Edit tour

Windows Analysis Report
https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20

Overview

General Information

Sample URL:	https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2
Analysis ID:	1592379
Infos:

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,65664859004425449,9395212604314751465,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2

Source: chrome.exe

Memory has grown: Private usage: 27MB later: 43MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=KoODWxMvxS9VHeALumAO-hKAs6oyTu10HKswkmY4Jy2ZzRq2atO6ukoqKiVIPlVmp3QskgGGzKYGHxD-50R94tdJaduOuLBXRGHzf7SgcU4ab-Eq1gSPqq5pBUT0rVRdiZBQlGIP8kRez5k4yhym6gfYN_p67qSBBZpA0NiR58wHwGvhn5UgAKazHkYYYoGFAmXIMi4miQ
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=KoODWxMvxS9VHeALumAO-hKAs6oyTu10HKswkmY4Jy2ZzRq2atO6ukoqKiVIPlVmp3QskgGGzKYGHxD-50R94tdJaduOuLBXRGHzf7SgcU4ab-Eq1gSPqq5pBUT0rVRdiZBQlGIP8kRez5k4yhym6gfYN_p67qSBBZpA0NiR58wHwGvhn5UgAKazHkYYYoGFAmXIMi4miQ
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=KoODWxMvxS9VHeALumAO-hKAs6oyTu10HKswkmY4Jy2ZzRq2atO6ukoqKiVIPlVmp3QskgGGzKYGHxD-50R94tdJaduOuLBXRGHzf7SgcU4ab-Eq1gSPqq5pBUT0rVRdiZBQlGIP8kRez5k4yhym6gfYN_p67qSBBZpA0NiR58wHwGvhn5UgAKazHkYYYoGFAmXIMi4miQ
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=15&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=KoODWxMvxS9VHeALumAO-hKAs6oyTu10HKswkmY4Jy2ZzRq2atO6ukoqKiVIPlVmp3QskgGGzKYGHxD-50R94tdJaduOuLBXRGHzf7SgcU4ab-Eq1gSPqq5pBUT0rVRdiZBQlGIP8kRez5k4yhym6gfYN_p67qSBBZpA0NiR58wHwGvhn5UgAKazHkYYYoGFAmXIMi4miQ

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: chromecache_63.1.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_67.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_67.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_67.1.dr, chromecache_63.1.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_67.1.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_67.1.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_67.1.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_63.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_63.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_63.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_63.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_63.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_67.1.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_67.1.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_67.1.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_67.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_67.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_63.1.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_63.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_63.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css

Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: classification engine

Classification label: sus20.win@20/28@6/3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,65664859004425449,9395212604314751465,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,65664859004425449,9395212604314751465,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.185.206	true	false	high
play.google.com	172.217.18.110	true	false	high
www.google.com	142.250.185.132	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=15&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://play.google.com/log?format=json&hasfast=true	chromecache_63.1.dr	false	high
http://www.broofa.com	chromecache_63.1.dr	false	high
https://apis.google.com	chromecache_67.1.dr, chromecache_63.1.dr	false	high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_67.1.dr	false	high
https://domains.google.com/suggest/flow	chromecache_67.1.dr	false	high
https://clients6.google.com	chromecache_67.1.dr	false	high
https://plus.google.com	chromecache_67.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
142.250.185.132	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592379
Start date and time:	2025-01-16 02:27:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus20.win@20/28@6/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.131, 142.250.186.78, 108.177.15.84, 172.217.16.206, 142.250.185.206, 172.217.16.131, 199.232.214.172, 216.58.206.74, 172.217.18.106, 142.250.185.138, 142.250.184.202, 172.217.16.202, 142.250.185.106, 216.58.212.138, 142.250.185.74, 172.217.23.106, 142.250.185.170, 142.250.186.42, 142.250.186.138, 142.250.184.234, 142.250.186.74, 172.217.18.10, 142.250.185.202, 142.250.185.110, 216.58.206.78, 172.217.18.14, 142.250.185.238, 172.217.18.3, 142.250.186.46, 172.217.18.110, 2.23.242.162, 4.245.163.56
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20 Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": true, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": true, "third_party_hosting": true, "reasoning": "This URL contains several suspicious elements: 1) It uses the .ch TLD instead of the legitimate .com for YouTube, 2) It contains numerous encoded characters and spaces which is highly unusual and suspicious, 3) It appears to be attempting to spoof the YouTube brand with an unofficial domain" }
URL: https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2

Input

Output

URL: https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20 Model: Joe Sandbox AI

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": true,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true,
    "reasoning": "This URL contains several suspicious elements: 1) It uses the .ch TLD instead of the legitimate .com for YouTube, 2) It contains numerous encoded characters and spaces which is highly unusual and suspicious, 3) It appears to be attempting to spoof the YouTube brand with an unofficial domain"
}

