www.creationtch.com/ X-Served-By: Namecheap URL Forward Server: namecheap-nginx Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 63 72 65 61 74 69 6f 6e 74 63 68 2e 63 6f 6d 2f 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href='http://www.creationtch.com/'>Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49708	91.195.240.19	80	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 17:18:35.874362946 CEST	434	OUT	GET / HTTP/1.1 Host: www.creationtch.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 17:18:36.548505068 CEST	1236	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 15:18:36 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_olwR5g9c1xMV2nuQ44zGTckrNNrwRPEct3JiWQRpNQJyy9Qr5IWX4b93BQfMjxqcTMuraDbT+07iQy78CB9fsQ== last-modified: Tue, 01 Oct 2024 15:18:36 GMT x-cache-miss-from: parking-75d9cf65f9-d8c6n server: Parking/1.0 content-encoding: gzip Data Raw: 32 43 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 59 eb 72 db 36 16 fe bf 4f c1 aa e3 9d a6 15 25 4a 96 64 89 b2 33 63 27 4e 37 17 bb 51 ea 6c 92 cd 78 32 20 09 8a 88 48 82 25 40 5d a2 d5 cc be c6 be de 3e c9 1e 00 bc 8b 52 ec 4e e3 49 4c 02 38 1f ce e5 3b e7 00 cc f9 0f cf 7f 7b 76 f7 e9 ed b5 e6 f1 c0 7f 7a 2e fe d5 7c 14 ce 2f 5a 38 6c 69 9a 83 38 d2 91 63 f9 d4 5e 2c f0 e6 e2 e6 c5 6a f5 7c f6 e9 d5 6b fa af 97 de d2 be bd 9c 5d 5f 5d cd 2e 9f ff be ba 5c fd 7e f9 ea ea f2 36 dc f8 1f 56 fd e5 9b 4f 03 ef 7d 38 59 19 a3 6f b3 d7 96 f7 fa ca 5d 7e 7d f1 fe 19 73 5e f8 d6 e8 ce 99 79 6b 6b f2 ee e3 87 8f c9 cb 01 3f ed d9 bf d0 b1 fb e9 b7 65 97 8d ff e8 bd f9 f5 ed 1c 9d 3e bf ee bd e9 f2 7f bc 1f bc b9 be bd 79 76 b9 ba be bc 9c 5d 5c 7c a1 fe ea dd 70 3e b1 7b eb 9b 7f f6 c3 64 36 18 7c fb f5 ce 5e c4 b7 b7 f1 ea dd db 6b 9b 9f be 22 1f 66 ef a2 db d9 ab cd 66 32 8b 87 2f 3f 7c 1c 58 93 d3 ab 99 7b f3 75 fd 87 7d 77 93 c4 e8 b9 75 f7 8b 71 46 66 9b b3 f1 b3 ab 89 cb 00 18 4c c7 c8 79 7a 1e 60 8e [TRUNCATED] Data Ascii: 2CBYr6O%Jd3c'N7Qlx2 H%@]>RNIL8;{vz.\|/Z8li8c^,j\|k]_].\~6VO}8Yo]~}s^ykk?e>yv]\\|p>{d6\|^k"ff2/?\|X{u}wuqFfLyz`4C1pWs}1:6Z,WiN{Mb32tiyW!mBUDcl!l".$6KF>uv$HHp,_#FHQfF5K-k5RX&X)]p.v1`qckFfK(,V4#ls%czi5:y4B
Oct 1, 2024 17:18:36.548517942 CEST	1236	IN	Data Raw: 36 60 18 c5 b6 97 ea f2 03 78 c3 27 e1 e2 6f 5a fa 27 c6 fe 45 8b 80 23 5a f9 10 df 44 e0 28 12 a0 39 ee 46 e1 bc 98 f0 62 ec 5e b4 ba 5d 12 cc 3b 0c 3b 34 42 b1 b0 51 e8 d3 e5 38 88 7c c4 31 eb fa 74 4e 59 57 cc 7f 11 8f 1d 09 d1 7d 7a ce f8 06 Data Ascii: 6`x'oZ'E#ZD(9Fb^];;4BQ8\|1tNYW}zBuA\|wlYwy0Knbur?wEn,576{=n:TVB~MT_akAxfxNBm.m$+D6XA\a)km]78x
Oct 1, 2024 17:18:36.548525095 CEST	448	IN	Data Raw: b8 46 43 65 92 1a d5 c8 1c 82 3a 4c d4 0a f0 c1 55 24 88 a0 6d f3 e3 b6 a7 8b 1e 6e 78 5d 60 cf ea bd 05 32 e9 aa e6 4f 0f 2a 2d 9f 6c ae 27 ec b8 de c5 ba 87 ab de 20 b3 a7 7d d3 9a 47 19 00 c6 2f 91 bd 79 4b e1 4a b1 39 6e 43 65 e9 c3 cd 68 16 Data Ascii: FCe:LU$mnx]`2O*-l' }G/yKJ9nCeh{`=cm~9q;f8r[?MR@WUEe$+#XO$gZ%4p>?;GJoZ>kj(Qq3.Qh5I8Hxn
Oct 1, 2024 17:18:36.549412966 CEST	1236	IN	Data Raw: 4b d5 57 2a af f5 87 4d c7 cf bd cf 73 52 89 da e1 2c 8d 85 04 28 e8 0d d4 96 0a ea 3a 4b 6c 61 7a 83 ad fd de 78 7c 3a 2e c5 a3 34 58 24 74 a9 10 ac 75 59 0a aa c0 a6 27 6e e4 0d f0 3d 34 b2 fa 76 0d 3e 1d 7c 38 bc ce 82 bf 42 f5 34 cf f6 b0 ff Data Ascii: KW*MsR,(:Klazx\|:.4X$tuY'n=4v>\|8B4:k;@BGyd8Cui?\|~`+"G,"!M~N2WV#QS(9nl`I,jhikQ4ntAk].qR&VfM)#p o
Oct 1, 2024 17:18:36.549422026 CEST	224	IN	Data Raw: 3e 2a 54 73 27 26 e6 79 fe fb df 70 67 e9 d7 97 b8 cd f4 6b dc e5 7b e8 65 45 74 bc 58 f2 5a 8e 67 89 53 17 ea 5a 0e 52 1a 0c b5 de 52 ef c4 ca 6c fb 91 e9 40 e4 c4 ab 2e db 21 78 22 42 28 b5 36 28 e2 1b 69 c9 0e 7c 70 dd 2a 4c 3c 11 da 23 8f 3b Data Ascii: >Ts'&ypgk{eEtXZgSZRRl@.!x"B(6(i\|pL<#;T2..0-;+e<A\|*CUs^ALw:6h ?M#S#^YZ}xfpG\|'3bOVa]kQ\|"
Oct 1, 2024 17:18:36.549484968 CEST	1236	IN	Data Raw: 3e b9 78 7c dc a7 23 47 c6 47 0c f2 92 5c b2 6f f8 c7 35 1d 39 90 9d 90 78 7d 87 63 f8 8f 90 d8 ba dd 19 94 58 d1 52 d9 f6 60 98 11 07 92 a3 55 5a fe b4 48 b3 1a ab ae d0 73 69 d2 f3 15 26 43 49 cc 7c 25 31 42 d4 b2 a6 8e b4 2f ed 24 46 64 a6 c5 Data Ascii: >x\|#GG\o59x}cXR`UZHsi&CI\|%1B/$FdwWnj8qiE[;8GcaNkGeF{E/z[LjU5GyKM))[2[z{#oXq-~^OB4xEHyl0?#Ft\| B
Oct 1, 2024 17:18:36.549622059 CEST	224	IN	Data Raw: 83 14 14 29 6a 2b 2e a5 16 eb cc 36 a3 3b d3 a5 97 ce 30 32 5d 59 4e c3 cd 52 5e 0a 99 c2 76 22 82 45 b3 90 ae e6 6b f4 3a d3 32 f3 c6 86 36 46 72 ae 3c 62 0c d9 f3 da e4 78 bf 9d f7 b2 1d b9 60 85 c3 ba 32 16 d4 4d 69 ce 37 0d 78 8d 82 c0 2d 1c Data Ascii: )j+.6;02]YNR^v"Ek:26Fr<bx`2Mi7x-/U\U-d764NHAIUy=>$k{%-Xr{6VPKE3O=}y~jib5uo{5VTHR=tP%[ob?eLk
Oct 1, 2024 17:18:36.549741983 CEST	1236	IN	Data Raw: 85 6c 61 b9 a8 65 ff a9 ae df 18 78 33 e8 f7 be 89 fa 82 ea 12 ea d1 8c 80 dc 67 cd eb c4 0e 75 ac 53 8c 28 f2 c3 d7 d8 f3 46 0f b1 cb 0d a3 53 f4 2b d5 f0 dc f7 66 91 e2 55 e6 67 c1 e4 dc 8d 95 14 d2 a1 c4 95 4d 82 73 6b 38 17 1c 74 74 30 f3 0f Data Ascii: laex3guS(FS+fUgMsk8tt0;RsmA=9<P1gSlF[i82YZVuYJi]+1 i.MKW\LH0Mv_tp3?N`
Oct 1, 2024 17:18:36.549977064 CEST	224	IN	Data Raw: d4 8b e2 b6 99 e0 bf e2 64 4e b8 27 be 15 ba 8b 18 aa 47 b5 8b 72 55 90 27 2f 5a 06 02 a4 ac 47 3b 42 5e 1d 80 5e 03 52 96 0b dd f6 bc 4f 04 5a db ac 75 60 ec 80 a2 32 23 81 ce a7 4c d7 c5 af 3b 52 66 7c 06 e3 e8 51 78 73 0d 23 a8 6f 69 f5 d9 44 Data Ascii: dN'GrU'/ZG;B^^ROZu`2#L;Rf\|Qxs#oiDYFMUGbmdDRCL=SKd&1&&:JyRG+B*UP`+N($(((7xz(rA15F\|;{2VqjG+G
Oct 1, 2024 17:18:36.549985886 CEST	1236	IN	Data Raw: ec ff 3e 41 d3 89 97 05 9f d3 88 c1 72 eb e8 f8 f7 7e d1 2d 94 23 62 57 f7 d1 fc 14 8f ad 0b b7 dd 7a d3 b0 96 5b d6 b0 8d 97 c7 3c 35 c7 3c b9 a5 0c 20 e5 cb 2f a3 ec f8 11 96 24 37 c8 03 9f 46 0e 88 fd d4 9b 3d 54 92 c2 2c d2 a6 14 c0 5c c3 3a Data Ascii: >Ar~-#bWz[<5< /$7F=T,\:=:9%vGAm0\c$hQym,$WOdmV)HkNMEfh:^RO {$~LpHtcPt0hB'_X>QTPT(X
Oct 1, 2024 17:18:36.553531885 CEST	345	IN	Data Raw: 5c 5d 38 e9 e4 b9 1c 8b 21 af 1c 09 7e ba ea 00 23 2e 68 32 a0 8c d3 7c fa 9c 84 fc 0c f9 3a 7c 0c 54 0f 4e f5 15 f2 26 1f b0 96 e5 83 17 c8 11 c6 f0 91 2f fa 65 5a ef 7f d8 ff f1 87 77 43 fc 6f 14 1c c8 9c c2 77 f2 f8 f3 f5 e4 2a 4f f9 a4 34 67 Data Ascii: \]8!~#.h2\|:\|TN&/eZwCow*O4g=p]o,=\|v.#~Zoqs~61!>QbVn1}RT~#\|ehXG8,Z$2u)QpI)06bYm
Oct 1, 2024 17:18:37.775608063 CEST	713	OUT	GET /search/tsc.php?ses=ogcSA4H0k2oRlqNjppsa16mMM6tGSicreVZ4J2GgFLbXnWlTQ-bNCtQ8Ma-6Ai86Oj6TRrbkuGpbHKKRoqOrYn76CgMdPyQOeK-9bYtObn0cDJ2x5fmZqo452a1GqZswqaq95CxXMekLC4HBI1v5NiBhw1hVaAFV2haooO-WzxgR7PaCjsUJbW9cwEg8LhsGn996kmo8EGF6oLoUXAIPu1Tvu4jUMcknC7wEOlte1-v4A-998OqE-0H8fAbR75BfU-BpnloE2Gok3cDdWmFO_nKuM9GaEDiB-FofTPeB8Zj14nEn8S7Z39cDHr08vRgPIzRGQq3iaNtJ0-dGGPM5z6AzCfMhcQEnHAvxmDJSUG8FlF0p22RNs3CqkI7&cv=2 HTTP/1.1 Host: www.creationtch.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.creationtch.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 17:18:37.976742983 CEST	181	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 15:18:37 GMT content-type: text/html; charset=UTF-8 content-length: 0 x-cache-miss-from: parking-75d9cf65f9-lw9z8 server: Parking/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49712	204.93.142.142	80	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 17:18:36.596093893 CEST	401	OUT	GET /templates/bg/arrows-curved.png HTTP/1.1 Host: img.sedoparking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.creationtch.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 17:18:37.206073046 CEST	544	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 15:18:37 GMT Content-Type: image/png Content-Length: 13502 Connection: keep-alive Access-Control-Allow-Origin: * Cache-Control: max-age=604800 Expires: Tue, 08 Oct 2024 15:18:37 GMT X-CFHash: "107694ee1e94990d97b7e58651ffd6a0" X-CFF: B Last-Modified: Tue, 12 Oct 2021 05:19:02 GMT X-CF3: H CF4Age: 76651 x-cf-tsc: 1718566112 CF4ttl: 31459348.000 X-CF2: H Server: CFS 1124 X-CF-ReqID: c724e2a9df41c9bc14732d32bc9b29db X-CF1: 11696:fC.bog1:cf:nom:cacheN.bog1-01:H Accept-Ranges: bytes
Oct 1, 2024 17:18:37.206208944 CEST	1236	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 9d 00 00 02 52 08 06 00 00 00 18 89 18 5e 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 Data Ascii: PNGIHDRR^pHYssRGBgAMAa4SIDATx\yFUbUA#VJ?.wUD&AP&Q#qAd\E[Y';{+_<y9ko-J%C)I37oe
Oct 1, 2024 17:18:37.206227064 CEST	1236	IN	Data Raw: 50 e9 00 f5 d9 bf 64 6e a0 ee 50 fd 00 fb a8 74 80 fa ec 5f 32 47 f5 03 1c a0 d2 01 16 8b ea 07 51 a3 d2 01 16 8b ea 07 51 a3 d2 01 96 8f ea 07 d1 a0 d2 01 96 8f ea 07 d1 a0 d2 01 dc 94 2a ad b7 32 ad 36 a8 7e 10 12 42 07 70 9d 96 ae 4e 74 5b 3e Data Ascii: PdnPt_2GQQ26~BpNt[>u.5uS=Ov&7\|W~h+ov7[__Q%5M65*%}Y~RWZ:Ygou'Zg?t@5t)AHN$Q&u!
Oct 1, 2024 17:18:37.206235886 CEST	448	IN	Data Raw: 76 9e 89 36 42 e7 b0 50 03 88 c1 03 00 55 99 eb 8c 36 42 e7 68 36 80 b6 76 d5 ce 46 28 63 d8 a5 c1 03 5a 6f 00 e6 31 f3 28 35 a1 33 81 fc 9a 06 ad 36 42 d9 07 94 87 8f f9 9e 33 78 00 60 0e 33 8d 52 13 3a 53 2a 36 a2 be fb e3 0b 95 1f 0f b1 0c b4 Data Ascii: v6BPU6Bh6vF(cZo1(536B3x`3R:S*6jQjBgVW3tBY`SR:f)M<N RZo&4B.hNu"Bg1RS}x``c7:c<7<J8AuL/tS\2`!t
Oct 1, 2024 17:18:37.206293106 CEST	1236	IN	Data Raw: f9 d8 7a 6b ad bf b2 2a a7 4e ad d3 7a 03 9c 37 36 70 2c 42 27 52 de ef f9 39 ff fa ba f9 f1 bd ca c8 35 e0 9c 23 03 c7 22 74 22 67 c2 a7 67 5a 6f 1b 01 b4 de ec d4 db aa 00 58 a6 63 03 c7 22 74 50 48 95 34 36 b6 d5 a7 5b 5e b6 de 38 ed 00 58 2e Data Ascii: zkNz76p,B'R95#"t"ggZoXc"tPH46[^8X.-8'NmM4,=QM8Ix7&SE`pTc*5\2?6\|`r3E`^yuk)8A\|?D_UZ
Oct 1, 2024 17:18:37.206302881 CEST	1236	IN	Data Raw: f5 19 42 08 70 06 63 d8 70 ce dc a1 33 aa b9 f6 ca 6a e3 33 8d 35 42 08 70 4a 3a 5c 07 da da d9 d9 ee a6 5d 46 77 b1 1c 95 87 ce a8 22 84 1a 92 ac 9b f5 a0 33 c2 09 b3 c0 d2 15 eb 40 59 26 77 68 c3 61 91 6a 0f 9d 51 b6 1d 37 90 6c 4d 69 39 6b 2a Data Ascii: Bpcp3j35BpJ:\]Fw"3@Y&whajQ7lMi9k*5,<tFohNB:eTAsR43IaOTUPK(Zq]Bp:tA\8 h$NmiD+QkH~tR=aSV[WPJ57C<`
Oct 1, 2024 17:18:37.206314087 CEST	1236	IN	Data Raw: 5f 5a 6f 8c 5c 03 51 32 c1 93 98 e0 39 9f ca 9c 08 1d 77 78 37 78 c0 c8 35 10 05 f3 bb b1 7e f1 67 3f fa d6 86 54 80 d0 71 4f df 7c 8f 3b 5e b6 de 18 b9 06 42 a3 b5 1a 5c 79 ef ad ef b4 a5 22 84 8e cb 94 ee 66 a2 6e f9 72 e2 01 23 d7 40 40 b4 7e Data Ascii: _Zo\Q29wx7x5~g?TqO\|;^B\y"fnr#@@~8/~\|B^X<e8C[>rKoT640)`p^c:[o>m88pm8aW:A7Zohon[DXNiKo},Fi5SwY0B
Oct 1, 2024 17:18:37.206330061 CEST	1236	IN	Data Raw: 07 58 ae 94 00 42 4c 08 1d c0 1d 07 6b 40 9f 0e 76 ba 0c 21 20 44 ea df 3c fb dd 1b 4a ab ab a2 84 c3 fe 00 87 14 53 70 8c 61 23 24 aa 78 e3 cb ad ef b6 cc 3b 67 24 51 6b 5a cb 1a 21 04 38 44 e9 ae 0d a0 ed 44 ee 7c f8 b7 2f 47 71 ad 31 c2 a4 8e Data Ascii: XBLk@v! D<JSpa#$x;g$QkZ!8DD\|/Gq1DB-{pE:\|&5{TApS{l6$[S:K+pJj BgU([igZqZqpA%SVTA\| 1&LwN$]BPy~N*Smhn
Oct 1, 2024 17:18:37.206341028 CEST	1236	IN	Data Raw: 63 dd 07 88 cf 70 4f cf 0d 71 44 22 98 9a 09 e9 4b aa 91 dd b5 81 fd a5 67 be e3 45 0b eb 83 de cb ed 7f bc fb d2 57 92 6c f0 bc 69 19 76 05 40 f8 b4 dc cd b2 a4 2d 0e a1 d2 a9 86 77 83 07 ac fb 00 81 d3 d2 fe 58 ef 5c 77 ed 90 50 42 a7 62 be 1d Data Ascii: cpOqD"KgEWliv@-wX\wPBb8Q;@8O>x})KpF:Q;t"?r[F,7FiytviBgkq)-w:9#\|m,ye;W\>Zor,#'!t
Oct 1, 2024 17:18:37.206350088 CEST	552	IN	Data Raw: 9d 6d ed aa 95 8d 58 d7 7f aa f2 b8 5a b2 cf f5 49 d3 04 d3 e7 6d 40 d9 f7 f3 90 da ff 44 b3 f8 7a 2d aa 59 fe fb 27 3a 1e c8 84 88 16 39 b4 79 d3 54 65 e9 fe df af cc e7 74 7f ff cb e4 fd 24 93 87 7b 92 6c d1 4e 5b 1e 42 07 38 8e 1d 40 48 a4 bd Data Ascii: mXZIm@Dz-Y':9yTet${lN[B8@H-LF :lIvG6CZcxPSEuw6\x\|D$TG;+BXgO.UbAB,=s9RrVQekA*]{(ib#LjI.7
Oct 1, 2024 17:18:37.211235046 CEST	1236	IN	Data Raw: 57 6f 0a 96 ca 89 d0 29 b3 01 94 49 76 43 68 bf 01 a8 1e c1 b3 64 ce 85 4e d9 17 ff e8 5b eb 8d 86 ba 48 fb 0d 40 65 b4 ee ec 6c 37 2e 33 1a be 1c 4e 87 4e e1 e0 24 6c 51 df 13 aa 1f 00 f3 4b 77 24 f9 3a 83 0d 8b e7 45 e8 94 95 a6 df 2e 0a 00 cc Data Ascii: Wo)IvChdN[H@el7.3NN$lQKw$:E..,w#XB@NAe+\B`j,LSXm^Z}`XYB~Wo~!W-u7k{v2`ZZO7iUO}66\|?5/[D:w&Lv[FC,5/
Oct 1, 2024 17:18:40.263340950 CEST	400	OUT	GET /templates/logos/sedo_logo.png HTTP/1.1 Host: img.sedoparking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.creationtch.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 17:18:40.442411900 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 15:18:40 GMT Content-Type: image/png Content-Length: 15086 Connection: keep-alive Access-Control-Allow-Origin: * Cache-Control: max-age=604800 Expires: Tue, 08 Oct 2024 15:18:40 GMT X-CFHash: "def00c11b1596db4efee6a9fbe64fc27" X-CFF: B Last-Modified: Mon, 11 Jan 2021 07:44:34 GMT X-CF3: H CF4Age: 0 x-cf-tsc: 1718541930 CF4ttl: 31536000.000 X-CF2: H Server: CFS 1124 X-CF-ReqID: d5fcc7abc4b0e7ec7e7e9105c65eeb13 X-CF1: 11696:fC.bog1:cf:nom:cacheN.bog1-01:H Accept-Ranges: bytes Data Raw: 00 00 01 00 03 00 30 30 00 00 01 00 20 00 a8 25 00 00 36 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 de 25 00 00 10 10 00 00 01 00 20 00 68 04 00 00 86 36 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8f 40 04 01 8e 40 03 04 8e 40 03 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8e 40 03 04 8b 41 07 11 8d 41 04 20 8d 41 04 20 8d 41 04 20 8e 41 03 2e 8d 41 04 20 8d 41 04 20 8b 41 07 11 8e 40 03 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8f 40 04 01 8e 40 03 04 8f 40 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8f 40 04 01 8e 40 03 04 8f 40 04 01 00 00 00 00 00 00 00 00 00 00 00 00 8e 40 03 04 8e 41 03 2e [TRUNCATED] Data Ascii: 00 %6 % h6(0` $@@@@AA A A A.A A A@@@@@@@@A.AU@@@@@@@@@@@@@@@@}AUA @@@@@A.@j@@@@@@@@@@@@@@@@@@@@@@@@}A.@@@A @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49714	205.234.175.175	80	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 17:18:37.317303896 CEST	302	OUT	GET /templates/bg/arrows-curved.png HTTP/1.1 Host: img.sedoparking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 17:18:37.793832064 CEST	540	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 15:18:37 GMT Content-Type: image/png Content-Length: 13502 Connection: keep-alive Access-Control-Allow-Origin: * Cache-Control: max-age=604800 Expires: Tue, 08 Oct 2024 15:18:37 GMT X-CFHash: "107694ee1e94990d97b7e58651ffd6a0" X-CFF: B Last-Modified: Tue, 12 Oct 2021 05:19:02 GMT X-CF3: H CF4Age: 0 x-cf-tsc: 1697895099 CF4ttl: 31536000.000 X-CF2: H Server: CFS 1124 X-CF-ReqID: aa359683059125d4d247447e6ac803d8 X-CF1: 11696:fQ.iad2:cf:nom:cacheN.iad2-01:H Accept-Ranges: bytes
Oct 1, 2024 17:18:37.794162989 CEST	1236	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 9d 00 00 02 52 08 06 00 00 00 18 89 18 5e 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 Data Ascii: PNGIHDRR^pHYssRGBgAMAa4SIDATx\yFUbUA#VJ?.wUD&AP&Q#qAd\E[Y';{+_<y9ko-J%C)I37oe
Oct 1, 2024 17:18:37.794174910 CEST	1236	IN	Data Raw: 50 e9 00 f5 d9 bf 64 6e a0 ee 50 fd 00 fb a8 74 80 fa ec 5f 32 47 f5 03 1c a0 d2 01 16 8b ea 07 51 a3 d2 01 16 8b ea 07 51 a3 d2 01 96 8f ea 07 d1 a0 d2 01 96 8f ea 07 d1 a0 d2 01 dc 94 2a ad b7 32 ad 36 a8 7e 10 12 42 07 70 9d 96 ae 4e 74 5b 3e Data Ascii: PdnPt_2GQQ26~BpNt[>u.5uS=Ov&7\|W~h+ov7[__Q%5M65*%}Y~RWZ:Ygou'Zg?t@5t)AHN$Q&u!