URL: https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 00:27:41 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9810126241890345
Encrypted:	false
SSDEEP:	48:8hdyTe9kfHTidAKZdA1FehwiZUklqehKy+3:8eOkVFy
MD5:	184F95DFB54851A440AD7F149368F21F
SHA1:	471C8A87910E087A2B1BE5C0626D97730EC7C8BF
SHA-256:	5E1EEEB3C145C6EE639154DBB1103A9000267AD69496650883176E2B5B009855
SHA-512:	B4732AC468B046C1A979916E47002E436F4150DC4D0B6E4C6507F8816E2E06E4F434AC7AF74B458396ECABA95F0EFE7587024273051C51F535CE748A9F558DC4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......L.g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I0Zl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Zt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Zt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Zt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V0Zu............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............._.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 00:27:41 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.996187423397436
Encrypted:	false
SSDEEP:	48:8YdyTe9kfHTidAKZdA1seh/iZUkAQkqeh1y+2:8hOkL9Qoy
MD5:	AFE275A4D8819EA3DA552FDCF4823DBF
SHA1:	D81DDA0B0A4C679B81C14E0B1D0D4C2D04774979
SHA-256:	4367E1BFC22CB6AAD30E5D6A46EC2C49745C14E86F77D0DE00315933465496CC
SHA-512:	AB5E16FC05A265C2286A81F214A860D81431F41A81BB01E270B1340B4E184473CB2A231F6DC3F26BB32C9EF2FFA3CEAD9DB94963F0FC8A25926A771C34F7EA29
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....l>.g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I0Zl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Zt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Zt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Zt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V0Zu............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............._.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.006176638577596
Encrypted:	false
SSDEEP:	48:8HdyTe9kAHTidAKZdA14meh7sFiZUkmgqeh7sby+BX:8cOkin5y
MD5:	BA43C4E4C6F1ADCF5408D34AF262C39B
SHA1:	71BF65244B3B39A67EFD39E47ED50C5A6711834A
SHA-256:	8D569AFD25DD683EBEDC2AB7DD7D811C9464363A84F8775F5EA515A55BA348D0
SHA-512:	8ED6FCA86AA7327BC26900AF0BD0B23F1A2819050C68FD99FA61961411355C90FAB9CC286D658BC3A95C4F9D4CCA3A63F73AAE658CD41B3B7537A4B82599A0D0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I0Zl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Zt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Zt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Zt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............._.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 00:27:41 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9938998908775076
Encrypted:	false
SSDEEP:	48:8PrdyTe9kfHTidAKZdA1TehDiZUkwqehxy+R:8PYOkYzy
MD5:	61BBCC777BDD7140EA0960C98DCF437D
SHA1:	EFDA12CBBE2969530330C12101CCC26C8E955B6D
SHA-256:	CE8CFAEAB852FBF6C5CB60BEC8A60CB3D4710AB05967FFFBF9FB80D15CA44D3C
SHA-512:	A59257AE33F42C74582CE3AE06805D239EE76D063C1186BCE51AA175BB11722657AD5A1B3D46D4515403BBEA1584C59C99A5017A26CF3F029C076B15488D1DAA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....g7.g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I0Zl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Zt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Zt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Zt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V0Zu............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............._.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 00:27:41 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.984942705799252
Encrypted:	false
SSDEEP:	48:8HdyTe9kfHTidAKZdA1dehBiZUk1W1qehPy+C:8cOko9vy
MD5:	B70D2A8902469FDE2761F6B95401E735
SHA1:	473594A58A569C59111E7C96CFAFF1242794571A
SHA-256:	2BB72BECE0D5D6AA69433521DB15599BE5B414FC87A401203AC4C08491FA9793
SHA-512:	5A851CF71EC524A12CE92BACA9F44E31343C6FEC70ABFCC08C5476BC490545C80753B6EC9D5E2AF38C6D6ADF60F9AF1BFAF105765EE6E486C07A5364C6E18B8D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......F.g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I0Zl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Zt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Zt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Zt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V0Zu............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............._.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 00:27:41 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9926647051307596
Encrypted:	false
SSDEEP:	48:84dyTe9kfHTidAKZdA1duTeehOuTbbiZUk5OjqehOuTb5y+yT+:8BOkaTfTbxWOvTb5y7T
MD5:	F4EBD780F5716707D5C29E2834EC5362
SHA1:	237F857F11AC2E949C503E50E6B2718A5BC4AA57
SHA-256:	05F27344B88419FF6E0230E79CDB033AFEA6BE3A3A9ED13CB3AA2650E5703722
SHA-512:	D7FACAA457635DEA265C35049533293C9A75975130387A24EF8B4955DA0FD2676D62578693737ABA0CDF43670A227C3D28DAAFC4C11D85DBF47580119959A679
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......-.g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I0Zl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Zt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Zt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Zt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V0Zu............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............._.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (801)
Category:	downloaded
Size (bytes):	806
Entropy (8bit):	5.156599342861495
Encrypted:	false
SSDEEP:	24:c/RAFUJoI9MFEvw2BHslgT9lCuABATw3uoB7HHHHHHHYqmffffffo:rFrISKJKlgZ01BA83uSEqmffffffo
MD5:	4DAE7FC6F9F6831444DADD8714BA003A
SHA1:	0A9770BC6534F6BDAD0568A6845DF88622FCAFDC
SHA-256:	CDBFB7412A7C9DDF91FE7757780BDCB8323C32C26A21AF6FA637D454E145EC84
SHA-512:	D3079BCA8B11F2E9505E0B1DAC1E48C93BF92B094165B143CE4F6369E241C50A1518433966D1C343EF83FF3852939652EED891039C6884F4116BF943FA52D671
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["lucy dacus ankles lyrics","metro rewind ridership report 2024","cris rodriguez detroit tigers","atlas comet tonight","dji drones","boar head","fortnite hatsune miku","arsenal fc vs tottenham hotspur"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":"4842841534809833859","google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	175017
Entropy (8bit):	5.547141709627909
Encrypted:	false
SSDEEP:	3072:ZzKYRicPAENEJ8X5rpzKSoi5O4NmHha+q5ByukhCOWomLCHiYyKfQ1fbK0jOJv6B:ZzKYRPAENEJ+pKSoUO4NmHhbq5ByukhM
MD5:	DE73B70C2E96AA995C1D89F9DE01D399
SHA1:	D72592A0BF7FC706B4063B146FA0F505D9598E37
SHA-256:	47051D5F0947B959605CA98298809213203547BD992E9EC13557B40547F5228F
SHA-512:	7C01A3EC31D67C79BDBFFCF166E8F61DFED6EBCEF56F0BBFAE4EFAA363E0F797E397C054183AC16515F1AA34B1C6E19ABB2EBF3F9C5CA85EEAE9B173D657028B
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.WSo7OLdFZck.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu3OIbomB3nx1wiDyRkhdiMoOpjsA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Zi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.$i=class extends _.Q{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{._.aj=function(a,b,c){a=_.vb(a,b,c);return Array.isArray(a)?a:_.Cc};_.bj=function(a,b){a=2&b?a\|2:a&-3;return(a\|32)&-2049};_.cj=function(a,b){a===0&&(a=_.bj(a,b));return a\|1};_.dj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.ej=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.fj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);const k=h?1:e;f=!!f;g&&(g=!h);e=_.aj(a,b,d);var l=e[_.v]\|0;h=!!(4&l);if(!h){l=_.cj(l,b);var n=e,p=l,r=b;(l=!!(2&p))&&(r\|=2);var q=!l;let x=!0,D=0,C=0;for(;D<n.length;D++){const H=_.Xa(n[D],c,r);if(H instanceof c){if(!l){const M=_.Ba(H.ha);q&&(q=!M);x&&(x=M)}n[C++]=H}}C<D&&(n.length=C);c=p\|4;p=x?c\|16:c&-17;p=q?p\|8:p&-9;n[_.v]=p;l&&Object.freeze(n);l=p}if(g&&!(8&l\|\|!e.length&&(k===1\|\|k===4&&32&l))){_.dj(l)&&(e=_.Ea(e),l=_.bj(l,b),b=_.ub(a,b,d,e));g=.e;c=l;for(n=0;n<g