Oct 1, 2024 17:18:37.794186115 CEST	1236	IN	Data Raw: 76 9e 89 36 42 e7 b0 50 03 88 c1 03 00 55 99 eb 8c 36 42 e7 68 36 80 b6 76 d5 ce 46 28 63 d8 a5 c1 03 5a 6f 00 e6 31 f3 28 35 a1 33 81 fc 9a 06 ad 36 42 d9 07 94 87 8f f9 9e 33 78 00 60 0e 33 8d 52 13 3a 53 2a 36 a2 be fb e3 0b 95 1f 0f b1 0c b4 Data Ascii: v6BPU6Bh6vF(cZo1(536B3x`3R:S*6jQjBgVW3tBY`SR:f)M<N RZo&4B.hNu"Bg1RS}x``c7:c<7<J8AuL/tS\2`!t
Oct 1, 2024 17:18:37.794195890 CEST	672	IN	Data Raw: dc 62 3d d4 7b fa 4a ef 7f 5f e8 88 27 08 1d a0 1a 79 f5 13 f2 be 9f 49 e4 57 34 64 49 4b 94 5e 63 30 a1 76 4b 3f 47 6d 16 84 0e 50 b1 e2 c0 d1 10 4f 3d 98 d6 f0 94 84 56 5e 0d 89 5e 33 cf 35 36 84 9a 82 f9 38 76 ca c0 34 08 1d a0 46 a1 9e f9 36 Data Ascii: b={J_'yIW4dIK^c0vK?GmPO=V^^3568v4F6 2/M)x8,FkBk}0zsL>vgU\qh)<sXTcM6?G8HROP%eQ_kvi:?Ilm!5xS
Oct 1, 2024 17:18:37.794205904 CEST	1236	IN	Data Raw: 09 99 57 f7 86 d5 50 4a 35 14 37 ef 43 a7 8c 00 02 3c 60 aa 21 ad 94 0d 1e 82 28 42 41 85 4e d9 41 00 65 fa 2a 6b 40 80 e3 4a 41 94 88 3c b0 ad b9 47 8f f6 7a ec 19 0a 4f b0 a1 53 56 ac 01 99 32 ff 9a 30 05 07 f8 63 4c 18 89 ec a5 f7 99 9a f3 56 Data Ascii: WPJ57C<`!(BANAek@JA<GzOSV20cLVSf-/i0H_nd)[z?H%DB2tI6$Km05;}_+j(FEZtO^"{??J.1DfS:}&k~
Oct 1, 2024 17:18:37.794214964 CEST	1236	IN	Data Raw: 07 ef 46 ae 69 bd 01 35 53 d9 cd 77 df fa f6 0d 59 30 42 27 3a a6 f5 e6 e7 69 07 b4 de 80 aa 2c 29 70 f2 7f 35 a1 13 27 df 46 ae 2d ce 7a 03 e6 56 e9 39 6a b3 20 74 e0 df c8 35 d7 6b 03 d3 b3 a7 0c 24 d9 8b 55 9e a3 36 0b 42 07 85 54 8b b4 b3 4c Data Ascii: Fi5SwY0B':i,)p5'F-zV9j t5k$U6BTLmzu6,'Xi:uH9)BGp:<=i7"t0}?W\e1Z) t0v,;v8uNkT8(BpbAZI:wG\|CsRj
Oct 1, 2024 17:18:37.794224977 CEST	1236	IN	Data Raw: 84 1e ed 6d f7 68 c7 a1 6e b5 86 ce a8 bc 0d a7 1a 97 b4 c8 19 a5 02 be 4f 03 f0 57 cf ac 09 f5 cc 2f 8a 5d 06 13 50 87 85 86 4e 19 01 04 78 a1 6f aa a1 9e 6d c9 69 a5 7a 0c 27 60 5e 4b 0b 9d 32 02 08 f0 4a aa 95 a9 88 b4 be 67 83 68 2f d1 29 15 Data Ascii: mhnOW/]PNxomiz'`^K2Jgh/)&D@=c8:eL5!WO@e}x9:e_n}RUd]g_@]B7S`fN}~?Ff)I=P~.tJ,?@6lH>t~WcyxM
Oct 1, 2024 17:18:37.794239044 CEST	1236	IN	Data Raw: 1e af 5a 6f 9c 72 0d 2c 83 bb 23 d1 27 21 74 dc 95 9a 97 f6 8e 24 9b be b4 de 38 e5 1a a8 9f eb 23 d1 27 21 74 3c 60 5b 6f 9c 76 00 44 4e cb c3 44 e9 17 5d 1f 89 3e 09 a1 e3 11 df 2e 99 a3 f5 06 54 c3 4e a8 29 ad cf 7d d0 7b d9 9b 43 86 8f 42 e8 Data Ascii: Zor,#'!t$8#'!t<`[ovDND]>.TN)}{CBkNo#'!t<%s>p:m=?-0:Qz1ayw^:JV]nyzc1Y:zm&:mA~c{.:qnA8
Oct 1, 2024 17:18:37.794297934 CEST	328	IN	Data Raw: 4c 6a f4 03 bf fb cc b7 d6 12 49 2e 99 37 cf 98 97 a6 00 58 b6 fd 73 e1 ec 40 02 21 04 cf a9 e3 3e f9 a5 3f be d0 92 c1 ca 25 f3 e6 19 53 09 71 01 14 e0 86 83 10 92 41 72 8f 76 1c 7c a2 26 fd c2 bc 0d a7 b2 b3 a2 f5 3a 6b 40 80 3b 0e da 71 89 ea Data Ascii: LjI.7Xs@!>?%SqArv\|&:k@;qjc\6q@Kf2ppjSzTDDXC6$(GcTier!HAF&Cj<tv";=~Hj }ZuBB}@@IGJ
Oct 1, 2024 17:18:37.800697088 CEST	1236	IN	Data Raw: 57 6f 0a 96 ca 89 d0 29 b3 01 94 49 76 43 68 bf 01 a8 1e c1 b3 64 ce 85 4e d9 17 ff e8 5b eb 8d 86 ba 48 fb 0d 40 65 b4 ee ec 6c 37 2e 33 1a be 1c 4e 87 4e e1 e0 24 6c 51 df 13 aa 1f 00 f3 4b 77 24 f9 3a 83 0d 8b e7 45 e8 94 95 a6 df 2e 0a 00 cc Data Ascii: Wo)IvChdN[H@el7.3NN$lQKw$:E..,w#XB@NAe+\B`j,LSXm^Z}`XYB~Wo~!W-u7k{v2`ZZO7iUO}66\|?5/[D:w&Lv[FC,5/
Oct 1, 2024 17:18:40.448401928 CEST	301	OUT	GET /templates/logos/sedo_logo.png HTTP/1.1 Host: img.sedoparking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 17:18:40.551542997 CEST	564	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 15:18:40 GMT Content-Type: image/png Content-Length: 15086 Connection: keep-alive Access-Control-Allow-Origin: * Cache-Control: max-age=604800 Expires: Tue, 08 Oct 2024 15:18:40 GMT X-CFHash: "def00c11b1596db4efee6a9fbe64fc27" X-CFF: B Last-Modified: Mon, 11 Jan 2021 07:44:34 GMT X-CF3: H x-cf-rand: 5.010 CF4Age: 2099882 x-cf-tsc: 1699994980 CF4ttl: 29436118.000 X-CF2: H Server: CFS 1124 X-CF-ReqID: aafced2437b065b5a32922ccbb59442b X-CF1: 11696:fQ.iad2:cf:nom:cacheN.iad2-01:H Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49721	91.195.240.19	80	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 17:18:38.034699917 CEST	675	OUT	GET /search/tsc.php?ses=ogcSA4H0k2oRlqNjppsa16mMM6tGSicreVZ4J2GgFLbXnWlTQ-bNCtQ8Ma-6Ai86Oj6TRrbkuGpbHKKRoqOrYn76CgMdPyQOeK-9bYtObn0cDJ2x5fmZqo452a1GqZswqaq95CxXMekLC4HBI1v5NiBhw1hVaAFV2haooO-WzxgR7PaCjsUJbW9cwEg8LhsGn996kmo8EGF6oLoUXAIPu1Tvu4jUMcknC7wEOlte1-v4A-998OqE-0H8fAbR75BfU-BpnloE2Gok3cDdWmFO_nKuM9GaEDiB-FofTPeB8Zj14nEn8S7Z39cDHr08vRgPIzRGQq3iaNtJ0-dGGPM5z6AzCfMhcQEnHAvxmDJSUG8FlF0p22RNs3CqkI7&cv=2 HTTP/1.1 Host: www.creationtch.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 17:18:38.678834915 CEST	181	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 15:18:38 GMT content-type: text/html; charset=UTF-8 content-length: 0 x-cache-miss-from: parking-75d9cf65f9-b9tc5 server: Parking/1.0
Oct 1, 2024 17:18:38.941144943 CEST	181	IN	HTTP/1.1 200 OK date: Tue, 01 Oct 2024 15:18:38 GMT content-type: text/html; charset=UTF-8 content-length: 0 x-cache-miss-from: parking-75d9cf65f9-b9tc5 server: Parking/1.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49711	216.58.206.36	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:37 UTC	452	OUT	GET /adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://www.creationtch.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:37 UTC	845	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Content-Length: 153198 Date: Tue, 01 Oct 2024 15:18:37 GMT Expires: Tue, 01 Oct 2024 15:18:37 GMT Cache-Control: private, max-age=3600 ETag: "16155903164772261079" X-Content-Type-Options: nosniff Link: <https://syndicatedsearch.goog>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 15:18:37 UTC	545	IN	Data Raw: 69 66 28 21 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 29 7b 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 3d 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 41 6c 74 4c 6f 61 64 65 72 3d 33 3b 76 61 72 20 73 66 66 65 44 61 74 61 5f 3d 7b 73 65 72 76 69 63 65 5f 68 6f 73 74 3a 22 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 68 61 73 68 3a 22 31 37 33 38 33 36 33 33 34 36 34 33 37 30 36 31 35 35 35 33 22 2c 70 61 63 6b 61 67 65 73 3a 22 64 6f 6d 61 69 6e 73 22 2c 6d 6f 64 75 6c 65 3a 22 61 64 73 22 2c 76 65 72 73 69 6f 6e 3a 22 31 22 2c 6d 3a 7b 63 65 69 3a 22 31 37 33 30 31 34 33 37 2c 31 37 33 30 31 34 33 39 2c 31 37 33 Data Ascii: if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"17383633464370615553",packages:"domains",module:"ads",version:"1",m:{cei:"17301437,17301439,173
2024-10-01 15:18:37 UTC	1390	IN	Data Raw: 6f 6d 61 69 6e 22 3a 74 72 75 65 2c 22 5f 77 61 69 74 4f 6e 43 6f 6e 73 65 6e 74 46 6f 72 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 45 6e 68 61 6e 63 65 64 54 61 72 67 65 74 69 6e 67 52 73 6f 6e 63 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 4e 6f 6e 62 6c 6f 63 6b 69 6e 67 53 61 73 43 6f 6f 6b 69 65 22 3a 74 72 75 65 7d 2c 6d 64 70 3a 31 38 30 30 30 30 30 2c 73 73 64 6c 3a 22 59 58 42 77 63 33 42 76 64 43 35 6a 62 32 30 73 59 6d 78 76 5a 33 4e 77 62 33 51 75 59 32 39 74 4c 47 4a 79 4c 6d 4e 76 62 53 78 6a 62 79 35 6a 62 32 30 73 59 32 78 76 64 57 52 6d 63 6d 39 75 64 43 35 75 5a 58 51 73 5a 58 55 75 59 32 39 74 4c 47 68 76 63 48 52 76 4c 6d 39 79 5a 79 78 70 62 69 35 75 5a 58 51 73 64 48 4a 68 62 6e 4e 73 59 Data Ascii: omain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsY
2024-10-01 15:18:37 UTC	1390	IN	Data Raw: 61 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 65 7d 3b 76 61 72 20 64 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45 39 3e 3e 3e 30 29 2b 22 5f 22 2c 65 3d 30 3b 72 65 74 75 72 6e 20 62 7d 29 3b 0a 71 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 Data Ascii: a;c.prototype.toString=function(){return this.ne};var d="jscomp_symbol_"+(Math.random()*1E9>>>0)+"_",e=0;return b});q("Symbol.iterator",function(a){if(a)return a;a=Symbol("Symbol.iterator");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Arr
2024-10-01 15:18:37 UTC	1390	IN	Data Raw: 74 20 65 78 74 65 6e 73 69 62 6c 65 22 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 6c 6c 7d 76 61 72 20 70 61 3d 6c 61 3b 0a 66 75 6e 63 74 69 6f 6e 20 71 61 28 61 2c 62 29 7b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6b 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 69 66 28 70 61 29 70 61 28 61 2c 62 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 63 21 3d 22 70 72 6f 74 6f 74 79 70 65 22 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 62 2c 63 29 3b 64 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 Data Ascii: t extensible");return a}:null}var pa=la;function qa(a,b){a.prototype=ka(b.prototype);a.prototype.constructor=a;if(pa)pa(a,b);else for(var c in b)if(c!="prototype")if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProp
2024-10-01 15:18:37 UTC	1390	IN	Data Raw: 69 6f 6e 22 3a 68 3d 21 30 3b 62 72 65 61 6b 20 61 3b 0a 64 65 66 61 75 6c 74 3a 68 3d 21 31 7d 68 3f 74 68 69 73 2e 55 66 28 67 29 3a 74 68 69 73 2e 4c 64 28 67 29 7d 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 55 66 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 76 6f 69 64 20 30 3b 74 72 79 7b 68 3d 67 2e 74 68 65 6e 7d 63 61 74 63 68 28 6b 29 7b 74 68 69 73 2e 62 64 28 6b 29 3b 72 65 74 75 72 6e 7d 74 79 70 65 6f 66 20 68 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 74 68 69 73 2e 67 67 28 68 2c 67 29 3a 74 68 69 73 2e 4c 64 28 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 62 64 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 63 65 28 32 2c 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4c 64 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 Data Ascii: ion":h=!0;break a;default:h=!1}h?this.Uf(g):this.Ld(g)}};b.prototype.Uf=function(g){var h=void 0;try{h=g.then}catch(k){this.bd(k);return}typeof h=="function"?this.gg(h,g):this.Ld(g)};b.prototype.bd=function(g){this.ce(2,g)};b.prototype.Ld=function(g){thi
2024-10-01 15:18:37 UTC	1390	IN	Data Raw: 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 72 2c 74 29 7b 6c 3d 72 3b 6d 3d 74 7d 29 3b 74 68 69 73 2e 69 62 28 6b 28 67 2c 6c 29 2c 6b 28 68 2c 6d 29 29 3b 72 65 74 75 72 6e 20 70 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 69 62 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 0a 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 73 77 69 74 63 68 28 6c 2e 42 29 7b 63 61 73 65 20 31 3a 67 28 6c 2e 58 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 68 28 6c 2e 58 61 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 55 6e 65 78 70 65 63 74 65 64 20 73 74 61 74 65 Data Ascii: new b(function(r,t){l=r;m=t});this.ib(k(g,l),k(h,m));return p};b.prototype.catch=function(g){return this.then(void 0,g)};b.prototype.ib=function(g,h){function k(){switch(l.B){case 1:g(l.Xa);break;case 2:h(l.Xa);break;default:throw Error("Unexpected state
2024-10-01 15:18:37 UTC	1390	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 65 28 6b 29 7b 69 66 28 21 73 61 28 6b 2c 67 29 29 7b 76 61 72 20 6c 3d 6e 65 77 20 63 3b 63 61 28 6b 2c 67 2c 7b 76 61 6c 75 65 3a 6c 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 66 28 6b 29 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 5b 6b 5d 3b 6c 26 26 28 4f 62 6a 65 63 74 5b 6b 5d 3d 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 69 66 28 6d 20 69 6e 73 74 61 6e 63 65 6f 66 20 63 29 72 65 74 75 72 6e 20 6d 3b 4f 62 6a 65 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 65 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6c 3d 4f Data Ascii: unction e(k){if(!sa(k,g)){var l=new c;ca(k,g,{value:l})}}function f(k){var l=Object[k];l&&(Object[k]=function(m){if(m instanceof c)return m;Object.isExtensible(m)&&e(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var k=Object.seal({}),l=O
2024-10-01 15:18:37 UTC	1390	IN	Data Raw: 3a 68 2c 49 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 0a 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 2d 31 2c 49 3a 76 6f 69 64 20 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 68 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 62 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 68 29 7b 68 3d 75 28 68 29 3b 66 6f 72 28 76 61 72 20 6b 3b 21 28 6b 3d 68 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6b 3d 6b 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6b 5b 30 5d 2c 6b 5b 31 5d 29 7d 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d Data Ascii: :h,I:p}}return{id:l,list:m,index:-1,I:void 0}}function e(h){this[0]={};this[1]=b();this.size=0;if(h){h=u(h);for(var k;!(k=h.next()).done;)k=k.value,this.set(k[0],k[1])}}if(function(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!=
2024-10-01 15:18:37 UTC	1390	IN	Data Raw: 79 7d 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 2e 76 61 6c 75 65 7d 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 68 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 65 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 67 3d 30 3b 72 Data Ascii: y})};e.prototype.values=function(){return c(this,function(h){return h.value})};e.prototype.forEach=function(h,k){for(var l=this.entries(),m;!(m=l.next()).done;)m=m.value,h.call(k,m[1],m[0],this)};e.prototype[Symbol.iterator]=e.prototype.entries;var g=0;r
2024-10-01 15:18:37 UTC	1390	IN	Data Raw: 5d 21 3d 62 5b 2d 2d 65 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 65 3c 3d 30 7d 7d 29 3b 0a 71 28 22 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3b 66 6f 72 28 64 20 69 6e 20 62 29 73 61 28 62 2c 64 29 26 26 63 2e 70 75 73 68 28 5b 64 2c 62 5b 64 5d 5d 29 3b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 71 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6e 64 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 61 3a 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 Data Ascii: ]!=b[--e])return!1;return e<=0}});q("Object.entries",function(a){return a?a:function(b){var c=[],d;for(d in b)sa(b,d)&&c.push([d,b[d]]);return c}});q("Array.prototype.find",function(a){return a?a:function(b,c){a:{var d=this;d instanceof String&&(d=String

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49709	204.93.142.142	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:37 UTC	609	OUT	GET /templates/images/hero_nc.svg HTTP/1.1 Host: img.sedoparking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://www.creationtch.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:37 UTC	465	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 15:18:37 GMT Content-Type: image/svg+xml Content-Length: 48097 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * X-CFF: B Last-Modified: Thu, 05 Oct 2023 09:16:15 GMT Vary: Accept-Encoding X-CF3: M CF4Age: 0 x-cf-tsc: 1720683735 CF4ttl: 31536000.000 X-CF2: H Accept-Ranges: bytes Server: CFS 1124 X-CF-ReqID: ca7c2d8a7b63963f35e82969420c5665 X-CF1: 11696:fA.bog1:nom:cacheN.bog1-01:M
2024-10-01 15:18:37 UTC	15919	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 73 76 67 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 53 56 47 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 47 72 61 70 68 69 63 73 2f 53 56 47 2f 31 2e 31 2f 44 54 44 2f 73 76 67 31 31 2e 64 74 64 22 3e 0a 3c 21 2d 2d 20 43 72 65 61 74 6f 72 3a 20 43 6f 72 65 6c 44 52 41 57 20 32 30 31 38 20 28 36 34 2d 42 69 74 29 20 2d 2d 3e 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 3a 73 70 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 20 77 69 64 74 68 3d 22 31 34 34 30 70 78 22 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">... Creator: CorelDRAW 2018 (64-Bit) --><svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="1440px"
2024-10-01 15:18:37 UTC	16384	IN	Data Raw: 20 2d 34 31 2e 38 34 33 32 2c 2d 34 35 2e 38 33 33 34 20 2d 37 34 2e 30 30 35 2c 2d 36 30 2e 30 30 36 34 20 2d 33 32 2e 33 33 36 33 2c 2d 31 34 2e 31 35 31 32 20 2d 36 38 2e 38 33 37 33 2c 2d 32 31 2e 31 35 30 35 20 2d 31 30 39 2e 35 30 33 2c 2d 32 31 2e 31 35 30 35 20 2d 36 37 2e 33 33 32 38 2c 30 20 2d 31 31 38 2e 38 33 35 2c 31 33 2e 39 39 38 36 20 2d 31 35 34 2e 31 35 39 2c 34 31 2e 38 32 31 33 20 2d 33 35 2e 33 32 33 36 2c 32 37 2e 39 39 37 32 20 2d 35 37 2e 38 32 36 2c 36 39 2e 33 33 38 38 20 2d 36 37 2e 36 35 39 39 2c 31 32 34 2e 31 35 36 7a 22 2f 3e 0a 20 20 20 3c 67 6c 79 70 68 20 75 6e 69 63 6f 64 65 3d 22 74 22 20 68 6f 72 69 7a 2d 61 64 76 2d 78 3d 22 32 37 37 22 20 64 3d 22 4d 32 35 36 2e 39 39 20 37 38 2e 34 39 36 38 6c 31 32 2e 30 31 34 34 Data Ascii: -41.8432,-45.8334 -74.005,-60.0064 -32.3363,-14.1512 -68.8373,-21.1505 -109.503,-21.1505 -67.3328,0 -118.835,13.9986 -154.159,41.8213 -35.3236,27.9972 -57.826,69.3388 -67.6599,124.156z"/> <glyph unicode="t" horiz-adv-x="277" d="M256.99 78.4968l12.0144
2024-10-01 15:18:37 UTC	15794	IN	Data Raw: 3d 22 70 61 74 68 36 32 39 22 20 63 6c 61 73 73 3d 22 66 69 6c 31 31 22 20 64 3d 22 4d 34 30 30 2e 31 34 37 20 31 34 31 2e 30 37 37 63 2d 30 2e 34 37 38 2c 2d 30 2e 33 34 31 20 2d 30 2e 39 35 39 2c 2d 30 2e 36 37 39 20 2d 31 2e 34 34 31 2c 2d 31 2e 30 31 32 20 2d 35 2e 32 31 32 2c 2d 33 2e 35 35 20 2d 31 30 2e 36 35 31 2c 2d 36 2e 37 39 38 20 2d 31 36 2e 33 39 32 2c 2d 39 2e 34 34 32 6c 30 20 2d 30 2e 30 37 35 20 34 2e 33 30 36 20 31 2e 39 36 33 63 31 2e 34 33 35 2c 30 2e 36 38 20 32 2e 37 39 35 2c 31 2e 34 33 36 20 34 2e 32 33 2c 32 2e 31 31 35 20 30 2e 36 38 2c 30 2e 33 37 38 20 31 2e 33 36 2c 30 2e 37 35 36 20 32 2e 30 33 39 2c 31 2e 31 33 33 6c 32 2e 30 34 20 31 2e 32 30 39 63 31 2e 33 36 2c 30 2e 37 35 35 20 32 2e 37 31 39 2c 31 2e 36 36 32 20 34 2e Data Ascii: ="path629" class="fil11" d="M400.147 141.077c-0.478,-0.341 -0.959,-0.679 -1.441,-1.012 -5.212,-3.55 -10.651,-6.798 -16.392,-9.442l0 -0.075 4.306 1.963c1.435,0.68 2.795,1.436 4.23,2.115 0.68,0.378 1.36,0.756 2.039,1.133l2.04 1.209c1.36,0.755 2.719,1.662 4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49717	142.250.186.36	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:38 UTC	497	OUT	GET /adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:38 UTC	845	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Content-Length: 153198 Date: Tue, 01 Oct 2024 15:18:38 GMT Expires: Tue, 01 Oct 2024 15:18:38 GMT Cache-Control: private, max-age=3600 ETag: "16155903164772261079" X-Content-Type-Options: nosniff Link: <https://syndicatedsearch.goog>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 15:18:38 UTC	545	IN	Data Raw: 69 66 28 21 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 29 7b 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 3d 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 41 6c 74 4c 6f 61 64 65 72 3d 33 3b 76 61 72 20 73 66 66 65 44 61 74 61 5f 3d 7b 73 65 72 76 69 63 65 5f 68 6f 73 74 3a 22 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 68 61 73 68 3a 22 31 37 33 38 33 36 33 33 34 36 34 33 37 30 36 31 35 35 35 33 22 2c 70 61 63 6b 61 67 65 73 3a 22 64 6f 6d 61 69 6e 73 22 2c 6d 6f 64 75 6c 65 3a 22 61 64 73 22 2c 76 65 72 73 69 6f 6e 3a 22 31 22 2c 6d 3a 7b 63 65 69 3a 22 31 37 33 30 31 34 33 37 2c 31 37 33 30 31 34 33 39 2c 31 37 33 Data Ascii: if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"17383633464370615553",packages:"domains",module:"ads",version:"1",m:{cei:"17301437,17301439,173
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 6f 6d 61 69 6e 22 3a 74 72 75 65 2c 22 5f 77 61 69 74 4f 6e 43 6f 6e 73 65 6e 74 46 6f 72 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 45 6e 68 61 6e 63 65 64 54 61 72 67 65 74 69 6e 67 52 73 6f 6e 63 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 4e 6f 6e 62 6c 6f 63 6b 69 6e 67 53 61 73 43 6f 6f 6b 69 65 22 3a 74 72 75 65 7d 2c 6d 64 70 3a 31 38 30 30 30 30 30 2c 73 73 64 6c 3a 22 59 58 42 77 63 33 42 76 64 43 35 6a 62 32 30 73 59 6d 78 76 5a 33 4e 77 62 33 51 75 59 32 39 74 4c 47 4a 79 4c 6d 4e 76 62 53 78 6a 62 79 35 6a 62 32 30 73 59 32 78 76 64 57 52 6d 63 6d 39 75 64 43 35 75 5a 58 51 73 5a 58 55 75 59 32 39 74 4c 47 68 76 63 48 52 76 4c 6d 39 79 5a 79 78 70 62 69 35 75 5a 58 51 73 64 48 4a 68 62 6e 4e 73 59 Data Ascii: omain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsY
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 61 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 65 7d 3b 76 61 72 20 64 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45 39 3e 3e 3e 30 29 2b 22 5f 22 2c 65 3d 30 3b 72 65 74 75 72 6e 20 62 7d 29 3b 0a 71 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 Data Ascii: a;c.prototype.toString=function(){return this.ne};var d="jscomp_symbol_"+(Math.random()*1E9>>>0)+"_",e=0;return b});q("Symbol.iterator",function(a){if(a)return a;a=Symbol("Symbol.iterator");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Arr
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 74 20 65 78 74 65 6e 73 69 62 6c 65 22 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 6c 6c 7d 76 61 72 20 70 61 3d 6c 61 3b 0a 66 75 6e 63 74 69 6f 6e 20 71 61 28 61 2c 62 29 7b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6b 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 69 66 28 70 61 29 70 61 28 61 2c 62 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 63 21 3d 22 70 72 6f 74 6f 74 79 70 65 22 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 62 2c 63 29 3b 64 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 Data Ascii: t extensible");return a}:null}var pa=la;function qa(a,b){a.prototype=ka(b.prototype);a.prototype.constructor=a;if(pa)pa(a,b);else for(var c in b)if(c!="prototype")if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProp
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 69 6f 6e 22 3a 68 3d 21 30 3b 62 72 65 61 6b 20 61 3b 0a 64 65 66 61 75 6c 74 3a 68 3d 21 31 7d 68 3f 74 68 69 73 2e 55 66 28 67 29 3a 74 68 69 73 2e 4c 64 28 67 29 7d 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 55 66 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 76 6f 69 64 20 30 3b 74 72 79 7b 68 3d 67 2e 74 68 65 6e 7d 63 61 74 63 68 28 6b 29 7b 74 68 69 73 2e 62 64 28 6b 29 3b 72 65 74 75 72 6e 7d 74 79 70 65 6f 66 20 68 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 74 68 69 73 2e 67 67 28 68 2c 67 29 3a 74 68 69 73 2e 4c 64 28 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 62 64 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 63 65 28 32 2c 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4c 64 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 Data Ascii: ion":h=!0;break a;default:h=!1}h?this.Uf(g):this.Ld(g)}};b.prototype.Uf=function(g){var h=void 0;try{h=g.then}catch(k){this.bd(k);return}typeof h=="function"?this.gg(h,g):this.Ld(g)};b.prototype.bd=function(g){this.ce(2,g)};b.prototype.Ld=function(g){thi
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 72 2c 74 29 7b 6c 3d 72 3b 6d 3d 74 7d 29 3b 74 68 69 73 2e 69 62 28 6b 28 67 2c 6c 29 2c 6b 28 68 2c 6d 29 29 3b 72 65 74 75 72 6e 20 70 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 69 62 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 0a 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 73 77 69 74 63 68 28 6c 2e 42 29 7b 63 61 73 65 20 31 3a 67 28 6c 2e 58 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 68 28 6c 2e 58 61 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 55 6e 65 78 70 65 63 74 65 64 20 73 74 61 74 65 Data Ascii: new b(function(r,t){l=r;m=t});this.ib(k(g,l),k(h,m));return p};b.prototype.catch=function(g){return this.then(void 0,g)};b.prototype.ib=function(g,h){function k(){switch(l.B){case 1:g(l.Xa);break;case 2:h(l.Xa);break;default:throw Error("Unexpected state
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 65 28 6b 29 7b 69 66 28 21 73 61 28 6b 2c 67 29 29 7b 76 61 72 20 6c 3d 6e 65 77 20 63 3b 63 61 28 6b 2c 67 2c 7b 76 61 6c 75 65 3a 6c 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 66 28 6b 29 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 5b 6b 5d 3b 6c 26 26 28 4f 62 6a 65 63 74 5b 6b 5d 3d 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 69 66 28 6d 20 69 6e 73 74 61 6e 63 65 6f 66 20 63 29 72 65 74 75 72 6e 20 6d 3b 4f 62 6a 65 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 65 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6c 3d 4f Data Ascii: unction e(k){if(!sa(k,g)){var l=new c;ca(k,g,{value:l})}}function f(k){var l=Object[k];l&&(Object[k]=function(m){if(m instanceof c)return m;Object.isExtensible(m)&&e(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var k=Object.seal({}),l=O