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (849)
Category:	downloaded
Size (bytes):	855
Entropy (8bit):	5.1861220763104905
Encrypted:	false
SSDEEP:	24:fRkfK7FnAPDpmBHslgT9lCuABATAuoB7HHHHHHHYqmffffffo:ai7FAVmKlgZ01BA8uSEqmffffffo
MD5:	A09696124A3CC5A737DE54A2F56445F6
SHA1:	CCDEED7D7EAFE54D74C1086851164B4D61D182E8
SHA-256:	7009850453F984FB91DA63E304C03A84623349CEE79C97112E7D192D9CEB2FDC
SHA-512:	529CB440F21F1FD3B982B66A3B66B459A75C06C57276E7327A1D4F021DB83B1907C7ED7D235FA2F3579AAC26806BF1EA1D20B09BCA7D41376430BEDD780296C9
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["metro rewind ridership report 2024","the sims 4 25th anniversary update","pok.mon tcg prismatic evolutions","cris rodriguez detroit tigers","full moon wolf moon","adam sandler big daddy 2","elder scrolls iv oblivion remake","gta 6 rockstar games"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":"-9119084109494719313","google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133103
Entropy (8bit):	5.434431231772
Encrypted:	false
SSDEEP:	3072:fJkAu9kJGkLpS+QVHTZxKtujUMoDI7VW2i6e:fZueFS7jxKtujUMo07VW8e
MD5:	37311948BBA277848A368803B6DDC5F8
SHA1:	AA1A0002899E797ABCD7F243935D8DBCFB836511
SHA-256:	7F48374EBF8D82DD4395E7EAC054BB438A8264ED72B887EFD132338EE38C7969
SHA-512:	637C47D7CBC0CCFAEBE359E82451826873450966A0A6C053F26FBD9F3E2CCE2982C3D30ADAE394C4521DE5159A790E5A1A0DF334B031197A9C5B17F7EE260315
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1395)
Category:	downloaded
Size (bytes):	117446
Entropy (8bit):	5.490775275046353
Encrypted:	false
SSDEEP:	3072:T2yvefrtJUEgK3Cvw3wWs/ZuTZVL/G1kL:T2y4tJbDK0L/G1kL
MD5:	942EA4F96889BAE7D3C59C0724AB2208
SHA1:	033DDF473319500621D8EBB6961C4278E27222A7
SHA-256:	F59F7F32422E311462A6A6307D90CA75FE87FA11E6D481534A6F28BFCCF63B03
SHA-512:	C3F27662D08AA00ECBC910C39F6429C2F4CBC7CB5FC9083F63390047BACAF8CD7A83C3D6BBE7718F699DAE2ADA486F9E0CAED59BC3043491EECD9734EC32D92F
Malicious:	false
Reputation:	low
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);ma=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.CEsjJf2wziM.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTvDtorsWuiBHYzP5-lS7pwgoAa95g"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (849)
Category:	downloaded
Size (bytes):	855
Entropy (8bit):	5.19090611840839
Encrypted:	false
SSDEEP:	24:fRkfK7FnAPDpmBHslgT9lCuABATjquoB7HHHHHHHYqmffffffo:ai7FAVmKlgZ01BACuSEqmffffffo
MD5:	8C2A8CE09D011AAA48A1C747F4845B8F
SHA1:	D7C1B3069C8147561FAAF774CD7649B6B92FE9F9
SHA-256:	2597D3160832F975B7250B68827B259CEE10AFBA633CE49162CFFD7753A6ED7C
SHA-512:	D0FC5EA86C2ADE6ABDDD4B0B303CD7D92725569A9DC5FBEF7BD79D21E8EB6B7B9110066DCFA73DE5307EBF3AFC738C8775A680ECEEEE01C062A4BECDD96AF0AE
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=15&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["metro rewind ridership report 2024","the sims 4 25th anniversary update","pok.mon tcg prismatic evolutions","cris rodriguez detroit tigers","full moon wolf moon","adam sandler big daddy 2","elder scrolls iv oblivion remake","gta 6 rockstar games"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":"-6940592801587611557","google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:VQRWN:VQRWN
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3621)
Category:	downloaded
Size (bytes):	3626
Entropy (8bit):	5.859364391513557
Encrypted:	false
SSDEEP:	96:KvVMliWCIN6666VezgCilq7lRGxQ3sIKmvNrTvSioIjDfQffo:KInN6666VeE1ClUxg1lbwIj
MD5:	455EDB49A5799DCE1E7709FB5B5D59F6
SHA1:	D47A9B4F2E7AEA90B0EBE2B9D76B7D726D65E08B
SHA-256:	35A4A1414806E68CD0F67BE7113439A3F6C2AED79884A57B6AB09219703F3A9F
SHA-512:	795337FFFD184775068A265529C2528C8D6077A73DCE5513580098CEF00A5534107AA55FDFD11CDE97C2041A4BE0284E6B893F843F65CE80E0DDCA97BA0391C3
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["twin cedars high school","planets alignment","richmond water plant pump failure","princess anne","diablo 4 season 7 witchcraft","polar vortex temperatures","nyt mini crossword clues","kohl\u0027s stores closing"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgovbS8wNzYwMmo3EhlIaWdoIHNjaG9vbCDCtyBCdXNzZXksIElBOhdUd2luIENlZGFycyBIaWdoIFNjaG9vbFJ6Z3Nfc3NwPWVKemo0dExQMVRjd056TXd5akkzWUxSU05haXdNRS0xU0U0eFN6TXhNMHhKTmJRd3RES29NTEpJdERTMHNEUTJOekJNTVVzMFRQVVNMeW5QekZOSVRrMUpMQ3BXeU1oTXoxQW9UczdJejg4QkFBVkZGaVlwGQ\u003d\u003d","zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8weG41chIiTWVtYmVyIG9mIHRoZSBCcml0aXNoIHJveWFsIGZhbWlseTK3DWRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 02:27:40.134772062 CET	49673	443	192.168.2.16	204.79.197.203
Jan 16, 2025 02:27:40.438137054 CET	49673	443	192.168.2.16	204.79.197.203
Jan 16, 2025 02:27:41.044153929 CET	49673	443	192.168.2.16	204.79.197.203
Jan 16, 2025 02:27:41.641223907 CET	49703	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:41.641256094 CET	443	49703	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:41.641335011 CET	49703	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:41.641747952 CET	49703	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:41.641757965 CET	443	49703	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.073517084 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.073554039 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.073616028 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.074301004 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.074312925 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.120147943 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.120197058 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.120357990 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.120594978 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.120606899 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.151583910 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.151607990 CET	443	49706	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.151684999 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.151943922 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.151956081 CET	443	49706	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.247174978 CET	49673	443	192.168.2.16	204.79.197.203
Jan 16, 2025 02:27:42.274774075 CET	443	49703	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.275310993 CET	49703	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.275327921 CET	443	49703	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.276328087 CET	443	49703	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.276575089 CET	49703	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.277880907 CET	49703	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.277945995 CET	443	49703	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.278040886 CET	49703	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.278047085 CET	443	49703	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.326493025 CET	49703	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.565150023 CET	443	49703	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.567518950 CET	443	49703	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.567985058 CET	49703	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.571753979 CET	49703	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.571768999 CET	443	49703	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.701518059 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.701803923 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.701821089 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.702708960 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.702965975 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.703087091 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.703133106 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.703319073 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.747334003 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.753585100 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.753838062 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.753851891 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.755278111 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.755338907 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.755718946 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.755799055 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.755855083 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.757177114 