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 3a 68 2c 49 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 0a 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 2d 31 2c 49 3a 76 6f 69 64 20 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 68 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 62 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 68 29 7b 68 3d 75 28 68 29 3b 66 6f 72 28 76 61 72 20 6b 3b 21 28 6b 3d 68 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6b 3d 6b 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6b 5b 30 5d 2c 6b 5b 31 5d 29 7d 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d Data Ascii: :h,I:p}}return{id:l,list:m,index:-1,I:void 0}}function e(h){this[0]={};this[1]=b();this.size=0;if(h){h=u(h);for(var k;!(k=h.next()).done;)k=k.value,this.set(k[0],k[1])}}if(function(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!=
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 79 7d 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 2e 76 61 6c 75 65 7d 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 68 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 65 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 67 3d 30 3b 72 Data Ascii: y})};e.prototype.values=function(){return c(this,function(h){return h.value})};e.prototype.forEach=function(h,k){for(var l=this.entries(),m;!(m=l.next()).done;)m=m.value,h.call(k,m[1],m[0],this)};e.prototype[Symbol.iterator]=e.prototype.entries;var g=0;r
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 5d 21 3d 62 5b 2d 2d 65 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 65 3c 3d 30 7d 7d 29 3b 0a 71 28 22 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3b 66 6f 72 28 64 20 69 6e 20 62 29 73 61 28 62 2c 64 29 26 26 63 2e 70 75 73 68 28 5b 64 2c 62 5b 64 5d 5d 29 3b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 71 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6e 64 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 61 3a 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 Data Ascii: ]!=b[--e])return!1;return e<=0}});q("Object.entries",function(a){return a?a:function(b){var c=[],d;for(d in b)sa(b,d)&&c.push([d,b[d]]);return c}});q("Array.prototype.find",function(a){return a?a:function(b,c){a:{var d=this;d instanceof String&&(d=String

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49716	205.234.175.175	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:38 UTC	371	OUT	GET /templates/images/hero_nc.svg HTTP/1.1 Host: img.sedoparking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:38 UTC	483	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 15:18:38 GMT Content-Type: image/svg+xml Content-Length: 48097 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * X-CFF: B Last-Modified: Thu, 05 Oct 2023 09:16:15 GMT Vary: Accept-Encoding x-cf-rand: 4.749 X-CF3: M CF4Age: 0 x-cf-tsc: 1696583686 CF4ttl: 31536000.000 X-CF2: H Accept-Ranges: bytes Server: CFS 1124 X-CF-ReqID: e2a94cd11321a7f3a6eb657393aeec75 X-CF1: 11696:fM.iad2:nom:cacheN.iad2-01:M
2024-10-01 15:18:38 UTC	15901	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 73 76 67 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 53 56 47 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 47 72 61 70 68 69 63 73 2f 53 56 47 2f 31 2e 31 2f 44 54 44 2f 73 76 67 31 31 2e 64 74 64 22 3e 0a 3c 21 2d 2d 20 43 72 65 61 74 6f 72 3a 20 43 6f 72 65 6c 44 52 41 57 20 32 30 31 38 20 28 36 34 2d 42 69 74 29 20 2d 2d 3e 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 3a 73 70 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 20 77 69 64 74 68 3d 22 31 34 34 30 70 78 22 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">... Creator: CorelDRAW 2018 (64-Bit) --><svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="1440px"
2024-10-01 15:18:38 UTC	16384	IN	Data Raw: 20 2d 31 37 2e 31 38 32 31 2c 2d 32 35 2e 38 33 38 35 20 2d 34 31 2e 38 34 33 32 2c 2d 34 35 2e 38 33 33 34 20 2d 37 34 2e 30 30 35 2c 2d 36 30 2e 30 30 36 34 20 2d 33 32 2e 33 33 36 33 2c 2d 31 34 2e 31 35 31 32 20 2d 36 38 2e 38 33 37 33 2c 2d 32 31 2e 31 35 30 35 20 2d 31 30 39 2e 35 30 33 2c 2d 32 31 2e 31 35 30 35 20 2d 36 37 2e 33 33 32 38 2c 30 20 2d 31 31 38 2e 38 33 35 2c 31 33 2e 39 39 38 36 20 2d 31 35 34 2e 31 35 39 2c 34 31 2e 38 32 31 33 20 2d 33 35 2e 33 32 33 36 2c 32 37 2e 39 39 37 32 20 2d 35 37 2e 38 32 36 2c 36 39 2e 33 33 38 38 20 2d 36 37 2e 36 35 39 39 2c 31 32 34 2e 31 35 36 7a 22 2f 3e 0a 20 20 20 3c 67 6c 79 70 68 20 75 6e 69 63 6f 64 65 3d 22 74 22 20 68 6f 72 69 7a 2d 61 64 76 2d 78 3d 22 32 37 37 22 20 64 3d 22 4d 32 35 36 2e Data Ascii: -17.1821,-25.8385 -41.8432,-45.8334 -74.005,-60.0064 -32.3363,-14.1512 -68.8373,-21.1505 -109.503,-21.1505 -67.3328,0 -118.835,13.9986 -154.159,41.8213 -35.3236,27.9972 -57.826,69.3388 -67.6599,124.156z"/> <glyph unicode="t" horiz-adv-x="277" d="M256.
2024-10-01 15:18:38 UTC	15812	IN	Data Raw: 39 20 30 7a 22 2f 3e 0a 20 20 3c 70 61 74 68 20 69 64 3d 22 70 61 74 68 36 32 39 22 20 63 6c 61 73 73 3d 22 66 69 6c 31 31 22 20 64 3d 22 4d 34 30 30 2e 31 34 37 20 31 34 31 2e 30 37 37 63 2d 30 2e 34 37 38 2c 2d 30 2e 33 34 31 20 2d 30 2e 39 35 39 2c 2d 30 2e 36 37 39 20 2d 31 2e 34 34 31 2c 2d 31 2e 30 31 32 20 2d 35 2e 32 31 32 2c 2d 33 2e 35 35 20 2d 31 30 2e 36 35 31 2c 2d 36 2e 37 39 38 20 2d 31 36 2e 33 39 32 2c 2d 39 2e 34 34 32 6c 30 20 2d 30 2e 30 37 35 20 34 2e 33 30 36 20 31 2e 39 36 33 63 31 2e 34 33 35 2c 30 2e 36 38 20 32 2e 37 39 35 2c 31 2e 34 33 36 20 34 2e 32 33 2c 32 2e 31 31 35 20 30 2e 36 38 2c 30 2e 33 37 38 20 31 2e 33 36 2c 30 2e 37 35 36 20 32 2e 30 33 39 2c 31 2e 31 33 33 6c 32 2e 30 34 20 31 2e 32 30 39 63 31 2e 33 36 2c 30 2e Data Ascii: 9 0z"/> <path id="path629" class="fil11" d="M400.147 141.077c-0.478,-0.341 -0.959,-0.679 -1.441,-1.012 -5.212,-3.55 -10.651,-6.798 -16.392,-9.442l0 -0.075 4.306 1.963c1.435,0.68 2.795,1.436 4.23,2.115 0.68,0.378 1.36,0.756 2.039,1.133l2.04 1.209c1.36,0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49719	142.250.186.142	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:38 UTC	707	OUT	GET /afs/ads/i/iframe.html HTTP/1.1 Host: syndicatedsearch.goog Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: http://www.creationtch.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:38 UTC	1037	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Content-Security-Policy: script-src 'nonce-hQQpXoOzMxplnCpFScep6Q' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui; base-uri 'none' Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Content-Length: 1560 Date: Tue, 01 Oct 2024 15:18:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Last-Modified: Tue, 17 Sep 2024 06:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 15:18:38 UTC	353	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 52 4f 42 4f 54 53 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 61 64 42 6c 6f 63 6b 22 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 68 51 51 70 58 6f 4f 7a 4d 78 70 6c 6e 43 70 46 53 63 65 70 36 51 22 3e 69 66 20 28 77 69 6e 64 6f 77 2e 6e Data Ascii: <!doctype html><html><head><meta name="ROBOTS" content="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta content="origin" name="referrer"></head><body><div id="adBlock"></div><script nonce="hQQpXoOzMxplnCpFScep6Q">if (window.n
2024-10-01 15:18:38 UTC	1207	IN	Data Raw: 61 64 73 65 6e 73 65 2f 73 65 61 72 63 68 2f 61 64 73 2e 6a 73 22 3b 76 61 72 20 68 72 65 66 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 69 66 20 28 21 21 68 72 65 66 20 26 26 20 28 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 27 3f 70 61 63 3d 27 29 20 3e 20 30 20 7c 7c 20 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 27 26 70 61 63 3d 27 29 20 3e 20 30 29 29 20 7b 69 66 20 28 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 27 3f 70 61 63 3d 31 27 29 20 3e 20 30 20 7c 7c 20 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 27 26 70 61 63 3d 31 27 29 20 3e 20 30 29 20 7b 73 63 72 69 70 74 2e 73 72 63 20 2b 3d 20 27 3f 70 61 63 3d 31 27 3b 7d 20 65 6c 73 65 20 69 66 20 28 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 27 3f 70 61 63 3d 32 27 29 20 3e 20 30 20 7c 7c 20 Data Ascii: adsense/search/ads.js";var href = window.location.href;if (!!href && (href.indexOf('?pac=') > 0 \|\| href.indexOf('&pac=') > 0)) {if (href.indexOf('?pac=1') > 0 \|\| href.indexOf('&pac=1') > 0) {script.src += '?pac=1';} else if (href.indexOf('?pac=2') > 0 \|\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49720	142.250.186.142	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:38 UTC	1508	OUT	GET /afs/ads?adsafe=low&adtest=off&psid=3259787283&channel=exp-0051%2Cauxa-control-1%2C44786252&client=dp-sedo80_3ph&r=m&hl=en&ivt=1&rpbu=http%3A%2F%2Fwww.creationtch.com%2Fcaf%2F%3Fses%3DY3JlPTE3Mjc3OTU5MTYmdGNpZD13d3cuY3JlYXRpb250Y2guY29tNjZmYzEyY2M2ZDRmNzQuOTk1NTI2MTAmdGFzaz1zZWFyY2gmZG9tYWluPWNyZWF0aW9udGNoLmNvbSZhX2lkPTMmc2Vzc2lvbj1kRG1EczNra012TjNHYk1oLVBjcw%3D%3D&type=3&uiopt=false&swp=as-drid-2280784292183247&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301511%2C17301516%2C17301266%2C72717108&format=r3%7Cs&nocache=8001727795916463&num=0&output=afd_ads&domain_name=www.creationtch.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1727795916468&u_w=1280&u_h=1024&biw=1263&bih=907&psw=1263&psh=1146&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&nfp=1&jsv=678245571&rurl=http%3A%2F%2Fwww.creationtch.com%2F HTTP/1.1 Host: syndicatedsearch.goog Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: http://www.creationtch.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:38 UTC	807	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Disposition: inline Date: Tue, 01 Oct 2024 15:18:38 GMT Expires: Tue, 01 Oct 2024 15:18:38 GMT Cache-Control: private, max-age=3600 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-cy_cFWcnnZ1RfN9jkN-fSw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Server: gws X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-01 15:18:38 UTC	583	IN	Data Raw: 33 38 64 63 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 68 65 61 64 3e 20 3c 73 74 79 6c 65 20 69 64 3d 22 73 73 72 2d 62 6f 69 6c 65 72 70 6c 61 74 65 22 3e 62 6f 64 79 7b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 20 6d 61 72 67 69 6e 3a 30 3b 7d 2e 64 69 76 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 20 30 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 20 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 7d 2e 73 70 61 6e 3a 6c 61 73 74 2d 63 68 69 6c 64 2c 20 2e 64 69 76 3a 6c 61 73 Data Ascii: 38dc<!doctype html><html lang="en"> <head> <style id="ssr-boilerplate">body{-webkit-text-size-adjust:100%; font-family:arial,sans-serif; margin:0;}.div{-webkit-box-flex:0 0; -webkit-flex-shrink:0; flex-shrink:0;max-width:100%;}.span:last-child, .div:las
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 69 5f 7b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 20 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 20 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 20 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 20 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 7d 2e 76 5f 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 31 20 30 3b 20 2d 77 65 62 6b 69 74 Data Ascii: i_{display:-ms-flexbox; display:-webkit-box; display:-webkit-flex; display:flex;-ms-flex-align:start; -webkit-box-align:start; -webkit-align-items:flex-start; align-items:flex-start;box-sizing:border-box; overflow:hidden;}.v_{-webkit-box-flex:1 0; -webkit