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.757184982 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.789474964 CET	443	49706	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.790266991 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.790277958 CET	443	49706	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.793873072 CET	443	49706	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.794064045 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.794318914 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.794405937 CET	443	49706	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.794509888 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.799356937 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.805166960 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.805176020 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.805198908 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.836405993 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.836421013 CET	443	49706	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:42.852159977 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:42.884417057 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.006711960 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.006814003 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.006969929 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.007817030 CET	49704	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.007831097 CET	443	49704	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.077507973 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.077656031 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.077733994 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.077773094 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.077789068 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.077877998 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.077897072 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.077904940 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.077939987 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.082920074 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.087131023 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.087208986 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.087308884 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.087321043 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.087368011 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.090312004 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.115664959 CET	443	49706	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.115999937 CET	443	49706	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.116086960 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.116764069 CET	49706	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.116771936 CET	443	49706	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.139174938 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.139184952 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.165415049 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.165486097 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.165498972 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.166470051 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.166524887 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.166533947 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.172580004 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.172657967 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.172725916 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.172734976 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.172838926 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.179105043 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.185296059 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.185359001 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.185370922 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.191502094 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.191559076 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.191566944 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.197622061 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.197681904 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.197690010 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.203587055 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.203660011 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.203666925 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.209724903 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.209800959 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.209803104 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.209831953 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.209887981 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.215883017 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.221965075 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.222023010 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.222033024 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.252121925 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.252202034 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.252211094 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.252342939 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.252388954 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.252394915 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.253902912 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.253967047 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.253973961 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.254065037 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.254137039 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.254143000 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.259357929 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.259413958 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.259421110 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.264913082 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.264991045 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.264997959 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.270931959 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.271009922 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.271015882 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.276793957 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.276911974 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.276959896 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.276968002 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.277069092 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.282532930 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.287897110 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.287964106 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.287971020 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.292897940 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.292979956 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.292988062 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.297832012 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.297890902 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.297899961 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.302849054 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.302906036 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.302913904 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.307698011 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.307785034 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.307791948 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.307813883 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.307883024 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.312237978 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.316662073 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.316721916 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.316729069 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.321058989 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.321109056 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.321115971 