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 5f 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 7d 2e 6f 5f 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 7d 2e 78 5f 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 7d 2e 79 5f 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 7a 2d 69 6e 64 65 78 3a 31 3b 7d 2e 6b 5f 3e 64 69 76 3a 6e 6f 74 28 2e 79 5f 29 20 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 20 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 20 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 69 6e 6c 69 6e 65 2d 66 6c 65 78 62 6f 78 3b 20 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 20 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 Data Ascii: _{overflow:hidden;}.o_{white-space:nowrap;}.x_{cursor:pointer;}.y_{display:none; position:absolute; z-index:1;}.k_>div:not(.y_) {display:-webkit-inline-box; display:-moz-inline-box; display:-ms-inline-flexbox; display:-webkit-inline-flex; display:inline-f
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 73 74 61 72 74 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 7d 2e 66 6c 65 78 41 6c 69 67 6e 42 6f 74 74 6f 6d 7b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 65 6e 64 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 65 6e 64 3b 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 3b 7d 2e 66 6c 65 78 41 6c 69 67 6e 43 65 6e 74 65 72 7b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 Data Ascii: start; align-items:flex-start;}.flexAlignBottom{-ms-flex-align:end; -webkit-box-align:end; -webkit-align-items:flex-end; align-items:flex-end;}.flexAlignCenter{-ms-flex-align:center; -webkit-box-align:center; -webkit-align-items:center; align-items:center
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 72 69 67 68 74 3a 31 30 70 78 3b 77 69 64 74 68 3a 31 30 30 25 3b 20 2d 6d 73 2d 66 6c 65 78 2d 6e 65 67 61 74 69 76 65 3a 31 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 31 20 30 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 31 3b 20 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 31 3b 7d 2e 73 69 31 30 32 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 35 70 78 3b 68 65 69 67 68 74 3a 33 30 70 78 3b 77 69 64 74 68 3a 30 70 78 3b 7d 2e 73 69 31 32 38 7b 68 65 69 67 68 74 3a 31 70 78 3b 77 69 64 74 68 3a 31 30 30 25 3b 20 2d 6d 73 2d 66 6c 65 78 2d 6e 65 67 61 74 69 76 65 3a 31 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 31 20 30 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 31 3b 20 66 6c 65 78 2d 73 68 72 Data Ascii: right:10px;width:100%; -ms-flex-negative:1;-webkit-box-flex:1 0; -webkit-flex-shrink:1; flex-shrink:1;}.si102{border-radius:15px;height:30px;width:0px;}.si128{height:1px;width:100%; -ms-flex-negative:1;-webkit-box-flex:1 0; -webkit-flex-shrink:1; flex-shr
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 2d 6d 73 2d 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 20 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 22 20 64 61 74 61 2d 61 64 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 31 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 5f 20 64 69 76 20 72 73 73 41 74 74 72 43 6f 6e 74 61 69 6e 65 72 22 20 73 74 79 6c 65 3d 22 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 2d 77 65 62 6b 69 74 2d 62 6f Data Ascii: -align:start; -webkit-box-align:start; -webkit-align-items:flex-start; align-items:flex-start;-ms-flex-wrap:wrap; -webkit-flex-wrap:wrap; flex-wrap:wrap;" data-ad-container="1"><div class="i_ div rssAttrContainer" style="-ms-flex-direction:row; -webkit-bo
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 22 69 5f 20 64 69 76 20 73 69 36 39 22 20 73 74 79 6c 65 3d 22 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 20 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 20 2d 77 65 62 6b 69 74 Data Ascii: "i_ div si69" style="-ms-flex-direction:row; -webkit-box-orient:horizontal; -webkit-flex-direction:row; flex-direction:row;-ms-flex-pack:center; -webkit-box-pack:center; -webkit-justify-content:center; justify-content:center;-ms-flex-align:center; -webkit
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 72 65 61 74 69 6f 6e 74 63 68 2e 63 6f 6d 2f 63 61 66 2f 3f 73 65 73 3d 59 33 4a 6c 50 54 45 33 4d 6a 63 33 4f 54 55 35 4d 54 59 6d 64 47 4e 70 5a 44 31 33 64 33 63 75 59 33 4a 6c 59 58 52 70 62 32 35 30 59 32 67 75 59 32 39 74 4e 6a 5a 6d 59 7a 45 79 59 32 4d 32 5a 44 52 6d 4e 7a 51 75 4f 54 6b 31 4e 54 49 32 4d 54 41 6d 64 47 46 7a 61 7a 31 7a 5a 57 46 79 59 32 67 6d 5a 47 39 74 59 57 6c 75 50 57 4e 79 5a 57 46 30 61 57 39 75 64 47 4e 6f 4c 6d 4e 76 62 53 5a 68 58 32 6c 6b 50 Data Ascii: -box-orient:horizontal; -webkit-flex-direction:row; flex-direction:row;"><a href="http://www.creationtch.com/caf/?ses=Y3JlPTE3Mjc3OTU5MTYmdGNpZD13d3cuY3JlYXRpb250Y2guY29tNjZmYzEyY2M2ZDRmNzQuOTk1NTI2MTAmdGFzaz1zZWFyY2gmZG9tYWluPWNyZWF0aW9udGNoLmNvbSZhX2lkP
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 61 62 69 6e 64 65 78 3d 22 2d 31 22 20 63 6c 61 73 73 3d 22 64 69 76 20 71 5f 20 73 69 31 30 32 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 66 73 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 61 64 5f 69 63 6f 6e 73 2f 73 74 61 6e 64 61 72 64 2f 70 75 62 6c 69 73 68 65 72 5f 69 63 6f 6e 5f 69 6d 61 67 65 2f 73 65 61 72 63 68 2e 73 76 67 3f 63 3d 25 32 33 31 39 36 37 64 32 22 20 61 6c 74 3d 22 22 20 6c 6f 61 64 69 6e 67 3d 22 6c 61 7a 79 22 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 5f 20 64 69 76 20 73 69 33 33 22 20 73 74 79 6c 65 3d 22 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 2d 77 65 62 6b 69 Data Ascii: abindex="-1" class="div q_ si102"><img src="https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2" alt="" loading="lazy" class="img"></div></div></div><div class="i_ div si33" style="-ms-flex-direction:row; -webki
2024-10-01 15:18:38 UTC	1390	IN	Data Raw: 6b 58 6e 33 4d 74 56 5a 64 33 6c 45 52 68 77 58 34 64 45 43 6a 38 79 71 34 62 76 74 4b 41 46 69 32 6e 68 64 51 38 26 61 6d 70 3b 70 63 73 61 3d 66 61 6c 73 65 22 20 64 61 74 61 2d 6e 62 3d 22 30 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 20 63 6c 61 73 73 3d 22 69 5f 20 61 20 73 69 31 34 34 22 20 73 74 79 6c 65 3d 22 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 73 74 61 72 74 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 73 74 61 72 74 3b 20 2d Data Ascii: kXn3MtVZd3lERhwX4dECj8yq4bvtKAFi2nhdQ8&pcsa=false" data-nb="0" target="_top" class="i_ a si144" style="-ms-flex-direction:row; -webkit-box-orient:horizontal; -webkit-flex-direction:row; flex-direction:row;-ms-flex-pack:start; -webkit-box-pack:start; -

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49722	142.250.186.142	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:39 UTC	555	OUT	GET /adsense/domains/caf.js?pac=0 HTTP/1.1 Host: syndicatedsearch.goog Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://syndicatedsearch.goog/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:39 UTC	845	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Content-Length: 153214 Date: Tue, 01 Oct 2024 15:18:39 GMT Expires: Tue, 01 Oct 2024 15:18:39 GMT Cache-Control: private, max-age=3600 ETag: "17644445104357918825" X-Content-Type-Options: nosniff Link: <https://syndicatedsearch.goog>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 15:18:39 UTC	545	IN	Data Raw: 69 66 28 21 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 29 7b 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 3d 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 41 6c 74 4c 6f 61 64 65 72 3d 33 3b 76 61 72 20 73 66 66 65 44 61 74 61 5f 3d 7b 73 65 72 76 69 63 65 5f 68 6f 73 74 3a 22 73 79 6e 64 69 63 61 74 65 64 73 65 61 72 63 68 2e 67 6f 6f 67 22 2c 68 61 73 68 3a 22 31 37 33 38 33 36 33 33 34 36 34 33 37 30 36 31 35 35 35 33 22 2c 70 61 63 6b 61 67 65 73 3a 22 64 6f 6d 61 69 6e 73 22 2c 6d 6f 64 75 6c 65 3a 22 61 64 73 22 2c 76 65 72 73 69 6f 6e 3a 22 31 22 2c 6d 3a 7b 63 65 69 3a 22 31 37 33 30 31 34 33 37 2c 31 37 33 30 31 Data Ascii: if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"syndicatedsearch.goog",hash:"17383633464370615553",packages:"domains",module:"ads",version:"1",m:{cei:"17301437,17301
2024-10-01 15:18:39 UTC	1390	IN	Data Raw: 65 53 65 72 76 65 72 50 72 6f 76 69 64 65 64 44 6f 6d 61 69 6e 22 3a 74 72 75 65 2c 22 5f 77 61 69 74 4f 6e 43 6f 6e 73 65 6e 74 46 6f 72 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 45 6e 68 61 6e 63 65 64 54 61 72 67 65 74 69 6e 67 52 73 6f 6e 63 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 4e 6f 6e 62 6c 6f 63 6b 69 6e 67 53 61 73 43 6f 6f 6b 69 65 22 3a 74 72 75 65 7d 2c 6d 64 70 3a 31 38 30 30 30 30 30 2c 73 73 64 6c 3a 22 59 58 42 77 63 33 42 76 64 43 35 6a 62 32 30 73 59 6d 78 76 5a 33 4e 77 62 33 51 75 59 32 39 74 4c 47 4a 79 4c 6d 4e 76 62 53 78 6a 62 79 35 6a 62 32 30 73 59 32 78 76 64 57 52 6d 63 6d 39 75 64 43 35 75 5a 58 51 73 5a 58 55 75 59 32 39 74 4c 47 68 76 63 48 52 76 4c 6d 39 79 5a 79 78 70 62 Data Ascii: eServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpb
2024-10-01 15:18:39 UTC	1390	IN	Data Raw: 67 7d 29 7d 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 65 7d 3b 76 61 72 20 64 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45 39 3e 3e 3e 30 29 2b 22 5f 22 2c 65 3d 30 3b 72 65 74 75 72 6e 20 62 7d 29 3b 0a 71 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 Data Ascii: g})}if(a)return a;c.prototype.toString=function(){return this.ne};var d="jscomp_symbol_"+(Math.random()*1E9>>>0)+"_",e=0;return b});q("Symbol.iterator",function(a){if(a)return a;a=Symbol("Symbol.iterator");for(var b="Array Int8Array Uint8Array Uint8Clamp
2024-10-01 15:18:39 UTC	1390	IN	Data Raw: 65 45 72 72 6f 72 28 61 2b 22 20 69 73 20 6e 6f 74 20 65 78 74 65 6e 73 69 62 6c 65 22 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 6c 6c 7d 76 61 72 20 70 61 3d 6c 61 3b 0a 66 75 6e 63 74 69 6f 6e 20 71 61 28 61 2c 62 29 7b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6b 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 69 66 28 70 61 29 70 61 28 61 2c 62 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 63 21 3d 22 70 72 6f 74 6f 74 79 70 65 22 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 62 2c 63 29 3b 64 26 26 4f Data Ascii: eError(a+" is not extensible");return a}:null}var pa=la;function qa(a,b){a.prototype=ka(b.prototype);a.prototype.constructor=a;if(pa)pa(a,b);else for(var c in b)if(c!="prototype")if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&O
2024-10-01 15:18:39 UTC	1390	IN	Data Raw: 61 6b 20 61 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 68 3d 21 30 3b 62 72 65 61 6b 20 61 3b 0a 64 65 66 61 75 6c 74 3a 68 3d 21 31 7d 68 3f 74 68 69 73 2e 55 66 28 67 29 3a 74 68 69 73 2e 4c 64 28 67 29 7d 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 55 66 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 76 6f 69 64 20 30 3b 74 72 79 7b 68 3d 67 2e 74 68 65 6e 7d 63 61 74 63 68 28 6b 29 7b 74 68 69 73 2e 62 64 28 6b 29 3b 72 65 74 75 72 6e 7d 74 79 70 65 6f 66 20 68 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 74 68 69 73 2e 67 67 28 68 2c 67 29 3a 74 68 69 73 2e 4c 64 28 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 62 64 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 63 65 28 32 2c 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4c 64 Data Ascii: ak a;case "function":h=!0;break a;default:h=!1}h?this.Uf(g):this.Ld(g)}};b.prototype.Uf=function(g){var h=void 0;try{h=g.then}catch(k){this.bd(k);return}typeof h=="function"?this.gg(h,g):this.Ld(g)};b.prototype.bd=function(g){this.ce(2,g)};b.prototype.Ld
2024-10-01 15:18:39 UTC	1390	IN	Data Raw: 29 7d 7d 3a 74 7d 76 61 72 20 6c 2c 6d 2c 70 3d 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 72 2c 74 29 7b 6c 3d 72 3b 6d 3d 74 7d 29 3b 74 68 69 73 2e 69 62 28 6b 28 67 2c 6c 29 2c 6b 28 68 2c 6d 29 29 3b 72 65 74 75 72 6e 20 70 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 69 62 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 0a 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 73 77 69 74 63 68 28 6c 2e 42 29 7b 63 61 73 65 20 31 3a 67 28 6c 2e 58 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 68 28 6c 2e 58 61 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 Data Ascii: )}}:t}var l,m,p=new b(function(r,t){l=r;m=t});this.ib(k(g,l),k(h,m));return p};b.prototype.catch=function(g){return this.then(void 0,g)};b.prototype.ib=function(g,h){function k(){switch(l.B){case 1:g(l.Xa);break;case 2:h(l.Xa);break;default:throw Error("
2024-10-01 15:18:39 UTC	1390	IN	Data Raw: 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 7d 66 75 6e 63 74 69 6f 6e 20 65 28 6b 29 7b 69 66 28 21 73 61 28 6b 2c 67 29 29 7b 76 61 72 20 6c 3d 6e 65 77 20 63 3b 63 61 28 6b 2c 67 2c 7b 76 61 6c 75 65 3a 6c 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 66 28 6b 29 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 5b 6b 5d 3b 6c 26 26 28 4f 62 6a 65 63 74 5b 6b 5d 3d 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 69 66 28 6d 20 69 6e 73 74 61 6e 63 65 6f 66 20 63 29 72 65 74 75 72 6e 20 6d 3b 4f 62 6a 65 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 65 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a Data Ascii: l==="function"}function e(k){if(!sa(k,g)){var l=new c;ca(k,g,{value:l})}}function f(k){var l=Object[k];l&&(Object[k]=function(m){if(m instanceof c)return m;Object.isExtensible(m)&&e(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var k=Obj
2024-10-01 15:18:39 UTC	1390	IN	Data Raw: 64 3a 6c 2c 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 68 2c 49 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 0a 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 2d 31 2c 49 3a 76 6f 69 64 20 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 68 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 62 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 68 29 7b 68 3d 75 28 68 29 3b 66 6f 72 28 76 61 72 20 6b 3b 21 28 6b 3d 68 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6b 3d 6b 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6b 5b 30 5d 2c 6b 5b 31 5d 29 7d 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 Data Ascii: d:l,list:m,index:h,I:p}}return{id:l,list:m,index:-1,I:void 0}}function e(h){this[0]={};this[1]=b();this.size=0;if(h){h=u(h);for(var k;!(k=h.next()).done;)k=k.value,this.set(k[0],k[1])}}if(function(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|type
2024-10-01 15:18:39 UTC	1390	IN	Data Raw: 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 2e 6b 65 79 7d 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 2e 76 61 6c 75 65 7d 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 68 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 65 2e 70 72 6f 74 6f 74 79 70 65 2e 65 Data Ascii: n(h){return h.key})};e.prototype.values=function(){return c(this,function(h){return h.value})};e.prototype.forEach=function(h,k){for(var l=this.entries(),m;!(m=l.next()).done;)m=m.value,h.call(k,m[1],m[0],this)};e.prototype[Symbol.iterator]=e.prototype.e
2024-10-01 15:18:39 UTC	1390	IN	Data Raw: 30 26 26 63 3e 30 3b 29 69 66 28 64 5b 2d 2d 63 5d 21 3d 62 5b 2d 2d 65 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 65 3c 3d 30 7d 7d 29 3b 0a 71 28 22 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3b 66 6f 72 28 64 20 69 6e 20 62 29 73 61 28 62 2c 64 29 26 26 63 2e 70 75 73 68 28 5b 64 2c 62 5b 64 5d 5d 29 3b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 71 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6e 64 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 61 3a 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 Data Ascii: 0&&c>0;)if(d[--c]!=b[--e])return!1;return e<=0}});q("Object.entries",function(a){return a?a:function(b){var c=[],d;for(d in b)sa(b,d)&&c.push([d,b[d]]);return c}});q("Array.prototype.find",function(a){return a?a:function(b,c){a:{var d=this;d instanceof S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49725	142.250.184.238	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:40 UTC	373	OUT	GET /adsense/domains/caf.js?pac=0 HTTP/1.1 Host: syndicatedsearch.goog Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:41 UTC	845	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Content-Length: 153214 Date: Tue, 01 Oct 2024 15:18:41 GMT Expires: Tue, 01 Oct 2024 15:18:41 GMT Cache-Control: private, max-age=3600 ETag: "16762785716741463394" X-Content-Type-Options: nosniff Link: <https://syndicatedsearch.goog>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 15:18:41 UTC	545	IN	Data Raw: 69 66 28 21 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 29 7b 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 3d 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 41 6c 74 4c 6f 61 64 65 72 3d 33 3b 76 61 72 20 73 66 66 65 44 61 74 61 5f 3d 7b 73 65 72 76 69 63 65 5f 68 6f 73 74 3a 22 73 79 6e 64 69 63 61 74 65 64 73 65 61 72 63 68 2e 67 6f 6f 67 22 2c 68 61 73 68 3a 22 31 37 33 38 33 36 33 33 34 36 34 33 37 30 36 31 35 35 35 33 22 2c 70 61 63 6b 61 67 65 73 3a 22 64 6f 6d 61 69 6e 73 22 2c 6d 6f 64 75 6c 65 3a 22 61 64 73 22 2c 76 65 72 73 69 6f 6e 3a 22 31 22 2c 6d 3a 7b 63 65 69 3a 22 31 37 33 30 31 34 33 31 2c 31 37 33 30 31 Data Ascii: if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"syndicatedsearch.goog",hash:"17383633464370615553",packages:"domains",module:"ads",version:"1",m:{cei:"17301431,17301
2024-10-01 15:18:41 UTC	1390	IN	Data Raw: 65 53 65 72 76 65 72 50 72 6f 76 69 64 65 64 44 6f 6d 61 69 6e 22 3a 74 72 75 65 2c 22 5f 77 61 69 74 4f 6e 43 6f 6e 73 65 6e 74 46 6f 72 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 45 6e 68 61 6e 63 65 64 54 61 72 67 65 74 69 6e 67 52 73 6f 6e 63 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 4e 6f 6e 62 6c 6f 63 6b 69 6e 67 53 61 73 43 6f 6f 6b 69 65 22 3a 74 72 75 65 7d 2c 6d 64 70 3a 31 38 30 30 30 30 30 2c 73 73 64 6c 3a 22 59 58 42 77 63 33 42 76 64 43 35 6a 62 32 30 73 59 6d 78 76 5a 33 4e 77 62 33 51 75 59 32 39 74 4c 47 4a 79 4c 6d 4e 76 62 53 78 6a 62 79 35 6a 62 32 30 73 59 32 78 76 64 57 52 6d 63 6d 39 75 64 43 35 75 5a 58 51 73 5a 58 55 75 59 32 39 74 4c 47 68 76 63 48 52 76 4c 6d 39 79 5a 79 78 70 62 Data Ascii: eServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpb
2024-10-01 15:18:41 UTC	1390	IN	Data Raw: 67 7d 29 7d 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 65 7d 3b 76 61 72 20 64 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45 39 3e 3e 3e 30 29 2b 22 5f 22 2c 65 3d 30 3b 72 65 74 75 72 6e 20 62 7d 29 3b 0a 71 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 Data Ascii: g})}if(a)return a;c.prototype.toString=function(){return this.ne};var d="jscomp_symbol_"+(Math.random()*1E9>>>0)+"_",e=0;return b});q("Symbol.iterator",function(a){if(a)return a;a=Symbol("Symbol.iterator");for(var b="Array Int8Array Uint8Array Uint8Clamp
2024-10-01 15:18:41 UTC	1390	IN	Data Raw: 65 45 72 72 6f 72 28 61 2b 22 20 69 73 20 6e 6f 74 20 65 78 74 65 6e 73 69 62 6c 65 22 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 6c 6c 7d 76 61 72 20 70 61 3d 6c 61 3b 0a 66 75 6e 63 74 69 6f 6e 20 71 61 28 61 2c 62 29 7b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6b 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 69 66 28 70 61 29 70 61 28 61 2c 62 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 63 21 3d 22 70 72 6f 74 6f 74 79 70 65 22 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 62 2c 63 29 3b 64 26 26 4f Data Ascii: eError(a+" is not extensible");return a}:null}var pa=la;function qa(a,b){a.prototype=ka(b.prototype);a.prototype.constructor=a;if(pa)pa(a,b);else for(var c in b)if(c!="prototype")if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&O
2024-10-01 15:18:41 UTC	1390	IN	Data Raw: 61 6b 20 61 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 68 3d 21 30 3b 62 72 65 61 6b 20 61 3b 0a 64 65 66 61 75 6c 74 3a 68 3d 21 31 7d 68 3f 74 68 69 73 2e 55 66 28 67 29 3a 74 68 69 73 2e 4c 64 28 67 29 7d 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 55 66 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 76 6f 69 64 20 30 3b 74 72 79 7b 68 3d 67 2e 74 68 65 6e 7d 63 61 74 63 68 28 6b 29 7b 74 68 69 73 2e 62 64 28 6b 29 3b 72 65 74 75 72 6e 7d 74 79 70 65 6f 66 20 68 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 74 68 69 73 2e 67 67 28 68 2c 67 29 3a 74 68 69 73 2e 4c 64 28 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 62 64 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 63 65 28 32 2c 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4c 64 Data Ascii: ak a;case "function":h=!0;break a;default:h=!1}h?this.Uf(g):this.Ld(g)}};b.prototype.Uf=function(g){var h=void 0;try{h=g.then}catch(k){this.bd(k);return}typeof h=="function"?this.gg(h,g):this.Ld(g)};b.prototype.bd=function(g){this.ce(2,g)};b.prototype.Ld
2024-10-01 15:18:41 UTC	1390	IN	Data Raw: 29 7d 7d 3a 74 7d 76 61 72 20 6c 2c 6d 2c 70 3d 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 72 2c 74 29 7b 6c 3d 72 3b 6d 3d 74 7d 29 3b 74 68 69 73 2e 69 62 28 6b 28 67 2c 6c 29 2c 6b 28 68 2c 6d 29 29 3b 72 65 74 75 72 6e 20 70 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 67 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 69 62 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 0a 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 73 77 69 74 63 68 28 6c 2e 42 29 7b 63 61 73 65 20 31 3a 67 28 6c 2e 58 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 68 28 6c 2e 58 61 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 Data Ascii: )}}:t}var l,m,p=new b(function(r,t){l=r;m=t});this.ib(k(g,l),k(h,m));return p};b.prototype.catch=function(g){return this.then(void 0,g)};b.prototype.ib=function(g,h){function k(){switch(l.B){case 1:g(l.Xa);break;case 2:h(l.Xa);break;default:throw Error("
2024-10-01 15:18:41 UTC	1390	IN	Data Raw: 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 7d 66 75 6e 63 74 69 6f 6e 20 65 28 6b 29 7b 69 66 28 21 73 61 28 6b 2c 67 29 29 7b 76 61 72 20 6c 3d 6e 65 77 20 63 3b 63 61 28 6b 2c 67 2c 7b 76 61 6c 75 65 3a 6c 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 66 28 6b 29 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 5b 6b 5d 3b 6c 26 26 28 4f 62 6a 65 63 74 5b 6b 5d 3d 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 69 66 28 6d 20 69 6e 73 74 61 6e 63 65 6f 66 20 63 29 72 65 74 75 72 6e 20 6d 3b 4f 62 6a 65 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 65 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a Data Ascii: l==="function"}function e(k){if(!sa(k,g)){var l=new c;ca(k,g,{value:l})}}function f(k){var l=Object[k];l&&(Object[k]=function(m){if(m instanceof c)return m;Object.isExtensible(m)&&e(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var k=Obj
2024-10-01 15:18:41 UTC	1390	IN	Data Raw: 64 3a 6c 2c 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 68 2c 49 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 0a 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 2d 31 2c 49 3a 76 6f 69 64 20 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 68 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 62 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 68 29 7b 68 3d 75 28 68 29 3b 66 6f 72 28 76 61 72 20 6b 3b 21 28 6b 3d 68 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6b 3d 6b 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6b 5b 30 5d 2c 6b 5b 31 5d 29 7d 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 Data Ascii: d:l,list:m,index:h,I:p}}return{id:l,list:m,index:-1,I:void 0}}function e(h){this[0]={};this[1]=b();this.size=0;if(h){h=u(h);for(var k;!(k=h.next()).done;)k=k.value,this.set(k[0],k[1])}}if(function(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|type
2024-10-01 15:18:41 UTC	1390	IN	Data Raw: 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 2e 6b 65 79 7d 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 2e 76 61 6c 75 65 7d 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 68 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 65 2e 70 72 6f 74 6f 74 79 70 65 2e 65 Data Ascii: n(h){return h.key})};e.prototype.values=function(){return c(this,function(h){return h.value})};e.prototype.forEach=function(h,k){for(var l=this.entries(),m;!(m=l.next()).done;)m=m.value,h.call(k,m[1],m[0],this)};e.prototype[Symbol.iterator]=e.prototype.e