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.325169086 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.325225115 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.325233936 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.329303980 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.329416037 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.329452038 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.329458952 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.329638004 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.333122015 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.333301067 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.333386898 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.333395004 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.337138891 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.337219000 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.337227106 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.340889931 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.341007948 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.341015100 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.344770908 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.344826937 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.344844103 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.347177029 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.347240925 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.347248077 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.349482059 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.349536896 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.349544048 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.351888895 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.351950884 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.351958036 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.354149103 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.354203939 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.354212999 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.356605053 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.356842995 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.356849909 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.358911037 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.358971119 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.358979940 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.361253023 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.361325026 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.361331940 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.363606930 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.363667011 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.363684893 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.367188931 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.367275953 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.367294073 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.367594004 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:43.367763042 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.367923021 CET	49705	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:43.367937088 CET	443	49705	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:44.228725910 CET	49689	80	192.168.2.16	192.229.211.108
Jan 16, 2025 02:27:44.656174898 CET	49673	443	192.168.2.16	204.79.197.203
Jan 16, 2025 02:27:45.510725975 CET	49717	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:45.510781050 CET	443	49717	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:45.510857105 CET	49717	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:45.511071920 CET	49717	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:45.511090040 CET	443	49717	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:46.146294117 CET	443	49717	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:46.146631956 CET	49717	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:46.146665096 CET	443	49717	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:46.146996021 CET	443	49717	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:46.147489071 CET	49717	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:46.147550106 CET	443	49717	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:46.193173885 CET	49717	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:48.304563046 CET	49678	443	192.168.2.16	20.189.173.10
Jan 16, 2025 02:27:48.607219934 CET	49678	443	192.168.2.16	20.189.173.10
Jan 16, 2025 02:27:49.213222027 CET	49678	443	192.168.2.16	20.189.173.10
Jan 16, 2025 02:27:49.468247890 CET	49673	443	192.168.2.16	204.79.197.203
Jan 16, 2025 02:27:50.426232100 CET	49678	443	192.168.2.16	20.189.173.10
Jan 16, 2025 02:27:52.773380995 CET	49680	80	192.168.2.16	192.229.211.108
Jan 16, 2025 02:27:52.837249994 CET	49678	443	192.168.2.16	20.189.173.10
Jan 16, 2025 02:27:53.077272892 CET	49680	80	192.168.2.16	192.229.211.108
Jan 16, 2025 02:27:53.685235977 CET	49680	80	192.168.2.16	192.229.211.108
Jan 16, 2025 02:27:54.897269964 CET	49680	80	192.168.2.16	192.229.211.108
Jan 16, 2025 02:27:56.094104052 CET	443	49717	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:56.094243050 CET	443	49717	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:56.094309092 CET	49717	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:56.925964117 CET	49717	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:27:56.926009893 CET	443	49717	142.250.185.132	192.168.2.16
Jan 16, 2025 02:27:57.307377100 CET	49680	80	192.168.2.16	192.229.211.108
Jan 16, 2025 02:27:57.643301964 CET	49678	443	192.168.2.16	20.189.173.10
Jan 16, 2025 02:27:59.079282045 CET	49673	443	192.168.2.16	204.79.197.203
Jan 16, 2025 02:28:02.110361099 CET	49680	80	192.168.2.16	192.229.211.108
Jan 16, 2025 02:28:04.710623026 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:04.710668087 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:04.710740089 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:04.710967064 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:04.710978985 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.016879082 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.016977072 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.017072916 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.017354012 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.017390966 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.339792013 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.340066910 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.340087891 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.340589046 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.340873003 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.340951920 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.340992928 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.383328915 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.383491993 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.643800974 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.643866062 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.643913031 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.644087076 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.644104958 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.644201040 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.645246983 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.645468950 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.645477057 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.645489931 CET	443	49724	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.645531893 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.645637989 CET	49724	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.646106958 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.646353006 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.646428108 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.646806002 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.647103071 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.647178888 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.647207022 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.687397957 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.702394009 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.945207119 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.945250034 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.945282936 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.945317030 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.945389032 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.945442915 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.947345972 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.947419882 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.947458982 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.947487116 CET	443	49725	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:05.947513103 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.947513103 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:05.947560072 CET	49725	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:07.252424002 CET	49678	443	192.168.2.16	20.189.173.10
Jan 16, 2025 02:28:11.724477053 CET	49680	80	192.168.2.16	192.229.211.108
Jan 16, 2025 02:28:13.807800055 CET	49726	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:13.807852030 CET	443	49726	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:13.807921886 CET	49726	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:13.808289051 CET	49726	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:13.808299065 CET	443	49726	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.114907026 CET	49727	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.114962101 CET	443	49727	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.115134954 CET	49727	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.115395069 CET	49727	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.115427017 CET	443	49727	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.438473940 CET	443	49726	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.438872099 CET	49726	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.438890934 CET	443	49726	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.439357042 CET	443	49726	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.439748049 CET	49726	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.439820051 CET	443	49726	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.439940929 CET	49726	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.487335920 CET	443	49726	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.733380079 CET	443	49726	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.734998941 CET	443	49726	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.735068083 CET	49726	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.735729933 CET	49726	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.735749006 CET	443	49726	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.750699997 CET	443	49727	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.750951052 CET	49727	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.751017094 CET	443	49727	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.752182007 CET	443	49727	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.752600908 CET	49727	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.752723932 CET	443	49727	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.752727032 CET	49727	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:14.795339108 CET	443	49727	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:14.800398111 CET	49727	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:15.043922901 CET	443	49727	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:15.045506001 CET	443	49727	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:15.045583963 CET	49727	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:15.046324015 CET	49727	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:15.046346903 CET	443	49727	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:45.569087982 CET	49730	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:45.569154024 CET	443	49730	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:45.569303989 CET	49730	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:45.569694042 CET	49730	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:45.569716930 CET	443	49730	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:46.214679956 CET	443	49730	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:46.215241909 CET	49730	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:46.215312004 CET	443	49730	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:46.216435909 CET	443	49730	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:46.216761112 CET	49730	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:46.216958046 CET	443	49730	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:46.271765947 CET	49730	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:56.195658922 CET	443	49730	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:56.195743084 CET	443	49730	142.250.185.132	192.168.2.16
Jan 16, 2025 02:28:56.195828915 CET	49730	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:56.919250011 CET	49730	443	192.168.2.16	142.250.185.132
Jan 16, 2025 02:28:56.919287920 CET	443	49730	142.250.185.132	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 02:27:40.696284056 CET	53	55341	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:40.788868904 CET	53	53253	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:41.633618116 CET	53269	53	192.168.2.16	1.1.1.1
Jan 16, 2025 02:27:41.633851051 CET	58338	53	192.168.2.16	1.1.1.1
Jan 16, 2025 02:27:41.640263081 CET	53	53269	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:41.640466928 CET	53	58338	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:41.780158043 CET	53	59267	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:43.453963041 CET	53	57815	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:44.725727081 CET	56672	53	192.168.2.16	1.1.1.1
Jan 16, 2025 02:27:44.725883007 CET	60487	53	192.168.2.16	1.1.1.1
Jan 16, 2025 02:27:44.732410908 CET	53	56672	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:44.732718945 CET	53	49775	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:44.733159065 CET	53	60487	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:45.730051994 CET	57179	53	192.168.2.16	1.1.1.1
Jan 16, 2025 02:27:45.730242968 CET	62419	53	192.168.2.16	1.1.1.1
Jan 16, 2025 02:27:45.736881971 CET	53	57179	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:45.736963987 CET	53	62419	1.1.1.1	192.168.2.16
Jan 16, 2025 02:27:58.768403053 CET	53	49801	1.1.1.1	192.168.2.16
Jan 16, 2025 02:28:17.697489023 CET	53	55217	1.1.1.1	192.168.2.16
Jan 16, 2025 02:28:40.631783962 CET	53	55442	1.1.1.1	192.168.2.16
Jan 16, 2025 02:28:40.693974018 CET	53	55917	1.1.1.1	192.168.2.16
Jan 16, 2025 02:28:44.473498106 CET	138	138	192.168.2.16	192.168.2.255
Jan 16, 2025 02:29:10.411942959 CET	53	54560	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 16, 2025 02:27:41.633618116 CET	192.168.2.16	1.1.1.1	0x581f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 02:27:41.633851051 CET	192.168.2.16	1.1.1.1	0xf630	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 16, 2025 02:27:44.725727081 CET	192.168.2.16	1.1.1.1	0x7945	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 02:27:44.725883007 CET	192.168.2.16	1.1.1.1	0x52d7	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Jan 16, 2025 02:27:45.730051994 CET	192.168.2.16	1.1.1.1	0x3a89	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 02:27:45.730242968 CET	192.168.2.16	1.1.1.1	0x4d2a	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 16, 2025 02:27:41.640263081 CET	1.1.1.1	192.168.2.16	0x581f	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Jan 16, 2025 02:27:41.640466928 CET	1.1.1.1	192.168.2.16	0xf630	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 16, 2025 02:27:44.732410908 CET	1.1.1.1	192.168.2.16	0x7945	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 02:27:44.732410908 CET	1.1.1.1	192.168.2.16	0x7945	No error (0)	plus.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jan 16, 2025 02:27:44.733159065 CET	1.1.1.1	192.168.2.16	0x52d7	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 02:27:45.736881971 CET	1.1.1.1	192.168.2.16	0x3a89	No error (0)	play.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49703	142.250.185.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:27:42 UTC	627	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:27:42 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 01:27:42 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-YdJK6zE9YcqVAlhkgD6ZIg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:27:42 UTC	124	IN	Data Raw: 33 32 36 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6c 75 63 79 20 64 61 63 75 73 20 61 6e 6b 6c 65 73 20 6c 79 72 69 63 73 22 2c 22 6d 65 74 72 6f 20 72 65 77 69 6e 64 20 72 69 64 65 72 73 68 69 70 20 72 65 70 6f 72 74 20 32 30 32 34 22 2c 22 63 72 69 73 20 72 6f 64 72 69 67 75 65 7a 20 64 65 74 72 6f 69 74 20 74 69 67 65 72 73 22 2c 22 61 74 6c 61 73 20 63 6f 6d 65 74 20 Data Ascii: 326)]}'["",["lucy dacus ankles lyrics","metro rewind ridership report 2024","cris rodriguez detroit tigers","atlas comet