2024-10-01 15:18:41 UTC	1390	IN	Data Raw: 30 26 26 63 3e 30 3b 29 69 66 28 64 5b 2d 2d 63 5d 21 3d 62 5b 2d 2d 65 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 65 3c 3d 30 7d 7d 29 3b 0a 71 28 22 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3b 66 6f 72 28 64 20 69 6e 20 62 29 73 61 28 62 2c 64 29 26 26 63 2e 70 75 73 68 28 5b 64 2c 62 5b 64 5d 5d 29 3b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 71 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6e 64 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 61 3a 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 Data Ascii: 0&&c>0;)if(d[--c]!=b[--e])return!1;return e<=0}});q("Object.entries",function(a){return a?a:function(b){var c=[],d;for(d in b)sa(b,d)&&c.push([d,b[d]]);return c}});q("Array.prototype.find",function(a){return a?a:function(b,c){a:{var d=this;d instanceof S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49726	172.217.18.1	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:40 UTC	744	OUT	GET /ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2 HTTP/1.1 Host: afs.googleusercontent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://syndicatedsearch.goog/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:41 UTC	788	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: image/svg+xml Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers Cross-Origin-Opener-Policy: same-origin; report-to="afs-native-asset-managers" Report-To: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]} Content-Length: 391 Date: Tue, 01 Oct 2024 15:18:41 GMT Expires: Wed, 02 Oct 2024 14:18:41 GMT Cache-Control: public, max-age=82800 Last-Modified: Thu, 20 Jul 2023 22:48:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 15:18:41 UTC	391	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 27 23 31 39 36 37 64 32 27 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 30 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 35 2e 35 20 31 34 68 2d 2e 37 39 6c 2d 2e 32 38 2d 2e 32 37 43 31 35 2e 34 31 20 31 32 2e 35 39 20 31 36 20 31 31 2e 31 31 20 31 36 20 39 2e 35 20 31 36 20 35 2e 39 31 20 31 33 2e 30 39 20 33 20 39 2e 35 20 33 53 33 20 35 2e 39 31 20 33 20 39 2e 35 20 35 2e 39 31 20 31 36 20 39 2e 35 20 31 36 63 31 2e 36 31 20 30 20 33 2e 30 39 2d 2e 35 39 20 34 2e 32 33 2d 31 2e 35 37 6c 2e 32 37 2e 32 38 76 2e 37 39 6c 35 20 34 2e 39 39 4c Data Ascii: <svg fill='#1967d2' xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 24 24"><path d="M15.5 14h-.79l-.28-.27C15.41 12.59 16 11.11 16 9.5 16 5.91 13.09 3 9.5 3S3 5.91 3 9.5 5.91 16 9.5 16c1.61 0 3.09-.59 4.23-1.57l.27.28v.79l5 4.99L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49727	172.217.18.1	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:41 UTC	745	OUT	GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1 Host: afs.googleusercontent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://syndicatedsearch.goog/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:41 UTC	800	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers Cross-Origin-Opener-Policy: same-origin; report-to="afs-native-asset-managers" Report-To: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]} Content-Length: 200 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 30 Sep 2024 22:40:47 GMT Expires: Tue, 01 Oct 2024 21:40:47 GMT Cache-Control: public, max-age=82800 Last-Modified: Thu, 02 Nov 2023 22:48:00 GMT Content-Type: image/svg+xml Vary: Accept-Encoding Age: 59874 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 15:18:41 UTC	200	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 27 23 66 66 66 66 66 66 27 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 77 69 64 74 68 3d 22 32 34 22 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 32 34 76 32 34 48 30 7a 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 35 2e 38 38 20 34 2e 31 32 4c 31 33 2e 37 36 20 31 32 6c 2d 37 2e 38 38 20 37 2e 38 38 4c 38 20 32 32 6c 31 30 2d 31 30 4c 38 20 32 7a 22 2f 3e 3c 2f 73 76 67 3e Data Ascii: <svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M0 0h24v24H0z" fill="none"/><path d="M5.88 4.12L13.76 12l-7.88 7.88L8 22l10-10L8 2z"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49715	142.250.186.46	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:41 UTC	880	OUT	GET /afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=cufb1kveew19&aqid=zhL8Zqy0JrGhxdwPktzPsQ0&psid=3259787283&pbt=bs&adbx=385.203125&adby=413.015625&adbh=571&adbw=493&adbah=212%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo80_3ph&errv=678245571&csala=8%7C0%7C1224%7C1232%7C29&lle=0&ifv=1&hpt=0 HTTP/1.1 Host: syndicatedsearch.goog Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://www.creationtch.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:41 UTC	715	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-I56N9Uc0kTwZDjN4KTjsqw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Date: Tue, 01 Oct 2024 15:18:41 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49730	142.250.185.225	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:41 UTC	503	OUT	GET /ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2 HTTP/1.1 Host: afs.googleusercontent.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:42 UTC	800	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers Cross-Origin-Opener-Policy: same-origin; report-to="afs-native-asset-managers" Report-To: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]} Content-Length: 391 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 30 Sep 2024 22:41:52 GMT Expires: Tue, 01 Oct 2024 21:41:52 GMT Cache-Control: public, max-age=82800 Last-Modified: Thu, 20 Jul 2023 22:48:00 GMT Content-Type: image/svg+xml Vary: Accept-Encoding Age: 59810 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 15:18:42 UTC	391	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 27 23 31 39 36 37 64 32 27 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 30 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 35 2e 35 20 31 34 68 2d 2e 37 39 6c 2d 2e 32 38 2d 2e 32 37 43 31 35 2e 34 31 20 31 32 2e 35 39 20 31 36 20 31 31 2e 31 31 20 31 36 20 39 2e 35 20 31 36 20 35 2e 39 31 20 31 33 2e 30 39 20 33 20 39 2e 35 20 33 53 33 20 35 2e 39 31 20 33 20 39 2e 35 20 35 2e 39 31 20 31 36 20 39 2e 35 20 31 36 63 31 2e 36 31 20 30 20 33 2e 30 39 2d 2e 35 39 20 34 2e 32 33 2d 31 2e 35 37 6c 2e 32 37 2e 32 38 76 2e 37 39 6c 35 20 34 2e 39 39 4c Data Ascii: <svg fill='#1967d2' xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 24 24"><path d="M15.5 14h-.79l-.28-.27C15.41 12.59 16 11.11 16 9.5 16 5.91 13.09 3 9.5 3S3 5.91 3 9.5 5.91 16 9.5 16c1.61 0 3.09-.59 4.23-1.57l.27.28v.79l5 4.99L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49731	142.250.185.225	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:41 UTC	504	OUT	GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1 Host: afs.googleusercontent.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:42 UTC	800	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers Cross-Origin-Opener-Policy: same-origin; report-to="afs-native-asset-managers" Report-To: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]} Content-Length: 200 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 01 Oct 2024 11:11:49 GMT Expires: Wed, 02 Oct 2024 10:11:49 GMT Cache-Control: public, max-age=82800 Age: 14813 Last-Modified: Thu, 02 Nov 2023 22:48:00 GMT Content-Type: image/svg+xml Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 15:18:42 UTC	200	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 27 23 66 66 66 66 66 66 27 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 77 69 64 74 68 3d 22 32 34 22 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 32 34 76 32 34 48 30 7a 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 35 2e 38 38 20 34 2e 31 32 4c 31 33 2e 37 36 20 31 32 6c 2d 37 2e 38 38 20 37 2e 38 38 4c 38 20 32 32 6c 31 30 2d 31 30 4c 38 20 32 7a 22 2f 3e 3c 2f 73 76 67 3e Data Ascii: <svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M0 0h24v24H0z" fill="none"/><path d="M5.88 4.12L13.76 12l-7.88 7.88L8 22l10-10L8 2z"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49734	142.250.186.46	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:42 UTC	837	OUT	GET /afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=xa37wg2xt4y0&aqid=zhL8Zqy0JrGhxdwPktzPsQ0&pbt=bs&adbx=481.5&adby=986.015625&adbh=16&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo80_3ph&errv=678245571&csala=3%7C0%7C1229%7C1232%7C29&lle=0&ifv=0&hpt=0 HTTP/1.1 Host: syndicatedsearch.goog Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://www.creationtch.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:42 UTC	715	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-aY1Om7_pY0qee-v684DW-w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Date: Tue, 01 Oct 2024 15:18:42 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49735	142.250.186.46	443	6992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:42 UTC	880	OUT	GET /afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=vk7amg39g97w&aqid=zhL8Zqy0JrGhxdwPktzPsQ0&psid=3259787283&pbt=bv&adbx=385.203125&adby=413.015625&adbh=571&adbw=493&adbah=212%2C171%2C171&adbn=master-1&eawp=partner-dp-sedo80_3ph&errv=678245571&csala=8%7C0%7C1224%7C1232%7C29&lle=0&ifv=1&hpt=0 HTTP/1.1 Host: syndicatedsearch.goog Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://www.creationtch.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 15:18:43 UTC	715	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tMm-unIPqzTA1tQw2uSPGw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Date: Tue, 01 Oct 2024 15:18:43 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49739	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:45 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eRHCpk4Rnu28O7z&MD=CXskTKKm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-01 15:18:45 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 64c699f8-90b1-4010-826b-79048e071465 MS-RequestId: 379f87c5-cf5f-44d8-9433-47e4fca6ea72 MS-CV: jrC0HORLikygCz7+.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 01 Oct 2024 15:18:44 GMT Connection: close Content-Length: 24490
2024-10-01 15:18:45 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-01 15:18:45 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49740	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:46 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 15:18:46 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=178024 Date: Tue, 01 Oct 2024 15:18:46 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49741	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:18:47 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 15:18:47 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=177967 Date: Tue, 01 Oct 2024 15:18:47 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-01 15:18:47 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49742	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-01 15:19:22 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eRHCpk4Rnu28O7z&MD=CXskTKKm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-01 15:19:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 06fe788f-e576-49fc-8e79-4b2cb8229b53 MS-RequestId: dfeb2a80-4be5-457d-8398-6e9a6b1bf4e4 MS-CV: 2NcfxwsUykKFDRU+.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 01 Oct 2024 15:19:22 GMT Connection: close Content-Length: 30005
2024-10-01 15:19:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-01 15:19:23 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 6368, Parent PID: 3660

General

Target ID:	0
Start time:	11:18:32
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6992, Parent PID: 6368

General

Target ID:	1
Start time:	11:18:32
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1940,i,6973925189769928710,6796612593531634411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6512, Parent PID: 3660

General

Target ID:	2
Start time:	11:18:33
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://creationtch.com"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://creationtch.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Static File Info

Windows Analysis Report
http://creationtch.com