2025-01-16 01:27:42 UTC	689	IN	Data Raw: 74 6f 6e 69 67 68 74 22 2c 22 64 6a 69 20 64 72 6f 6e 65 73 22 2c 22 62 6f 61 72 20 68 65 61 64 22 2c 22 66 6f 72 74 6e 69 74 65 20 68 61 74 73 75 6e 65 20 6d 69 6b 75 22 2c 22 61 72 73 65 6e 61 6c 20 66 63 20 76 73 20 74 6f 74 74 65 6e 68 61 6d 20 68 6f 74 73 70 75 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 Data Ascii: tonight","dji drones","boar head","fortnite hatsune miku","arsenal fc vs tottenham hotspur"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail"
2025-01-16 01:27:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49704	142.250.185.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:27:42 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:27:43 UTC	1018	IN	HTTP/1.1 200 OK Version: 715568063 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 16 Jan 2025 01:27:42 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:27:43 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2025-01-16 01:27:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49705	142.250.185.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:27:42 UTC	530	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:27:43 UTC	1018	IN	HTTP/1.1 200 OK Version: 715568063 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 16 Jan 2025 01:27:42 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:27:43 UTC	372	IN	Data Raw: 32 31 39 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 219f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2025-01-16 01:27:43 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2025-01-16 01:27:43 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2025-01-16 01:27:43 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2025-01-16 01:27:43 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2025-01-16 01:27:43 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 36 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700296,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window
2025-01-16 01:27:43 UTC	1293	IN	Data Raw: 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 Data Ascii: Array(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Md\u003dglobalThis.trustedTypes;_.Nd\u003dclass{constructor(a){this
2025-01-16 01:27:43 UTC	500	IN	Data Raw: 31 65 64 0d 0a 3b 72 65 74 75 72 6e 20 58 64 7d 3b 5c 6e 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 59 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 5a 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 5a 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 48 5c 22 29 3b 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 62 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 Data Ascii: 1ed;return Xd};\n_.$d\u003dfunction(a){const b\u003d_.Yd();return new _.Zd(b?b.createScriptURL(a):a)};_.ae\u003dfunction(a){if(a instanceof _.Zd)return a.i;throw Error(\"H\");};_.ce\u003dfunction(a){if(be.test(a))return a};_.de\u003dfunction(a){if(a ins
2025-01-16 01:27:43 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 Data Ascii: 8000(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.fe\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ge\u003df
2025-01-16 01:27:43 UTC	1390	IN	Data Raw: 28 6f 65 5b 64 5d 2c 63 29 3a 5f 2e 55 64 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 55 64 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6f 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f Data Ascii: (oe[d],c):_.Ud(d,\"aria-\")\|\|_.Ud(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};oe\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\",nonce:\"nonce\",ro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49706	142.250.185.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:27:42 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:27:43 UTC	933	IN	HTTP/1.1 200 OK Version: 715568063 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 16 Jan 2025 01:27:43 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:27:43 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2025-01-16 01:27:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49724	142.250.185.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:28:05 UTC	833	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=KoODWxMvxS9VHeALumAO-hKAs6oyTu10HKswkmY4Jy2ZzRq2atO6ukoqKiVIPlVmp3QskgGGzKYGHxD-50R94tdJaduOuLBXRGHzf7SgcU4ab-Eq1gSPqq5pBUT0rVRdiZBQlGIP8kRez5k4yhym6gfYN_p67qSBBZpA0NiR58wHwGvhn5UgAKazHkYYYoGFAmXIMi4miQ
2025-01-16 01:28:05 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 01:28:05 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-MOdYvoN4mY7rbYsuI3TvhA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:28:05 UTC	124	IN	Data Raw: 65 32 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 74 77 69 6e 20 63 65 64 61 72 73 20 68 69 67 68 20 73 63 68 6f 6f 6c 22 2c 22 70 6c 61 6e 65 74 73 20 61 6c 69 67 6e 6d 65 6e 74 22 2c 22 72 69 63 68 6d 6f 6e 64 20 77 61 74 65 72 20 70 6c 61 6e 74 20 70 75 6d 70 20 66 61 69 6c 75 72 65 22 2c 22 70 72 69 6e 63 65 73 73 20 61 6e 6e 65 22 2c 22 64 69 61 62 6c 6f 20 34 20 73 Data Ascii: e29)]}'["",["twin cedars high school","planets alignment","richmond water plant pump failure","princess anne","diablo 4 s
2025-01-16 01:28:05 UTC	1390	IN	Data Raw: 65 61 73 6f 6e 20 37 20 77 69 74 63 68 63 72 61 66 74 22 2c 22 70 6f 6c 61 72 20 76 6f 72 74 65 78 20 74 65 6d 70 65 72 61 74 75 72 65 73 22 2c 22 6e 79 74 20 6d 69 6e 69 20 63 72 6f 73 73 77 6f 72 64 20 63 6c 75 65 73 22 2c 22 6b 6f 68 6c 5c 75 30 30 32 37 73 20 73 74 6f 72 65 73 20 63 6c 6f 73 69 6e 67 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 Data Ascii: eason 7 witchcraft","polar vortex temperatures","nyt mini crossword clues","kohl\u0027s stores closing"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:su
2025-01-16 01:28:05 UTC	1390	IN	Data Raw: 34 4d 57 31 6c 4d 32 35 4a 5a 55 74 4b 55 31 70 48 65 6e 52 71 59 6a 55 35 55 47 35 59 52 31 59 72 61 7a 68 6b 54 48 46 4b 5a 58 42 68 64 6d 4e 54 53 30 55 72 63 30 5a 43 4d 31 42 75 56 32 46 55 56 56 52 4a 5a 32 70 53 5a 57 63 7a 55 44 63 76 52 33 46 6d 5a 57 4e 47 4e 6c 6c 49 57 56 6c 51 57 47 5a 50 4b 32 46 46 4d 30 68 44 4b 32 31 53 55 32 64 34 64 32 64 46 5a 44 5a 4b 56 32 46 61 53 48 70 6e 63 57 6c 61 65 6a 4e 6a 61 54 63 72 52 32 4e 5a 4d 6e 4a 77 57 57 46 70 65 6c 4e 61 59 33 52 75 64 57 4d 31 4f 57 46 6c 64 46 4d 77 53 7a 4a 6c 4d 6b 6c 57 51 55 64 50 59 31 56 71 56 47 46 58 4d 45 31 36 51 6c 68 4c 63 33 41 32 4e 48 70 59 56 56 70 4b 64 45 56 61 54 57 52 5a 4d 6b 5a 48 64 44 52 6b 56 31 52 33 52 32 5a 72 62 56 68 51 61 48 4e 35 4c 7a 4e 4a 63 47 Data Ascii: 4MW1lM25JZUtKU1pHenRqYjU5UG5YR1YrazhkTHFKZXBhdmNTS0Urc0ZCM1BuV2FUVVRJZ2pSZWczUDcvR3FmZWNGNllIWVlQWGZPK2FFM0hDK21SU2d4d2dFZDZKV2FaSHpncWlaejNjaTcrR2NZMnJwWWFpelNaY3RudWM1OWFldFMwSzJlMklWQUdPY1VqVGFXME16QlhLc3A2NHpYVVpKdEVaTWRZMkZHdDRkV1R3R2ZrbVhQaHN5LzNJcG
2025-01-16 01:28:05 UTC	728	IN	Data Raw: 30 64 5a 57 6c 46 61 4c 30 63 32 59 6d 4a 57 65 44 46 4c 4e 30 56 70 65 47 74 4e 55 33 52 79 53 58 4d 77 62 6b 74 4f 4d 6b 6c 36 65 58 49 72 4e 54 64 45 64 6c 64 54 4e 44 52 71 4d 47 64 34 63 6a 52 4e 52 57 74 55 52 44 64 54 54 56 4e 33 4f 48 4e 56 51 7a 46 71 61 56 59 33 63 55 70 79 5a 54 4a 71 59 55 39 46 4e 30 31 54 64 6b 78 75 65 55 5a 47 62 6d 70 57 4d 6a 4a 34 56 6d 4e 77 54 32 52 54 51 7a 46 57 53 56 70 49 5a 55 70 6a 51 6d 31 36 61 58 5a 77 61 7a 56 48 4d 6a 5a 49 59 31 5a 34 5a 32 78 36 65 6b 74 6d 53 33 52 4a 62 6b 4d 30 55 6a 46 45 63 44 64 71 55 31 64 6e 63 56 41 76 57 6a 6f 55 51 57 35 75 5a 53 77 67 55 48 4a 70 62 6d 4e 6c 63 33 4d 67 55 6d 39 35 59 57 78 4b 42 79 4d 30 4d 6a 51 79 4e 44 4a 53 4e 6d 64 7a 58 33 4e 7a 63 44 31 6c 53 6e 70 71 Data Ascii: 0dZWlFaL0c2YmJWeDFLN0VpeGtNU3RySXMwbktOMkl6eXIrNTdEdldTNDRqMGd4cjRNRWtURDdTTVN3OHNVQzFqaVY3cUpyZTJqYU9FN01TdkxueUZGbmpWMjJ4VmNwT2RTQzFWSVpIZUpjQm16aXZwazVHMjZIY1Z4Z2x6ektmS3RJbkM0UjFEcDdqU1dncVAvWjoUQW5uZSwgUHJpbmNlc3MgUm95YWxKByM0MjQyNDJSNmdzX3NzcD1lSnpq
2025-01-16 01:28:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49725	142.250.185.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:28:05 UTC	846	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=KoODWxMvxS9VHeALumAO-hKAs6oyTu10HKswkmY4Jy2ZzRq2atO6ukoqKiVIPlVmp3QskgGGzKYGHxD-50R94tdJaduOuLBXRGHzf7SgcU4ab-Eq1gSPqq5pBUT0rVRdiZBQlGIP8kRez5k4yhym6gfYN_p67qSBBZpA0NiR58wHwGvhn5UgAKazHkYYYoGFAmXIMi4miQ
2025-01-16 01:28:05 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 01:28:05 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Ue3-TAhnQ2hEx--ELTl8mw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:28:05 UTC	124	IN	Data Raw: 65 32 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 74 77 69 6e 20 63 65 64 61 72 73 20 68 69 67 68 20 73 63 68 6f 6f 6c 22 2c 22 70 6c 61 6e 65 74 73 20 61 6c 69 67 6e 6d 65 6e 74 22 2c 22 72 69 63 68 6d 6f 6e 64 20 77 61 74 65 72 20 70 6c 61 6e 74 20 70 75 6d 70 20 66 61 69 6c 75 72 65 22 2c 22 70 72 69 6e 63 65 73 73 20 61 6e 6e 65 22 2c 22 64 69 61 62 6c 6f 20 34 20 73 Data Ascii: e2a)]}'["",["twin cedars high school","planets alignment","richmond water plant pump failure","princess anne","diablo 4 s
2025-01-16 01:28:05 UTC	1390	IN	Data Raw: 65 61 73 6f 6e 20 37 20 77 69 74 63 68 63 72 61 66 74 22 2c 22 70 6f 6c 61 72 20 76 6f 72 74 65 78 20 74 65 6d 70 65 72 61 74 75 72 65 73 22 2c 22 6e 79 74 20 6d 69 6e 69 20 63 72 6f 73 73 77 6f 72 64 20 63 6c 75 65 73 22 2c 22 6b 6f 68 6c 5c 75 30 30 32 37 73 20 73 74 6f 72 65 73 20 63 6c 6f 73 69 6e 67 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 Data Ascii: eason 7 witchcraft","polar vortex temperatures","nyt mini crossword clues","kohl\u0027s stores closing"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:su
2025-01-16 01:28:05 UTC	1390	IN	Data Raw: 34 4d 57 31 6c 4d 32 35 4a 5a 55 74 4b 55 31 70 48 65 6e 52 71 59 6a 55 35 55 47 35 59 52 31 59 72 61 7a 68 6b 54 48 46 4b 5a 58 42 68 64 6d 4e 54 53 30 55 72 63 30 5a 43 4d 31 42 75 56 32 46 55 56 56 52 4a 5a 32 70 53 5a 57 63 7a 55 44 63 76 52 33 46 6d 5a 57 4e 47 4e 6c 6c 49 57 56 6c 51 57 47 5a 50 4b 32 46 46 4d 30 68 44 4b 32 31 53 55 32 64 34 64 32 64 46 5a 44 5a 4b 56 32 46 61 53 48 70 6e 63 57 6c 61 65 6a 4e 6a 61 54 63 72 52 32 4e 5a 4d 6e 4a 77 57 57 46 70 65 6c 4e 61 59 33 52 75 64 57 4d 31 4f 57 46 6c 64 46 4d 77 53 7a 4a 6c 4d 6b 6c 57 51 55 64 50 59 31 56 71 56 47 46 58 4d 45 31 36 51 6c 68 4c 63 33 41 32 4e 48 70 59 56 56 70 4b 64 45 56 61 54 57 52 5a 4d 6b 5a 48 64 44 52 6b 56 31 52 33 52 32 5a 72 62 56 68 51 61 48 4e 35 4c 7a 4e 4a 63 47 Data Ascii: 4MW1lM25JZUtKU1pHenRqYjU5UG5YR1YrazhkTHFKZXBhdmNTS0Urc0ZCM1BuV2FUVVRJZ2pSZWczUDcvR3FmZWNGNllIWVlQWGZPK2FFM0hDK21SU2d4d2dFZDZKV2FaSHpncWlaejNjaTcrR2NZMnJwWWFpelNaY3RudWM1OWFldFMwSzJlMklWQUdPY1VqVGFXME16QlhLc3A2NHpYVVpKdEVaTWRZMkZHdDRkV1R3R2ZrbVhQaHN5LzNJcG
2025-01-16 01:28:05 UTC	729	IN	Data Raw: 30 64 5a 57 6c 46 61 4c 30 63 32 59 6d 4a 57 65 44 46 4c 4e 30 56 70 65 47 74 4e 55 33 52 79 53 58 4d 77 62 6b 74 4f 4d 6b 6c 36 65 58 49 72 4e 54 64 45 64 6c 64 54 4e 44 52 71 4d 47 64 34 63 6a 52 4e 52 57 74 55 52 44 64 54 54 56 4e 33 4f 48 4e 56 51 7a 46 71 61 56 59 33 63 55 70 79 5a 54 4a 71 59 55 39 46 4e 30 31 54 64 6b 78 75 65 55 5a 47 62 6d 70 57 4d 6a 4a 34 56 6d 4e 77 54 32 52 54 51 7a 46 57 53 56 70 49 5a 55 70 6a 51 6d 31 36 61 58 5a 77 61 7a 56 48 4d 6a 5a 49 59 31 5a 34 5a 32 78 36 65 6b 74 6d 53 33 52 4a 62 6b 4d 30 55 6a 46 45 63 44 64 71 55 31 64 6e 63 56 41 76 57 6a 6f 55 51 57 35 75 5a 53 77 67 55 48 4a 70 62 6d 4e 6c 63 33 4d 67 55 6d 39 35 59 57 78 4b 42 79 4d 30 4d 6a 51 79 4e 44 4a 53 4e 6d 64 7a 58 33 4e 7a 63 44 31 6c 53 6e 70 71 Data Ascii: 0dZWlFaL0c2YmJWeDFLN0VpeGtNU3RySXMwbktOMkl6eXIrNTdEdldTNDRqMGd4cjRNRWtURDdTTVN3OHNVQzFqaVY3cUpyZTJqYU9FN01TdkxueUZGbmpWMjJ4VmNwT2RTQzFWSVpIZUpjQm16aXZwazVHMjZIY1Z4Z2x6ektmS3RJbkM0UjFEcDdqU1dncVAvWjoUQW5uZSwgUHJpbmNlc3MgUm95YWxKByM0MjQyNDJSNmdzX3NzcD1lSnpq
2025-01-16 01:28:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49726	142.250.185.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:28:14 UTC	833	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=KoODWxMvxS9VHeALumAO-hKAs6oyTu10HKswkmY4Jy2ZzRq2atO6ukoqKiVIPlVmp3QskgGGzKYGHxD-50R94tdJaduOuLBXRGHzf7SgcU4ab-Eq1gSPqq5pBUT0rVRdiZBQlGIP8kRez5k4yhym6gfYN_p67qSBBZpA0NiR58wHwGvhn5UgAKazHkYYYoGFAmXIMi4miQ
2025-01-16 01:28:14 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 01:28:14 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-UvL9RWq7dP6eWYx2zxAv5g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:28:14 UTC	124	IN	Data Raw: 33 35 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 65 74 72 6f 20 72 65 77 69 6e 64 20 72 69 64 65 72 73 68 69 70 20 72 65 70 6f 72 74 20 32 30 32 34 22 2c 22 74 68 65 20 73 69 6d 73 20 34 20 32 35 74 68 20 61 6e 6e 69 76 65 72 73 61 72 79 20 75 70 64 61 74 65 22 2c 22 70 6f 6b c3 a9 6d 6f 6e 20 74 63 67 20 70 72 69 73 6d 61 74 69 63 20 65 76 6f 6c 75 74 69 6f 6e 73 22 Data Ascii: 357)]}'["",["metro rewind ridership report 2024","the sims 4 25th anniversary update","pokmon tcg prismatic evolutions"
2025-01-16 01:28:14 UTC	738	IN	Data Raw: 2c 22 63 72 69 73 20 72 6f 64 72 69 67 75 65 7a 20 64 65 74 72 6f 69 74 20 74 69 67 65 72 73 22 2c 22 66 75 6c 6c 20 6d 6f 6f 6e 20 77 6f 6c 66 20 6d 6f 6f 6e 22 2c 22 61 64 61 6d 20 73 61 6e 64 6c 65 72 20 62 69 67 20 64 61 64 64 79 20 32 22 2c 22 65 6c 64 65 72 20 73 63 72 6f 6c 6c 73 20 69 76 20 6f 62 6c 69 76 69 6f 6e 20 72 65 6d 61 6b 65 22 2c 22 67 74 61 20 36 20 72 6f 63 6b 73 74 61 72 20 67 61 6d 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 Data Ascii: ,"cris rodriguez detroit tigers","full moon wolf moon","adam sandler big daddy 2","elder scrolls iv oblivion remake","gta 6 rockstar games"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlb
2025-01-16 01:28:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49727	142.250.185.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:28:14 UTC	847	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=15&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=KoODWxMvxS9VHeALumAO-hKAs6oyTu10HKswkmY4Jy2ZzRq2atO6ukoqKiVIPlVmp3QskgGGzKYGHxD-50R94tdJaduOuLBXRGHzf7SgcU4ab-Eq1gSPqq5pBUT0rVRdiZBQlGIP8kRez5k4yhym6gfYN_p67qSBBZpA0NiR58wHwGvhn5UgAKazHkYYYoGFAmXIMi4miQ
2025-01-16 01:28:15 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 01:28:14 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tlXfSPMCogQPlHYmGz1ZMQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:28:15 UTC	124	IN	Data Raw: 33 35 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 65 74 72 6f 20 72 65 77 69 6e 64 20 72 69 64 65 72 73 68 69 70 20 72 65 70 6f 72 74 20 32 30 32 34 22 2c 22 74 68 65 20 73 69 6d 73 20 34 20 32 35 74 68 20 61 6e 6e 69 76 65 72 73 61 72 79 20 75 70 64 61 74 65 22 2c 22 70 6f 6b c3 a9 6d 6f 6e 20 74 63 67 20 70 72 69 73 6d 61 74 69 63 20 65 76 6f 6c 75 74 69 6f 6e 73 22 Data Ascii: 357)]}'["",["metro rewind ridership report 2024","the sims 4 25th anniversary update","pokmon tcg prismatic evolutions"
2025-01-16 01:28:15 UTC	738	IN	Data Raw: 2c 22 63 72 69 73 20 72 6f 64 72 69 67 75 65 7a 20 64 65 74 72 6f 69 74 20 74 69 67 65 72 73 22 2c 22 66 75 6c 6c 20 6d 6f 6f 6e 20 77 6f 6c 66 20 6d 6f 6f 6e 22 2c 22 61 64 61 6d 20 73 61 6e 64 6c 65 72 20 62 69 67 20 64 61 64 64 79 20 32 22 2c 22 65 6c 64 65 72 20 73 63 72 6f 6c 6c 73 20 69 76 20 6f 62 6c 69 76 69 6f 6e 20 72 65 6d 61 6b 65 22 2c 22 67 74 61 20 36 20 72 6f 63 6b 73 74 61 72 20 67 61 6d 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 Data Ascii: ,"cris rodriguez detroit tigers","full moon wolf moon","adam sandler big daddy 2","elder scrolls iv oblivion remake","gta 6 rockstar games"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlb
2025-01-16 01:28:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:27:38
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	20:27:39
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,65664859004425449,9395212604314751465,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	20:27:40
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.ch%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage